Abstract:Recently, the frequency and complexity of ransomware attacks have been increasing steadily, posing significant threats to individuals and organizations alike. While traditional signature-based antiransomware systems are effective in the detection of known threats, they struggle to identify new ransomware samples. To address this limitation, many researchers have focused on analyzing the behavior and actions of executables. During this dynamic analysis process, various dynamic-based features emerge, offering different perspectives on the executable's behavior, including Application Program Interface (API) call sequences, dynamic link libraries (DLLs), and mutual exclusions. Existing methods mostly perform machine or deep learning models for feature engineering and detection. These methods usually perform learning according to a single perspective or by combining data from different perspectives into the frequency domain. In this case, they may ignore the information from the other aspects or the sequence relationship between the features. In addition, learning models used in these solutions are mostly incomprehensible to humans, which could be an obstacle in terms of having an insight through the model's mentality and also ransomware's way of work. In this study, we provide XRan (eXplainable deep learning-based RANsomware detection using dynamic analysis), an Explainable Artificial Intelligence (XAI) supported ransomware detection system that combines different dynamic analysis-based sequences, each representing a different view of the executable, in order to enrich the feature space. XRan employs a Convolutional Neural Network (CNN) architecture to detect ransomware and two XAI models as Interpretable Model-Agnostic Explanations (LIME), and SHapley Additive exPlanations (SHAP) to provide local and global explanations for detection. Experimental results demonstrate that XRan provides up to 99.4% True Positive Rate (TPR), and outperforms the state-of-the-art methods.

Zero Day Ransomware Detection with Pulse: Function Classification with Transformer Models and Assembly Language

A comprehensive analysis combining structural features for detection of new ransomware families

Data-Centric Machine Learning Approach for Early Ransomware Detection and Attribution

A Transformer-Based Framework for Payload Malware Detection and Classification

Survey of Transformer-Based Malicious Software Detection Systems

RansomAI: AI-powered Ransomware for Stealthy Encryption

XRan: Explainable deep learning-based ransomware detection using dynamic analysis

A Lean Transformer Model for Dynamic Malware Analysis and Detection

Ransomware Classification Using Hardware Performance Counters on a Non-Virtualized System

Leveraging eBPF and AI for Ransomware Nose Out

EarlyMalDetect: A Novel Approach for Early Windows Malware Detection Based on Sequences of API Calls

Ransomware Detection and Classification Strategies

Machine Learning-based Ransomware Detection Using Low-level Memory Access Patterns Obtained From Live-forensic Hypervisor

Leveraging Machine Learning Techniques for Windows Ransomware Network Traffic Detection

Ransomware Detection: Leveraging Sandbox, Text Mining Techiques and Machine Learning

MalBERT: Using Transformers for Cybersecurity and Malicious Software Detection

A Survey of Machine Learning Algorithms for Detecting Ransomware Encryption Activity

Ransomware Analysis using Feature Engineering and Deep Neural Networks

Ranker: Early Ransomware Detection Through Kernel-Level Behavioral Analysis

Crypto-Ransomware and Their Defenses: In-depth Behavioral Characterization, Discussion of Deployability, and New Insights

Ransomware detection based on machine learning using memory features