Abstract:In today's digitalized era, the usage of Android devices is being extensively witnessed in various sectors. Cybercriminals inevitably adapt to new security technologies and utilize these platforms to exploit vulnerabilities for nefarious purposes, such as stealing users' sensitive and personal data. This may result in financial losses, discredit, ransomware, or the spreading of infectious malware and other catastrophic cyber-attacks. Due to the fact that ransomware encrypts user data and requests a ransom payment in exchange for the decryption key, it is one of the most devastating types of malicious software. The implications of ransomware attacks can range from a loss of essential data to a disruption of business operations and significant monetary damage. Artificial intelligence (AI)-based techniques, namely machine learning (ML), have proven to be notable in the detection of Android ransomware attacks. However, ensemble models and deep learning (DL) models have not been sufficiently explored. Therefore, in this study, we utilized ML- and DL-based techniques to build efficient, precise, and robust models for binary classification. A publicly available dataset from Kaggle consisting of 392,035 records with benign traffic and 10 different types of Android ransomware attacks was used to train and test the models. Two experiments were carried out. In experiment 1, all the features of the dataset were used. In experiment 2, only the best 19 features were used. The deployed models included a decision tree (DT), support vector machine (SVM), k-nearest neighbor (KNN), ensemble of (DT, SVM, and KNN), feedforward neural network (FNN), and tabular attention network (TabNet). Overall, the experiments yielded excellent results. DT outperformed the others, with an accuracy of 97.24%, precision of 98.50%, and F1-score of 98.45%. Whereas, in terms of the highest recall, SVM achieved 100%. The acquired results were thoroughly discussed, in addition to addressing limitations and exploring potential directions for future work.

Ransomware Classification and Detection With Machine Learning Algorithms

Ransomware Detection and Classification Strategies

BigRC-EML: big-data based ransomware classification using ensemble machine learning

Android Ransomware Detection Using Supervised Machine Learning Techniques Based on Traffic Analysis

Ransomware detection based on machine learning using memory features

Ransomware Analysis using Feature Engineering and Deep Neural Networks

Ransomware Detection: Leveraging Sandbox, Text Mining Techiques and Machine Learning

Data-Centric Machine Learning Approach for Early Ransomware Detection and Attribution

Machine learning-based ransomware classification of Bitcoin transactions

Leveraging Machine Learning Techniques for Windows Ransomware Network Traffic Detection

Ransomware threat mitigation through network traffic analysis and machine learning techniques

Ransomware Detection Using Machine Learning: A Review, Research Limitations and Future Directions

A Study on Countermeasures against Neutralizing Technology: Encoding Algorithm-Based Ransomware Detection Methods Using Machine Learning

Dynamic Feature Dataset for Ransomware Detection Using Machine Learning Algorithms

A few-shot meta-learning based siamese neural network using entropy features for ransomware classification

A Survey of Machine Learning Algorithms for Detecting Ransomware Encryption Activity

Application of Explainable Machine Learning in Detecting and Classifying Ransomware Families Based on API Call Analysis

Android ransomware detection using a novel hamming distance based feature selection

Crypto-ransomware detection using machine learning models in file-sharing network scenario with encrypted traffic

Classification of ransomware families with machine learning based on N-gram of opcodes.

Ransomware Detection and Classification Using Random Forest: A Case Study with the UGRansome2024 Dataset