A fine-tuning of decision tree classifier for ransomware detection based on memory data

Abstract: Ransomware has evolved into a pervasive and extremely disruptive cybersecurity threat, causing substantial operational and financial damage to individuals and businesses. This article explores the critical domain of Ransomware detection and employs Machine Learning (ML) classifiers, particularly Decision Tree (DT), for Ransomware detection. The article also delves into the usefulness of DT in identifying Ransomware attacks, leveraging the innate ability of DT to recognize complex patterns within datasets. Instead of merely introducing DT as a detection method, we adopt a comprehensive approach, emphasizing the importance of fine-tuning DT hyperparameters. The optimization of these parameters is essential for maximizing the DT capability to identify Ransomware threats accurately. The obfuscated-MalMem2022 dataset, which is well-known for its extensive and challenging Ransomware-related data, was utilized to evaluate the effectiveness of DT in detecting Ransomware. The implementation uses the versatile Python programming language, renowned for its efficiency and adaptability in data analysis and ML tasks. Notably, the DT classifier consistently outperforms other classifiers in Ransomware detection, including K-Nearest Neighbors, Gradient Boosting Tree, Naive Bayes, and Linear Support Vector Classifier. For instance, the DT demonstrated exceptional effectiveness in distinguishing between Ransomware and benign data, as evidenced by its remarkable accuracy of 99.97%.

How to cite this paper

 Abualhaj, M., Al-Zyoud, M., Hiari, M., Alrabanah, Y., Anbar, M., Amer, A & Al-Allawee, A. (2024). A fine-tuning of decision tree classifier for ransomware detection based on memory data.International Journal of Data and Network Science, 8(2), 733-742.

