Ransomware detection by cognitive security.

Abstract

This research applies dynamic analysis and machine learning to identify the ever-evolving ransomware signatures using selected dynamic features. Our study can be used for detecting current and even new variants of the threat. This research has the following objectives: (1) Execute experiments with encryptor and locker ransomware combined with goodware to generate JSON files with dynamic parameters using a sandbox. (2) Analyze and select the most relevant and non-redundant dynamic features for identifying encryptor and locker ransomware from goodware. (3) Generate and make public a dynamic features dataset that includes these selected parameters for samples of different artifacts. (4) Apply the dynamic feature dataset to obtain models with machine learning algorithms. Five platforms, 20 ransomware, and 20 goodware artifacts were evaluated. The final feature dataset is composed of 2000 registers of 50 characteristics each. This dataset allows for a machine learning detection with a 10-fold cross-evaluation with an average accuracy superior to 0.99 for gradient boosted regression trees, random forest, and neural networks. In addition, an application was developed to extract information from the dynamic analysis of the artifacts generated by the sandbox. Additionally, a client-server architecture was established for deployment and application in the protection stage. The models´ performance were evaluated with the new test data to simulate this early protection phase for deployment. The obtained results were very satisfactory