Hussain Amjad, Saadia Ayesha, Alhussein Musaed, Gul Ammara, Aurangzeb Khursheed
Department of Cyber Security, Air University, Islamabad, Pakistan.
Department of Computer Science, Air University, Islamabad, Pakistan.
PeerJ Comput Sci. 2024 Nov 29;10:e2546. doi: 10.7717/peerj-cs.2546. eCollection 2024.
Ransomware is a type of malware that locks access to or encrypts its victim's files for a ransom to be paid to get back locked or encrypted data. With the invention of obfuscation techniques, it became difficult to detect its new variants. Identifying the exact malware category and family can help to prepare for possible attacks. Traditional machine learning-based approaches failed to detect and classify advanced obfuscated ransomware variants using existing pattern-matching and signature-based detection techniques. Deep learning-based approaches have proven helpful in both detection and classification by analyzing obfuscated ransomware deeply. Researchers have contributed mainly to detection and minimaly to family attribution. This research aims to address all these multi-class classification problems by leveraging the power of deep learning. We have proposed a novel group normalization-based bidirectional long short-term memory (GN-BiLSTM) method to detect and classify ransomware variants with high accuracy. To validate the technique, five other deep learning models are also trained on the CIC-MalMem-2022, an obfuscated malware dataset. The proposed approach outperformed with an accuracy of 99.99% in detection, 85.48% in category-wise classification, and 74.65% in the identification of ransomware families. To verify its effectiveness, models are also trained on 10,876 self-collected latest samples of 26 malware families and the proposed model has achieved 99.20% accuracy in detecting malware, 97.44% in classifying its category, and 96.23% in identifying its family. Our proposed approach has proven the best for detecting new variants of ransomware with high accuracy and can be implemented in real-world applications of ransomware detection.
勒索软件是一种恶意软件，它会锁定对受害者文件的访问权限或对其进行加密，以索要赎金来恢复被锁定或加密的数据。随着混淆技术的发明，检测其新变种变得困难。识别确切的恶意软件类别和家族有助于为可能的攻击做好准备。基于传统机器学习的方法无法使用现有的模式匹配和基于签名的检测技术来检测和分类先进的混淆勒索软件变种。基于深度学习的方法已被证明通过深入分析混淆勒索软件在检测和分类方面都很有帮助。研究人员主要在检测方面做出了贡献，而在家族归属方面贡献较少。本研究旨在通过利用深度学习的力量来解决所有这些多类分类问题。我们提出了一种基于组归一化的新型双向长短期记忆（GN-BiLSTM）方法，以高精度检测和分类勒索软件变种。为了验证该技术，还在一个混淆恶意软件数据集CIC-MalMem-2022上训练了其他五个深度学习模型。所提出的方法在检测准确率方面达到了99.99%，在类别分类方面达到了85.48%，在勒索软件家族识别方面达到了74.65%，表现出色。为了验证其有效性，还在26个恶意软件家族的10,876个自收集的最新样本上训练了模型，所提出的模型在检测恶意软件方面达到了99.20%的准确率，在分类其类别方面达到了97.44%，在识别其家族方面达到了96.23%。我们提出的方法已被证明是检测勒索软件新变种的最佳方法，具有高精度，可应用于勒索软件检测的实际应用中。