Refrences

Abualhaj, M. M., Abu-Shareha, A. A., Hiari, M. O., Alrabanah, Y., Al-Zyoud, M., & Alsharaiah, M. A. (2022). A Para-digm for DoS Attack Disclosure using Machine Learning Techniques. International Journal of Advanced Computer Science and Applications, 13(3).‏
Agrawal, R., Stokes, J. W., Selvaraj, K., & Marinescu, M. (2019, May). Attention in recurrent neural networks for ran-somware detection. In ICASSP 2019-2019 IEEE international conference on acoustics, speech and signal processing (ICASSP) (pp. 3222-3226). IEEE.‏
Alawad, W., Zohdy, M., & Debnath, D. (2018, September). Tuning hyperparameters of decision tree classifiers using computationally efficient schemes. In 2018 IEEE First International Conference on Artificial Intelligence and Knowledge Engineering (AIKE) (pp. 168-169). IEEE.‏
Almashhadani, A. O., Kaiiali, M., Sezer, S., & O’Kane, P. (2019). A multi-classifier network-based crypto ransomware detection system: A case study of locky ransomware. IEEE access, 7, 47053-47067.‏
Al-Mimi, H., Hamad, N. A., Abualhaj, M. M., Daoud, M. S., Al-dahoud, A., & Rasmi, M. (2023). An Enhanced Intrusion Detection System for Protecting HTTP Services from Attacks. International Journal of Advances in Soft Computing & Its Applications, 15(2).‏
Alqahtani, A., Gazzan, M., & Sheldon, F. T. (2020, January). A proposed crypto-ransomware early detection (CRED) model using an integrated deep learning and vector space model approach. In 2020 10th Annual Computing and Com-munication Workshop and Conference (CCWC) (pp. 0275-0279). IEEE.‏
Alsharaiah, M., Abu-Shareha, A., Abualhaj, M., Baniata, L., Adwan, O., Al-saaidah, A., & Oraiqat, M. (2023). A new phishing-website detection framework using ensemble classification and clustering. International Journal of Data and Network Science, 7(2), 857-864.‏
Alves, T., Das, R., & Morris, T. (2018). Embedding encryption and machine learning intrusion prevention systems on pro-grammable logic controllers. IEEE Embedded Systems Letters, 10(3), 99-102.‏
Chen, C. W., Su, C. H., Lee, K. W., & Bair, P. H. (2020, February). Malware family classification using active learning by learning. In 2020 22nd International Conference on Advanced Communication Technology (ICACT) (pp. 590-595). IEEE.‏
Choudhary, S., & Sharma, A. (2020, February). Malware detection & classification using machine learning. In 2020 Inter-national Conference on Emerging Trends in Communication, Control and Computing (ICONC3) (pp. 1-4). IEEE.
Dener, M., Ok, G., & Orman, A. (2022). Malware detection using memory analysis data in big data environment. Applied Sciences, 12(17), 8604.‏
Deng, X., Jiang, M., & Cen, M. (2022, December). A Ransomware Classification Method Based on Entropy Map. In 2022 IEEE 21st International Conference on Ubiquitous Computing and Communications (IUCC/CIT/DSCI/SmartCNS) (pp. 1-8). IEEE.‏
Firdausi, I., Erwin, A., & Nugroho, A. S. (2010, December). Analysis of machine learning techniques used in behavior-based malware detection. In 2010 second international conference on advances in computing, control, and telecommu-nication technologies (pp. 201-203). IEEE.‏
Jain, P., Rajvaidya, I., Sah, K. K., & Kannan, J. (2022, February). Machine Learning Techniques for Malware Detection-a Research Review. In 2022 IEEE International Students' Conference on Electrical, Electronics and Computer Science (SCEECS) (pp. 1-6). IEEE.‏
Joy, J., & Selvan, M. P. (2022, June). A comprehensive study on the performance of different Multi-class Classification Algorithms and Hyperparameter Tuning Techniques using Optuna. In 2022 International Conference on Computing, Communication, Security and Intelligent Systems (IC3SIS) (pp. 1-5). IEEE.‏
Kolhar, M., Al-Turjman, F., Alameen, A., & Abualhaj, M. M. (2020). A three layered decentralized IoT biometric archi-tecture for city lockdown during COVID-19 outbreak. Ieee Access, 8, 163608-163617.‏
Lei, J., Gao, S., Shi, J., Wei, X., Dong, M., Wang, W., & Han, Z. (2022). A Reinforcement Learning Approach for Defend-ing Against Multiscenario Load Redistribution Attacks. IEEE Transactions on Smart Grid, 13(5), 3711-3722.‏
Ma, L., Sun, B., & Han, C. (2018, July). Training instance random sampling based evidential classification forest algo-rithms. In 2018 21st International Conference on Information Fusion (FUSION) (pp. 883-888). IEEE.‏
MahendraVardhan, A., & Sridhar, S. (2022, December). Determining False Positive Analysis of Software Vulnerabilities with Predefined Scan Rules using Random Forest Classifier and Decision Tree Technique. In 2022 4th International Conference on Advances in Computing, Communication Control and Networking (ICAC3N) (pp. 622-625). IEEE.‏
Manavi, F., & Hamzeh, A. (2021, March). Static detection of ransomware using LSTM network and PE header. In 2021 26th International Computer Conference, Computer Society of Iran (CSICC) (pp. 1-5). IEEE.
Molina, R. M. A., Torabi, S., Sarieddine, K., Bou-Harb, E., Bouguila, N., & Assi, C. (2021). On ransomware family attrib-ution using pre-attack paranoia activities. IEEE Transactions on Network and Service Management, 19(1), 19-36.‏
Parizad, A., & Hatziadoniu, C. J. (2022). Cyber-attack detection using principal component analysis and noisy clustering algorithms: A collaborative machine learning-based framework. IEEE Transactions on Smart Grid, 13(6), 4848-4861.‏
Peng, W., Li, F., Zou, X., & Wu, J. (2013). Behavioral malware detection in delay tolerant networks. IEEE Transactions on Parallel and Distributed systems, 25(1), 53-63.‏
Razali, M. H. M., Saian, R., Moktar, B., Wah, Y. B., & Ku-Mahamud, K. R. (2022, September). Performance of ACO-based Decision Tree Algorithm with Imbalanced Class Data Sets-A Heuristic Approach. In 2022 3rd International Conference on Artificial Intelligence and Data Sciences (AiDAS) (pp. 29-38). IEEE.‏
Rosmansyah, Y., & Dabarsyah, B. (2015, August). Malware detection on android smartphones using API class and ma-chine learning. In 2015 International Conference on Electrical Engineering and Informatics (ICEEI) (pp. 294-297). IEEE.‏
Saurabh. (2018). Advance malware analysis using static and dynamic methodology. 2018 International Conference on Ad-vanced Computation and Telecommunication (ICACAT). https://doi.org/10.1109/icacat.2018.8933769‏
Saurav, Z., Mitu, M. M., Ritu, N. S., Hasan, M. A., Arefin, S., & Farid, D. M. (2023, February). A New Method for Learn-ing Decision Tree Classifier. In 2023 International Conference on Electrical, Computer and Communication Engineer-ing (ECCE) (pp. 1-6). IEEE.‏
Sen, S., Aydogan, E., & Aysan, A. I. (2018). Coevolution of mobile malware and anti-malware. IEEE Transactions on In-formation Forensics and Security, 13(10), 2563-2574.‏
SonicWall, cyber threat report, 2022.
Vijayarangam, J., Kamalakkannan, S., & Smiles, J. A. (2021, November). A Novel Comparison of Neural Network and Decision Tree as Classifiers using R. In 2021 Fifth International Conference on I-SMAC (IoT in Social, Mobile, Ana-lytics and Cloud)(I-SMAC) (pp. 712-715). IEEE.‏
Wang, C., & Zhu, H. (2020). Representing fine-grained co-occurrences for behavior-based fraud detection in online pay-ment services. IEEE Transactions on Dependable and Secure Computing, 19(1), 301-315.‏
Yeo, M., Koo, Y., Yoon, Y., Hwang, T., Ryu, J., Song, J., & Park, C. (2018, January). Flow-based malware detection using convolutional neural network. In 2018 International Conference on Information Networking (ICOIN) (pp. 910-913). IEEE.‏
Zulfikar, W. B., Gerhana, Y. A., & Rahmania, A. F. (2018, August). An approach to classify eligibility blood donors using decision tree and naive bayes classifier. In 2018 6th International Conference on Cyber and IT Service Management (CITSM) (pp. 1-5). IEEE.‏