Ransomware Detection with Semi-Supervised Learning

Abstract

Today, ransomware is one of the most harmful cybersecurity threats that organizations and people face. Hence, there is a vital need for developing effective ransomware detection methods. Machine learning methods can be very useful for ransomware detection if there is sufficient labeled data for training. However, labeling data is time-consuming and expensive while a huge amount of unlabeled data exists. To cope with this problem, semi-supervised learning can be employed that exploits a few labeled data and a lot of unlabeled data for learning. To our best knowledge, there is no research investigating semi-supervised learning methods for ransomware detection. In this paper, we analyze different feature selection and semi-supervised classification methods applied to the CICAndMal 2017 dataset. Our findings suggest that the wrapper semi-supervised classification method using the random forest as a base classifier and OneR or Chi-squared as a feature selection method outperforms the other semi-supervised classification methods for ransomware detection.