On the classification of Microsoft-Windows ransomware using hardware profile.

Area of Science:

• Computer Science
• Cybersecurity
• Machine Learning

Background:

• Ransomware attacks are increasing with online service usage.
• Ransomware poses a significant threat, denying device access until payment.
• Existing dynamic analysis techniques for malware detection have limitations.

Purpose of the Study:

• To investigate the effectiveness of hardware execution profiles for ransomware analysis.
• To determine if hardware performance counters can identify obfuscated ransomware.
• To compare machine learning algorithms for ransomware classification using hardware features.

Main Methods:

• Utilized hardware execution profiles for ransomware analysis.
• Extracted features from hardware performance counters.
• Employed machine learning algorithms (Random Forest, Decision Tree, Gradient Boosting, Extreme Gradient Boosting) for classification.
• Used a dataset of 80 ransomware and 80 non-ransomware applications from VirusShare.

Main Results:

• Hardware execution profiles provide a clear picture for identifying obfuscated ransomware.
• Extracted hardware features are crucial for ransomware detection.
• Random Forest and Extreme Gradient Boosting achieved an F-measure score of 0.97.

Conclusions:

• Hardware execution profiles are a beneficial approach for ransomware detection.
• Machine learning models leveraging hardware features show high efficacy in identifying ransomware.
• This method offers a promising direction for enhancing cybersecurity defenses against ransomware.