Scholarlink

<p>Ransomware attacks continue to be a crucial cybersecurity issue, inflicting monetary and operational damages across multiple sectors. Signature-based and heuristic approaches, among other traditional detection methods, have significant difficulty coping with new, evolving variants of ransomware. In this research, we propose an optimized ransomware detection framework that integrates Decision Trees (DT) with Artificial Neural Networks (ANN) and XGBoost, believing that this combination will increase classification accuracy. The research is based on the publicly accessible Kaggle ransomware dataset, which incorporates both static features (file entropy, opcode sequences) and dynamic features (API calls, registry changes). PCA was performed for feature selection and dimensionality reduction to improve detection efficiency. To confirm the effectiveness of the proposed framework, we compared it with standalone models, including CNN, ANN, SVM, Logistic Regression, and Naïve Bayes. Experimental results show that the proposed DT + ANN + XGBoost ensemble model surpasses all other deep learning models (CNN: 98.26%, ANN: 99.01%) and traditional machine learning classifiers (SVM: 96.66%, Logistic Regression: 87.26%) with a striking accuracy of 99.87%. The proposed model also achieved the highest precision, recall, F1-score, and ROC-AUC (all at 99.87%), further proving the model’s strength in ransomware detection. To enhance interpretability, SHAP was applied to the ensemble model, providing insights into feature contributions and validating the model’s decision-making process. The research highlights the growing importance of utilizing deep learning and ensemble learning methods to enhance positive detection rates and reduce false detection rates. It improves the detection of ransomware by integrating feature engineering with various classification models, thereby increasing the reliability and adaptability of the detection process. Future work is planned for real-time applications, model interpretability using Explainable AI (XAI) frameworks, and improved handling of previously unknown ransomware variants to enhance overall defensive capabilities in cybersecurity.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

A hybrid ensemble model for ransomware detection using feature engineering and deep learning

  • 期刊论文

  • 发表日期：

    2025年8月9日

查看全文
  • Shweta Singh,
  • Tejaswi Khanna,
  • Deepak Kumar Verma

摘要

Ransomware attacks continue to be a crucial cybersecurity issue, inflicting monetary and operational damages across multiple sectors. Signature-based and heuristic approaches, among other traditional detection methods, have significant difficulty coping with new, evolving variants of ransomware. In this research, we propose an optimized ransomware detection framework that integrates Decision Trees (DT) with Artificial Neural Networks (ANN) and XGBoost, believing that this combination will increase classification accuracy. The research is based on the publicly accessible Kaggle ransomware dataset, which incorporates both static features (file entropy, opcode sequences) and dynamic features (API calls, registry changes). PCA was performed for feature selection and dimensionality reduction to improve detection efficiency. To confirm the effectiveness of the proposed framework, we compared it with standalone models, including CNN, ANN, SVM, Logistic Regression, and Naïve Bayes. Experimental results show that the proposed DT + ANN + XGBoost ensemble model surpasses all other deep learning models (CNN: 98.26%, ANN: 99.01%) and traditional machine learning classifiers (SVM: 96.66%, Logistic Regression: 87.26%) with a striking accuracy of 99.87%. The proposed model also achieved the highest precision, recall, F1-score, and ROC-AUC (all at 99.87%), further proving the model’s strength in ransomware detection. To enhance interpretability, SHAP was applied to the ensemble model, providing insights into feature contributions and validating the model’s decision-making process. The research highlights the growing importance of utilizing deep learning and ensemble learning methods to enhance positive detection rates and reduce false detection rates. It improves the detection of ransomware by integrating feature engineering with various classification models, thereby increasing the reliability and adaptability of the detection process. Future work is planned for real-time applications, model interpretability using Explainable AI (XAI) frameworks, and improved handling of previously unknown ransomware variants to enhance overall defensive capabilities in cybersecurity.