System and API call based ransomware detection methods have gained popularity recently since they are comparatively robust in the face of obfuscation attempts. In this paper, we present a system call based ransomware detection technique that utilises ResNet-50 image classifier model. Compared to previous work, we forego complex pre-processing and focus on five specific system calls. The system/API call datasets needed to train such models are scarce as they rely on the availability of active ransomware samples. Given the lack of publicly available ransomware samples for training and evaluating models, we employ transfer learning techniques on the ResNet-50 model. Our results show that transfer learning on models such as ResNet-50 can provide acceptable ransomware detection accuracy even when used with small datasets and a limited set of system calls with little pre-processing thus highlighting the importance of optimising or selecting the best feature sets in image-based detection to get better results and saving computational cost and detection time.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Detecting Ransomware Using System Calls Through Transfer Learning on a Limited Feature Set

  • Harpreet Kaur,
  • Vimal Kumar,
  • Atthapan Daramas

摘要

System and API call based ransomware detection methods have gained popularity recently since they are comparatively robust in the face of obfuscation attempts. In this paper, we present a system call based ransomware detection technique that utilises ResNet-50 image classifier model. Compared to previous work, we forego complex pre-processing and focus on five specific system calls. The system/API call datasets needed to train such models are scarce as they rely on the availability of active ransomware samples. Given the lack of publicly available ransomware samples for training and evaluating models, we employ transfer learning techniques on the ResNet-50 model. Our results show that transfer learning on models such as ResNet-50 can provide acceptable ransomware detection accuracy even when used with small datasets and a limited set of system calls with little pre-processing thus highlighting the importance of optimising or selecting the best feature sets in image-based detection to get better results and saving computational cost and detection time.