Feature-Selection-Based Ransomware Detection with Machine Learning of Data Analysis

Abstract

Ransomwares are continuously produced in underground markets such that increasingly high-level and sophisticated ransomwares are spreading all over the world, significantly affecting individuals, businesses, governments, and countries. To prevent large-scale attacks, most companies buy intrusion detection systems to alert regarding any abnormal network behavior. However, they cannot be detected using conventional signature-based detection even though ransomwares belong to the same family. In this study, a method is provided to develop a network intrusion detection model that is based on big data technology. The system uses Argus for packet preprocessing, merging, and labeling the known malicious data. A concept of Biflow was proposed to replace the packet data. Further, we observe that the data size is reduced to 1000: 1. Additionally, the characteristics of a complete traffic are obtained. Six feature selection algorithms were combined to achieve a better accuracy in terms of classification. Finally, the decision tree model of the supervised machine learning was used to enhance the performance of intrusion detection system.