On the classification of Microsoft-Windows ransomware using hardware profile

• Published in: PeerJ. Computer science Vol. 7; p. e361
• Main Authors: Aurangzeb, Sana, Rais, Rao Naveed Bin, Aleem, Muhammad, Islam, Muhammad Arshad, Iqbal, Muhammad Azhar
• Format: Journal Article
• Language: English
• Published: United States PeerJ. Ltd 02.02.2021; PeerJ, Inc; PeerJ Inc
• Subjects: Algorithms; Artificial Intelligence; Classification; Compensation; Computer software industry; Computer viruses; Data mining; Data Mining and Machine Learning; Decision trees; Feature extraction; Hardware; Machine learning; Malware; Operating Systems; Performance counters; Ransomware; Scientific Computing and Simulation; Security and Privacy; Software; Windows (computer programs); United States; Taiwan; Malware; Ransomware; Performance counters; Classification; Machine learning
• ISSN: 2376-5992; 2376-5992
• DOI: 10.7717/peerj-cs.361

Due to the expeditious inclination of online services usage, the incidents of ransomware proliferation being reported are on the rise. Ransomware is a more hazardous threat than other malware as the victim of ransomware cannot regain access to the hijacked device until some form of compensation is paid. In the literature, several dynamic analysis techniques have been employed for the detection of malware including ransomware; however, to the best of our knowledge, hardware execution profile for ransomware analysis has not been investigated for this purpose, as of today. In this study, we show that the true execution picture obtained via a hardware execution profile is beneficial to identify the obfuscated ransomware too. We evaluate the features obtained from hardware performance counters to classify malicious applications into ransomware and non-ransomware categories using several machine learning algorithms such as Random Forest, Decision Tree, Gradient Boosting, and Extreme Gradient Boosting. The employed data set comprises 80 ransomware and 80 non-ransomware applications, which are collected using the VirusShare platform. The results revealed that extracted hardware features play a substantial part in the identification and detection of ransomware with F-measure score of 0.97 achieved by Random Forest and Extreme Gradient Boosting.