Ransomware Early Detection Model using API-Calls at Runtime by Random Decision Forests
Authors
IZAZ AHMAD KHAN, FAIZAN ULLAH, MOHAMMAD ABRAR, SABIR SHAH, FAWAD TAJ, MUHAMMAD IMRAN KHAN KHALIL and ABDU SALAM
Abstract
Ransomware is a destructive type of malware that encrypts the user’s valuable data or locks the screen of the user’s device, causing massive economic losses to users. Signature-based ransomware detection models struggle to detect zero-day ransomware and questioning their suitability for protecting user’s files against such attacks. In this study, we propose a model that extracts eighteen useful features vectors from the ransomware dataset. It performs classification on ransomware datasets. We utilize API call series to represent behavior-based features of ransomware. To validate the effectiveness of Random Forest, we tested 78556 ransomware and good ware files. Compared to Naive Bayes and Support Vector Machine, the testing accuracy of the proposed method is 99.57%. In the future, we will use deep learning to detect ransomware and its types at an early stage.
Keywords: Malware Analysis, Machine Learning, Virus Total, Random Forest, Support Vector Machine.
