Ransomware Detection using Random Forest Technique

TLDR

Ransomware poses a serious threat to the computing world, demanding immediate measures to prevent financial and moral blackmail, yet prior detection approaches largely rely on complex dynamic analysis techniques. The study proposes a new static‑analysis‑based method to detect ransomware. The method extracts features directly from raw bytes using frequent pattern mining, selects 1,000 features with Gain Ratio, and applies a random forest classifier tuned on tree and seed numbers. The tuned random forest with 100 trees and seed 1 achieved optimal speed and accuracy, reaching 97.74 % detection accuracy.

Abstract

Nowadays, the ransomware became a serious threat challenge the computing world that requires an immediate consideration to avoid financial and moral blackmail. So, there is a real need for a new method that can detect and stop this type of attack. Most of the previous detection methods followed a dynamic analysis technique which involves a complicated process. The present study proposes a novel method based on static analysis to detect ransomware. The significant characteristic of proposed method is dispensing of disassemble process by direct extraction of features from raw byte with the use of frequent pattern mining which remarkably increases the detection speed. The Gain Ratio technique was used for feature selection which exhibited that 1000 features was the optimal number for detection process. The current study involved using random forest classifier with a comprehensive analysis to the effect of both tree and seed numbers on the ransomware detection. The results showed that tree numbers of 100 with seed number of 1 achieved best results in terms of time-consuming and accuracy. The experimental evaluation revealed that the proposed method could achieve a high accuracy of 97.74% for detection ransomware.