Enhancing ransomware defense: deep learning-based detection and family-wise classification of evolving threats

Area of Science:

• Cybersecurity
• Machine Learning
• Deep Learning

Background:

• Ransomware utilizes obfuscation techniques, making detection and classification challenging for traditional methods.
• Existing machine learning approaches struggle with advanced, obfuscated ransomware variants.
• Deep learning offers advanced capabilities for analyzing and classifying complex malware.

Purpose of the Study:

• To address the multi-class classification challenges in ransomware detection and family attribution.
• To propose and validate a novel deep learning model for enhanced ransomware identification.
• To improve the accuracy of detecting and classifying new ransomware variants.

Main Methods:

• Development of a novel group normalization-based bidirectional long short-term memory (GN-BiLSTM) model.
• Training and validation of the GN-BiLSTM model on the CIC-MalMem-2022 obfuscated malware dataset.
• Comparative analysis with five other deep learning models for performance evaluation.

Main Results:

• The GN-BiLSTM model achieved 99.99% accuracy in ransomware detection on the CIC-MalMem-2022 dataset.
• Category-wise classification accuracy reached 85.48%, and family identification accuracy was 74.65%.
• On a self-collected dataset, the model showed 99.20% detection, 97.44% category classification, and 96.23% family identification accuracy.

Conclusions:

• The proposed GN-BiLSTM approach demonstrates superior performance in detecting and classifying ransomware variants.
• This deep learning method is effective for identifying malware categories and families, even with obfuscation.
• The model shows significant potential for real-world implementation in advanced ransomware detection systems.