Dynamic Feature Dataset for Ransomware Detection Using Machine Learning Algorithms.

Area of Science:

• Computer Science
• Cybersecurity
• Machine Learning

Background:

• Ransomware cyber-attacks have significantly increased, posing a substantial threat to organizations.
• Existing detection methods struggle to keep pace with evolving ransomware threats.

Purpose of the Study:

• To develop and validate a machine learning model for detecting ransomware using dynamic analysis.
• To identify and utilize the most relevant dynamic features for distinguishing ransomware from benign software.
• To create and share a public dataset of dynamic features for ransomware analysis.

Main Methods:

• Dynamic analysis of encryptor and locker ransomware alongside goodware using a sandbox environment.
• Feature selection to identify non-redundant and discriminative dynamic parameters.
• Development of a public dataset comprising 2000 registers with 50 characteristics each.
• Application of machine learning algorithms (Gradient Boosted Regression Trees, Random Forest, Neural Networks) with 10-fold cross-validation.

Main Results:

• A curated dataset of dynamic features was generated from 20 ransomware and 20 goodware samples across five platforms.
• Machine learning models achieved an average accuracy exceeding 0.99 in detecting ransomware.
• The selected dynamic features proved effective in identifying both current and novel ransomware variants.

Conclusions:

• Dynamic analysis combined with machine learning offers a robust solution for advanced ransomware detection.
• The developed dataset and models can significantly improve the ability to combat evolving ransomware threats.
• This research contributes a valuable resource for the cybersecurity community in the fight against malware.