An experimental study to evaluate the performance of machine learning algorithms in ransomware detection

Dion, Yap; Brohi, Sarfraz N.

Abstract

The research in the domain of ransomware is rapidly emerging, and the application of machine learning algorithms in ransomware detection is one of the recent breakthroughs. In this research, we constructed an experimental platform using ransomware datasets to compare the performance of various machine learning algorithms such as Random Forest, Gradient Boosting Decision Tree (GBDT), Neural Network using Multilayer Perceptron as well as three types of Support Vector Machine (SVM) kernels in ransomware detection. Our experiment is based on a combination of different methodologies reported in the existing literature. We used complete executable files in our experiment, analyzed the opcodes and measures their frequencies. The objective of this research was to discover the algorithms that are highly suitable to develop models as well as systems for ransomware detection. Consequently, we identified that Random Forest, GBDT and SVM (Linear) have shown optimal results in detection of ransomware.

• Journal Article Type: Article
• Acceptance Date: Jan 6, 2020
• Publication Date: Apr 1, 2020
• Deposit Date: Sep 9, 2022
• Journal: Journal of Engineering Science and Technology
• Electronic ISSN: 1823-4690
• Peer Reviewed: Peer Reviewed
• Volume: 15
• Issue: 2
• Pages: 967-981
• Keywords: Decision tree, Gradient boosting, Machine learning, Neural network, Random forest, Ransomware, Support vector machine
• Public URL: https://uwe-repository.worktribe.com/output/9958923
• Publisher URL: https://jestec.taylors.edu.my/Vol%2015%20issue%202%20April%202020/15_2_17.pdf