Ransomware Classification Using Machine Learning

The rise of ransomware has emerged as a pressing concern for the technology industry, demanding prompt action to prevent monetary and ethical exploitation. Therefore, an accurate approach is imperative to identify and thwart such attacks effectively. Most of the prior ransomware detection techniques either are signature-based, which are inefficient to identify new ransomware, or utilize a dynamic analysis, which are complicated and computationally expensive. This paper proposes a feature selection-based framework along with different machine learning and deep learning algorithms that can effectively detect ransomware based on features extracted from the files. We performed various experiments beginning with filter, wrapper and embedded methods of feature selection and then applied Decision Tree (DT), Random Forest (RF), Naïve Bayes (NB), Logistic Regression (LR), Support Vector Machine (SVM), k-Nearest Neighbor (KNN), Extreme Gradient Boost (XGB) and Multi-layer Perceptron (MLP) on a ransomware dataset that contains the features and label from files. The experimental results demonstrate that RF and MLP classifiers with ANOVA filter method of feature selection outperform other methods in terms of accuracy, precision, and recall.