A Machine Learning-Based Ransomware Detection Method for Attackers' Neutralization Techniques Using Format-Preserving...

Area of Science:

• Cybersecurity
• Machine Learning
• Malware Analysis

Background:

• Ransomware encrypts files, demanding payment and causing global damage.
• Traditional detection methods struggle against advanced ransomware techniques like format-preserving encryption (FPE).
• Attackers manipulate file entropy and use FPE to bypass existing security measures.

Purpose of the Study:

• To develop and evaluate a machine learning-based method for detecting ransomware-infected files encrypted with FPE.
• To address the limitations of current detection technologies against sophisticated ransomware.
• To counter ransomware neutralization attacks that manipulate entropy and employ FPE.

Main Methods:

• Implementation of machine learning models including K-Nearest Neighbors (KNN), Logistic Regression, and Decision Tree.
• Training and testing models on datasets containing ransomware-infected files encrypted using FPE.
• Evaluation of model performance in detecting FPE-encrypted ransomware.

Main Results:

• Most machine learning models, excluding Logistic Regression and Multi-Layer Perceptron (MLP), successfully detected FPE-encrypted ransomware.
• The proposed method achieved an average precision of 94.64% across various datasets.
• The study demonstrated the effectiveness of machine learning in identifying ransomware that bypasses entropy-based detection.

Conclusions:

• Machine learning offers a robust solution for detecting ransomware employing format-preserving encryption.
• The proposed method effectively counters advanced ransomware tactics that manipulate file entropy.
• This research advances ransomware detection capabilities, improving protection against evolving cyber threats.