On the classification of Microsoft-Windows ransomware using hardware profile

Due to the expeditious inclination of online services usage, the incidents of ransomware proliferation being reported are on the rise. Ransomware is a more hazardous threat than other malware as the victim of ransomware cannot regain access to the hijacked device until some form of compensation is p...

Full description

Saved in:
Bibliographic Details
Published in:PeerJ. Computer science 2021-02, Vol.7, p.e361-e361, Article e361
Main Authors: Aurangzeb, Sana, Rais, Rao Naveed Bin, Aleem, Muhammad, Islam, Muhammad Arshad, Iqbal, Muhammad Azhar
Format: Article
Language:English
Subjects:
Algorithms
Artificial Intelligence
Classification
Compensation
Computer software industry
Computer viruses
Data mining
Data Mining and Machine Learning
Decision trees
Feature extraction
Hardware
Machine learning
Malware
Operating Systems
Performance counters
Ransomware
Scientific Computing and Simulation
Security and Privacy
Software
Windows (computer programs)
Citations: Items that this one cites
Items that cite this one
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:Due to the expeditious inclination of online services usage, the incidents of ransomware proliferation being reported are on the rise. Ransomware is a more hazardous threat than other malware as the victim of ransomware cannot regain access to the hijacked device until some form of compensation is paid. In the literature, several dynamic analysis techniques have been employed for the detection of malware including ransomware; however, to the best of our knowledge, hardware execution profile for ransomware analysis has not been investigated for this purpose, as of today. In this study, we show that the true execution picture obtained via a hardware execution profile is beneficial to identify the obfuscated ransomware too. We evaluate the features obtained from hardware performance counters to classify malicious applications into ransomware and non-ransomware categories using several machine learning algorithms such as Random Forest, Decision Tree, Gradient Boosting, and Extreme Gradient Boosting. The employed data set comprises 80 ransomware and 80 non-ransomware applications, which are collected using the VirusShare platform. The results revealed that extracted hardware features play a substantial part in the identification and detection of ransomware with F-measure score of 0.97 achieved by Random Forest and Extreme Gradient Boosting.
ISSN:2376-5992
2376-5992
DOI:10.7717/peerj-cs.361