A Survey of Machine Learning Algorithms for Detecting Ransomware Encryption Activity
This work addresses ransomware detection for cybersecurity systems, but it is incremental as it builds on existing sensor-based methods.
This survey paper tackles the problem of detecting ransomware encryption activity by evaluating machine learning algorithms on sensor-based data. The Multilayer Perceptron achieved 97% accuracy and F1 score, demonstrating that sensor-based detection can identify zero-day ransomware attacks before full execution.
A survey of machine learning techniques trained to detect ransomware is presented. This work builds upon the efforts of Taylor et al. in using sensor-based methods that utilize data collected from built-in instruments like CPU power and temperature monitors to identify encryption activity. Exploratory data analysis (EDA) shows the features most useful from this simulated data are clock speed, temperature, and CPU load. These features are used in training multiple algorithms to determine an optimal detection approach. Performance is evaluated with accuracy, F1 score, and false-negative rate metrics. The Multilayer Perceptron with three hidden layers achieves scores of 97% in accuracy and F1 and robust data preparation. A random forest model produces scores of 93% accuracy and 92% F1, showing that sensor-based detection is currently a viable option to detect even zero-day ransomware attacks before the code fully executes.