eMIFS: A Normalized Hyperbolic Ransomware Deterrence Model Yielding Greater Accuracy and Overall Performance.

Area of Science:

• Cybersecurity
• Machine Learning

Background:

• Early detection of ransomware is crucial for mitigating damage.
• Feature selection is key to developing effective ransomware detection models.

Purpose of the Study:

• To propose an enhanced Mutual Information Feature Selection (eMIFS) technique using a normalized hyperbolic function for improved early ransomware detection.
• To address challenges in feature characteristic perception with limited attack data.

Main Methods:

• Utilized Term Frequency-Inverse Document Frequency (TF-IDF) for numerical feature representation.
• Incorporated a normalized hyperbolic function (tanh) within the MIFS framework to evaluate feature relevance and redundancy individually.
• Adapted MIFS for pre-encryption detection by improving redundancy coefficient estimation.

Main Results:

• The eMIFS method demonstrated superior efficacy in early-stage ransomware detection compared to traditional MIFS techniques.
• The normalized hyperbolic function significantly enhanced the feature selection process.
• Achieved a more robust and accurate ransomware detection model.

Conclusions:

• The proposed eMIFS technique offers a significant advancement in early ransomware detection.
• Individual feature evaluation using hyperbolic functions improves model performance.
• This approach provides a more effective solution for detecting ransomware before encryption.