Detecting Ransomware Through Dynamic API Call Monitoring and Machine Learning

Ransomware is malicious software that encrypts user files, rendering them inaccessible unless a ransom is paid to the attacker. Ransomware detection has been a challenge recently. In this paper, we present a comprehensive analysis of ransomware detection using machine learning (ML) on Application Program Interface (API) calls made by malicious and non-malicious processes. The analysis is conducted on different ML models, including Random Forest, Long Short-Term Memory, Support Vector Machine, K-Nearest Neighbors, XGBoost, Linear Discriminant Analysis, and an ensemble model. The models were analyzed using two datasets: a primary public dataset and a zero-day dataset representing previously unseen real-world ransomware generated with no overlap with the primary dataset. For the primary dataset, the results indicate high detection accuracy of 99.82% for the ensemble model. On the other hand, testing on the zero-day ransomware results in a 96.3% accuracy while imposing minimal overhead on the CPU and memory of the machine. To boost the confidence in the detection method, we analyzed the detection time and the percentage of files saved because of the timely response of the proposed detection method. The results indicate that detection was done in a timely manner, saving on average 93% of the files under ransomware attack.