Ransomware detection using deep learning based unsupervised feature extraction and a cost sensitive Pareto Ensemble...

Area of Science:

• Cybersecurity
• Machine Learning
• Network Security

Background:

• Ransomware attacks, particularly zero-day variants, pose a significant threat to internet resources.
• Conventional machine learning methods struggle with zero-day attacks due to data dependency and insensitivity to error costs.

Purpose of the Study:

• To present a novel Cost-Sensitive Pareto Ensemble (CSPE-R) strategy for detecting unknown ransomware attacks.
• To address the limitations of traditional machine learning in handling zero-day ransomware variants with unseen data distributions.

Main Methods:

• Utilizes unsupervised deep Contractive Auto Encoder (CAE) for feature space transformation.
• Employs an ensemble technique exploring various semantic spaces for robust feature learning.
• Implements a Pareto Ensemble-based strategy for cost-sensitive selection of estimators to balance false positives and negatives.

Main Results:

• The CSPE-R framework demonstrates effective detection of novel ransomware attacks.
• Experimental results confirm the framework's strong performance against zero-day ransomware threats.
• The proposed method successfully transforms feature spaces and aggregates decisions for improved detection.

Conclusions:

• The CSPE-R strategy offers a robust solution for identifying zero-day ransomware attacks.
• The approach effectively handles unseen data distributions and mitigates risks associated with novel threats.
• CSPE-R provides a cost-sensitive compromise, enhancing overall ransomware detection capabilities.