Automatic Ransomware Detection and Analysis Based on Dynamic API Calls Flow Graph

TLDR

Ransomware poses a major threat to computer systems, and current signature‑based and static detection methods are easily evaded by obfuscation, polymorphism, compression, and encryption, making dynamic detection a pressing research area. This study proposes a dynamic ransomware detection system that employs data‑mining techniques—Random Forest, Support Vector Machine, Simple Logistic, and Naive Bayes—to identify both known and unknown ransomware. The system monitors software’s runtime behavior to construct API‑call flow graphs, transforms them into a feature space, applies data normalization and feature selection, and then trains the aforementioned classifiers to distinguish ransomware from benign software. Experimental results demonstrate that the proposed approach achieves an overall accuracy of 98.2 % and a detection rate of 97.6 % with the Simple Logistic algorithm, while reducing the false‑positive rate to 1.2 %.

Abstract

In recent cyber incidents, Ransom software (ransomware) causes a major threat to the security of computer systems. Consequently, ransomware detection has become a hot topic in computer security. Unfortunately, current signature-based and static detection model is often easily evadable by obfuscation, polymorphism, compress, and encryption. For overcoming the lack of signature-based and static ransomware detection approach, we have proposed the dynamic ransomware detection system using data mining techniques such as Random Forest (RF), Support Vector Machine (SVM), Simple Logistic (SL) and Naive Bayes (NB) algorithms for detecting known and unknown ransomware. We monitor the actual (dynamic) behaviors of software to generate API calls flow graphs (CFG) and transfer it in a feature space. Thereafter, data normalization and feature selection were applied to select informative features which are the best for discriminating between various categories of software and benign software. Finally, the data mining algorithms were used for building the detection model for judging whether the software is benign software or ransomware. Our experimental results show that our proposed system can be more effective to improve the performance for ransomware detection. Especially, the accuracy and detection rate of our proposed system with Simple Logistic (SL) algorithm can achieve to 98.2% and 97.6%, respectively. Meanwhile, the false positive rate also can be reduced to 1.2%.