Abstract:In today's digitalized era, the usage of Android devices is being extensively witnessed in various sectors. Cybercriminals inevitably adapt to new security technologies and utilize these platforms to exploit vulnerabilities for nefarious purposes, such as stealing users' sensitive and personal data. This may result in financial losses, discredit, ransomware, or the spreading of infectious malware and other catastrophic cyber-attacks. Due to the fact that ransomware encrypts user data and requests a ransom payment in exchange for the decryption key, it is one of the most devastating types of malicious software. The implications of ransomware attacks can range from a loss of essential data to a disruption of business operations and significant monetary damage. Artificial intelligence (AI)-based techniques, namely machine learning (ML), have proven to be notable in the detection of Android ransomware attacks. However, ensemble models and deep learning (DL) models have not been sufficiently explored. Therefore, in this study, we utilized ML- and DL-based techniques to build efficient, precise, and robust models for binary classification. A publicly available dataset from Kaggle consisting of 392,035 records with benign traffic and 10 different types of Android ransomware attacks was used to train and test the models. Two experiments were carried out. In experiment 1, all the features of the dataset were used. In experiment 2, only the best 19 features were used. The deployed models included a decision tree (DT), support vector machine (SVM), k-nearest neighbor (KNN), ensemble of (DT, SVM, and KNN), feedforward neural network (FNN), and tabular attention network (TabNet). Overall, the experiments yielded excellent results. DT outperformed the others, with an accuracy of 97.24%, precision of 98.50%, and F1-score of 98.45%. Whereas, in terms of the highest recall, SVM achieved 100%. The acquired results were thoroughly discussed, in addition to addressing limitations and exploring potential directions for future work.

Enhanced Android Ransomware Detection Through Hybrid Simultaneous Swarm-Based Optimization

Detection and Analysis of Android Ransomware Using the Support Vector Machines

RiskRanker: scalable and accurate zero-day android malware detection.

Prediction of android ransomware with deep learning model using hybrid cryptography

Android Ransomware Detection Using Supervised Machine Learning Techniques Based on Traffic Analysis

Lightweight Crypto-Ransomware Detection in Android Based on Reactive Honeyfile Monitoring

Android ransomware detection using a novel hamming distance based feature selection

Integrating Ebola optimization search algorithm for enhanced deep learning-based ransomware detection in Internet of Things security

Metaheuristics with Deep Learning Model for Cybersecurity and Android Malware Detection and Classification

Real-time system call-based ransomware detection

Ransomware detection based on machine learning using memory features

Ransomware in Windows and Android Platforms

Hybrid Android Malware Detection: A Review of Heuristic-Based Approach

A Weighted Minimum Redundancy Maximum Relevance Technique for Ransomware Early Detection in Industrial IoT

A Study on Countermeasures against Neutralizing Technology: Encoding Algorithm-Based Ransomware Detection Methods Using Machine Learning

Artificial Intelligence Algorithms for Malware Detection in Android-Operated Mobile Devices

A comprehensive analysis combining structural features for detection of new ransomware families

It's too late if exfiltrate: Early stage Android ransomware detection

Android malware classification based on random vector functional link and artificial Jellyfish Search optimizer

A Survey of Crypto Ransomware Attack Detection Methodologies: An Evolving Outlook

Ransomware Detection: Leveraging Sandbox, Text Mining Techiques and Machine Learning