RANSOMWARE DETECTION

‫‪RANSOMWARE‬‬ ‫‪DETECTION‬‬

‫دانشجویان ‪ :‬یگانه یاوری و حانیه نباتیان‬ ‫استاد راهنما ‪ :‬جناب آقای دکتر شاکری‬

Research Paper

1.Introduction

Ransomware has recently (re)emerged as a popular malware aimed at individuals and organizations that generally blocks access to your files; usually by encrypting your data, deleting your backups and asks for a ransom in exchange for the decryption key.

Nowadays, the ransomware became a serious threat challenge the computing world that requires an immediate consideration to avoid financial and moral blackmail.

Ransomware damages from 2015 to 2021

SECURITY

This article investigates the machine learning technique for the classification of ransomware using random forest and features extracted from raw byte of the file. Different size of seed and tree have been tested experimentally in order to design the best random forest classifier that can detect ransomware accurately.

The detection techniques classified into three categories:

1. Dynamic analysis Most ransomwares detection solutions are relying on behavioral detection which called “dynamic analysis

2. Static analysis Static analysis is a passive approach

3. hybrid system Combine dynamic and static analysis.

Detection technique

2.Related works

97.48% Takeuchi et al.

Detected the ransomware based on dynamic analysis using SVM classifier.

Since dynamic analysis executes the ransomware, it has a high accuracy rate. However, this analysis takes a relatively long time to process and analyze it.

96.3%.

Kharraz et al.

Utilized a dynamic analysis system called UNVEIL to detect ransomware.

dynamic analysis

2.Related works

91.43% Zhang et al.

Used opcode based as features to be used in ransomware detection.

A few analysts have proposed methods based on static analysis to detect ransomware attack.

96.5% Baldwin and Dehghantanha They extracted the opcode characteristics as the features to be used as input to the machine learning technique represented by SVM classifier.

static analysis

Related works

98.25% Shaukat and Ribeiro They introduced a Strong Trap Layer using a hybrid system of dynamic and static analysis with the use of machine learning techniques.

Some researchers used a hybrid technique combines between dynamic analysis and static analysis to detect ransomware.

Subedi et al.

Utilized dynamic analysis and static analysis in three different levels; assembly, function calls and library.

hybrid system

R a n d o m F o r e s t

This article provides a novel framework to solve the problem of detecting ransomware attack using static analysis and one of the prominent and robust machine learning technique called random forest classifier.

The proposed method

1

3

Preprocessing

Classification

Includes three steps namely feature extraction from raw bytes, frequent pattern mining, and normalization.

The current model utilized the random forest classifier which is one of the supervised learning technique that widely adopted in many studies

2 Feature Selection Gain Ratio (GR) has been chosen as one of feature selection methods.

Dataset

The dataset consists of 1680 executable files Both ransomware and goodware are checked using virustotal.com. Virus Total is a free tool that used to detect whether file is goodware or ransomware file. The present method was implemented using computer of Core i7 CPU with 8 core, and 16 GB RAM with two systems; Windows 10, and Linux 4.1.

Experimental results and discussion

The first step in experiments is dividing the preprocessed data into two group; training and testing.

the experimental analysis utilized different size of the tree and different number of the seed in each tree. WEKA (WEKA GUI based machine learning tool) is used to find the best design of random forest classifier that provide high accuracy in detecting ransomware attack.

Experimental results and discussion The common machine learning performance evaluation metrics

True Positive (TP) The number of ransomware that is correctly predicted as ransomware.

True Negative (TN)

03 02

The number of goodware files that are correctly classified as goodware.

04

False Positive (FP) The number of goodware files misclassified as ransomware.

False Negative (FN)

01

05

The number of ransomware which is misclassified as goodware.

Recall, F-Measure, Precision, and ROC for different features dimension.

The effect of features dimension

To explore the suitable effective size of features dimension to build the classifier, various number of features have been tested ranging from 1000 to 7000 with a seed number of 1 and tree set of 100.

The remained size of the features from 100 to 1000 is not included in this result because they gave a very bad detection rate

The accuracy for different features dimension.

Accuracy, Recall, F-Measure, Precision, and ROC for different tree number.

The effect of tree and seed numbers

The current study has tested different sizes of tree changing from 10–1000 and the size of seed changing from 1–1000.

Several experiments have been conducted to find the best number of trees in terms of accuracy, recall, FMeasure, precision, and ROC value for the tree number from 10 to 100

The time for classification build using 1000 features diminution, the test dataset using different number of tree (10 to 1000) for the random forest classifier.

The effect of tree and seed numbers

The results show that best result of accuracy is 97.74% for seed numbers of one

To find the effect of seed numbers on the performance of the classifier.

Text Here

The number of trees is maintained at 100, while the seed numbers is changing from 1 to 1000.

in most cases choosing one seed is efficient.

The standard classification measures of different classifiers when 10-fold cross validation has been used.

The effect of tree and seed numbers To prove the ability of RF classifier in detection ransomware attack, three different types of classifiers have been used for comparison namely Ada Boost M1, Bagging, and Rotation Forest.

The standard classification measures of different classifiers.

The present study is compared with the results of Zhang et al. [Classification of ransomware families with machine learning based on N-gram of opcodes] which used opcode based to represent them using n-gram as a features.

The comparison

Conclusion A

C

The experiments show a magnificent performance of random forest classifier with the byte level static analysis for ransomware attack detection.

The features from 100 to 1000 showed bad detection rate. Also, the increasing features number more than 1000 led to a degradation in accuracy.

SECURITY

B

D

The current analysis emphasized that tree size of 100 with seed size of 1 achieved a high accuracy of (97.74%), high ROC about 99.6%, low FPR (around 0.04), and low FNR (around 0.002) in just 1.37 s time of detection.

The number of tree from (200 to 1000) showed the same performance of that of 100.

THANK YOU