Intelligent Behavioral Analysis for Detection of Ransomware Threats

Ransomware is a type of malware that can encrypt files, cause disruption to computers and cause monetary and data loss. Signature-based security solutions may not be able to detect newer, modified and/or obfuscated ransomware. This paper presents an Intelligent Ransomware Detection System (IRDS). The system uses machine learning techniques to classify ransomware types. It uses a binary classifier based on memory forensics, which used the Obfuscated-MalMem2022 dataset. A multi-class approach was also used to classify 5 different ransomware families. The system contains a real-time monitor for detecting anomalies in file system/process activity. An executable scanner was also included. The data was preprocessed and reduced using Recursive Feature Elimination (RFE) and Principal Component Analysis (PCA). Random Forest was chosen as it was shown to perform better than other classifiers such as Decision Tree, Logistic Regression, Naive Bayes and Support Vector Machine. The memory forensic results showed Random Forest achieved a high accuracy of 99.97%. The results from the RFE/PCA experiment showed an accuracy of 99.98% with 6 dimensions. The results of the 5 family classification were 46.75% weighted accuracy. This shows there is more work to be done to improve this part of the system. A desktop application has been made to allow scanning, monitoring, alerting, scan history and producing a PDF report. The results show it is possible to create a prototype detection system. However, more validation should be done with a variety of different real-world data.