A Survey of Machine Learning Algorithms for Detecting Ransomware Encryption Activity

TL;DR

This survey reviews machine learning methods, especially sensor-based techniques, for detecting ransomware encryption activity, highlighting features like CPU metrics and evaluating models such as multilayer perceptrons and random forests for early threat detection.

Contribution

It compiles and analyzes recent sensor-based machine learning approaches for ransomware detection, emphasizing feature selection and model performance evaluation.

Findings

Multilayer Perceptron achieves 97% accuracy and F1 score.

Random forest achieves 93% accuracy and 92% F1 score.

Sensor-based detection can identify zero-day ransomware attacks early.

Abstract

A survey of machine learning techniques trained to detect ransomware is presented. This work builds upon the efforts of Taylor et al. in using sensor-based methods that utilize data collected from built-in instruments like CPU power and temperature monitors to identify encryption activity. Exploratory data analysis (EDA) shows the features most useful from this simulated data are clock speed, temperature, and CPU load. These features are used in training multiple algorithms to determine an optimal detection approach. Performance is evaluated with accuracy, F1 score, and false-negative rate metrics. The Multilayer Perceptron with three hidden layers achieves scores of 97% in accuracy and F1 and robust data preparation. A random forest model produces scores of 93% accuracy and 92% F1, showing that sensor-based detection is currently a viable option to detect even zero-day ransomware attacks before the code fully executes.