Ransomware Detection and Classification using Feature Selection and Machine learning Techniques

  • Samuel Egunjobi

Student thesis: Doctoral Thesis

Abstract

Researchers have developed techniques to detect ransomware attacks, but due to constant evolution, there is an increasing need to research and develop new techniques to not only detect ransomware samples but also identify new and evolving samples of ransomware. This research considers ransomware features acquired from static, behavioural, and network sources to help identify and classify ransomware sources. In this research project, this was achieved by using feature selection techniques to obtain an optimal dataset. The features are collected using Cuckoo Sandbox environment, which utilized nested virtualization to maintain host protection. The optimal set representing the best features of ransomware samples regardless of their variant or file type was used in the training stage of the machine learning analysis starting with a baseline algorithm ZeroR which showed average performance in training with an increase in performance at the testing stage, other classifier algorithms were investigated such as Random Forest, Naïve Bayes, Random Tree, Kstar, SMO and CVR to ensure the result is uniform regardless of the classifier with Kstar and Naïve Bayes as the top performers at both the training and testing stage. To ensure the diagnostic accuracy of this research, metrics that were used to quantify the efficiency and performance of the algorithms included the percentage of correctly classified instances, the accuracy of the classification and the Youden’s index. It was considered that accuracy is a better metric to measure the accuracy of the algorithms in the classification because it considers both type 1 and type 2 errors with Youden’s index even better since it considers the sensitivity and specificity of the algorithms. This research improves on the classification of ransomware using machine learning which used ransomware samples of filetype EXE and similar goodwares with the classification of ransomware samples that exist in other filetypes contributing to the development of a better way of mitigating against the rising ransomware attacks.
Date of Award26 Mar 2024
Original languageEnglish
SupervisorSimon Parkinson (Main Supervisor) & Andrew Crampton (Co-Supervisor)

Cite this

'