Abstract:Ransomware is a special kind of malware, which leads to irreversible data losses and incurs enormous economic costs. It is an urgent task to detect ransomware nowadays. Further, in order to achieve appropriate defenses and reduce analysts’ workloads, ransomware must be not only detected, but also classified into families. Some ransomware, e.g., fingerprinting ransomware, can fingerprint the run-time environment and evade dynamic analysis. To detect this type of ransomware and speed up the processing in comparison to dynamic analyses, we propose a static analysis framework based on N-gram opcodes with deep learning. Since opcode sequences obtained from executable files have rich context and semantic information, we view the opcode sequence from a natural language sentences perspective. However, the lengths of the N-gram opcode sequences are widely different, ranging from hundreds to millions. Among them, the extremely long sequences are far beyond the ability of most of the deep neural network based sequence classifier, such as RNN. To address this problem and enhance the scalability of our framework, we partition the N-gram sequence into many patches and feed each patch into a self-attention based convolution neural network named SA-CNN. Subsequently, the outputs of SA-CNNs are concatenated and put into a bi-directional self-attention network to get the ransomware classification result. Compared with CNN and RNN, the self-attention mechanism exhibits the brilliant ability to capture complementary information of the distance-aware dependencies with high computational efficiency. To the best of our knowledge, we are the first to exploit self-attention mechanism on opcode sequences for ransomware classification. With the partition strategy and the power of the self-attention network, the framework captures rich context and semantic information from the extremely long sequence. The comprehensive experiments on a real-world dataset show that the proposed framework outperforms the state-of-the-art methods in many evaluations.

Detection of ransomware attacks using federated learning based on the CNN model

Ransomware Detection Using Federated Learning with Imbalanced Datasets

Federated Learning Approach for Distributed Ransomware Analysis

Using Graph Neural Network to Ransomware Detection for Cyber Threats

Leveraging Machine Learning Techniques for Windows Ransomware Network Traffic Detection

A few-shot meta-learning based siamese neural network using entropy features for ransomware classification

Crypto-ransomware detection using machine learning models in file-sharing network scenario with encrypted traffic

Ransomware threat mitigation through network traffic analysis and machine learning techniques

Ransomware Classification and Detection With Machine Learning Algorithms

Data-Centric Machine Learning Approach for Early Ransomware Detection and Attribution

Ransomware Detection and Classification Strategies

Detection method of ransomware based on machine learning

A Study on Countermeasures against Neutralizing Technology: Encoding Algorithm-Based Ransomware Detection Methods Using Machine Learning

Ransomware detection based on machine learning using memory features

Ransomware Analysis using Feature Engineering and Deep Neural Networks

Ransomware Classification Using Patch-Based CNN and Self-Attention Network on Embedded N-grams of Opcodes

Visualizing Portable Executable Headers for Ransomware Detection: A Deep Learning-Based Approach

Android Ransomware Detection Using Supervised Machine Learning Techniques Based on Traffic Analysis

Ransomware Detection: Leveraging Sandbox, Text Mining Techiques and Machine Learning

A Survey of Machine Learning Algorithms for Detecting Ransomware Encryption Activity

FedDICE: A ransomware spread detection in a distributed integrated clinical environment using federated learning and SDN based mitigation