Early Ransomware Detection with Deep Learning Models

Matan Davidian, Michael Kiperberg and Natalia Vanetik ()
Additional contact information
Matan Davidian: Department of Software Engineering, Shamoon College of Engineering, Beer Sheva 84100, Israel
Michael Kiperberg: Department of Software Engineering, Shamoon College of Engineering, Beer Sheva 84100, Israel
Natalia Vanetik: Department of Software Engineering, Shamoon College of Engineering, Beer Sheva 84100, Israel

Future Internet, 2024, vol. 16, issue 8, 1-37

Abstract: Ransomware is a growing-in-popularity type of malware that restricts access to the victim’s system or data until a ransom is paid. Traditional detection methods rely on analyzing the malware’s content, but these methods are ineffective against unknown or zero-day malware. Therefore, zero-day malware detection typically involves observing the malware’s behavior, specifically the sequence of application programming interface (API) calls it makes, such as reading and writing files or enumerating directories. While previous studies have used machine learning (ML) techniques to classify API call sequences, they have only considered the API call name. This paper systematically compares various subsets of API call features, different ML techniques, and context-window sizes to identify the optimal ransomware classifier. Our findings indicate that a context-window size of 7 is ideal, and the most effective ML techniques are CNN and LSTM. Additionally, augmenting the API call name with the operation result significantly enhances the classifier’s precision. Performance analysis suggests that this classifier can be effectively applied in real-time scenarios.

Keywords: ransomware; deep learning; API call sequences; cybersecurity; malware detection; behavioral analysis (search for similar items in EconPapers)
JEL-codes: O3 (search for similar items in EconPapers)
Date: 2024
References: View complete reference list from CitEc
Citations:

Downloads: (external link)
https://www.mdpi.com/1999-5903/16/8/291/pdf (application/pdf)
https://www.mdpi.com/1999-5903/16/8/291/ (text/html)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:gam:jftint:v:16:y:2024:i:8:p:291-:d:1454141

Access Statistics for this article

Future Internet is currently edited by Ms. Grace You

More articles in Future Internet from MDPI
Bibliographic data for series maintained by MDPI Indexing Manager ().