A Study on the Evolution of Ransomware Detection Using Machine Learning and Deep Learning Techniques

被引:39
作者
Fernando, Damien Warren [1 ]
Komninos, Nikos [1 ]
Chen, Thomas [2 ]
机构
[1] City Univ London, Dept Comp Sci, London EC1V 0HB, England
[2] City Univ London, Dept Elect & Elect Engn, London EC1V 0HB, England
来源
IOT | 2020年 / 1卷 / 02期
关键词
ransomware; crypto; locker; detection; learning algorithms; internet;
D O I
10.3390/iot1020030
中图分类号
TN [电子技术、通信技术];
学科分类号
0809 ;
摘要
This survey investigates the contributions of research into the detection of ransomware malware using machine learning and deep learning algorithms. The main motivations for this study are the destructive nature of ransomware, the difficulty of reversing a ransomware infection, and how important it is to detect it before infecting a system. Machine learning is coming to the forefront of combatting ransomware, so we attempted to identify weaknesses in machine learning approaches and how they can be strengthened. The threat posed by ransomware is exceptionally high, with new variants and families continually being found on the internet and dark web. Recovering from ransomware infections is difficult, given the nature of the encryption schemes used by them. The increase in the use of artificial intelligence also coincides with this boom in ransomware. The exploration into machine learning and deep learning approaches when it comes to detecting ransomware poses high interest because machine learning and deep learning can detect zero-day threats. These techniques can generate predictive models that can learn the behaviour of ransomware and use this knowledge to detect variants and families which have not yet been seen. In this survey, we review prominent research studies which all showcase a machine learning or deep learning approach when detecting ransomware malware. These studies were chosen based on the number of citations they had by other research. We carried out experiments to investigate how the discussed research studies are impacted by malware evolution. We also explored the new directions of ransomware and how we expect it to evolve in the coming years, such as expansion into IoT (Internet of Things), with IoT being integrated more into infrastructures and into homes.
引用
收藏
页码:551 / 604
页数:54
相关论文
共 46 条
[1]  
Abadi M, 2016, PROCEEDINGS OF OSDI'16: 12TH USENIX SYMPOSIUM ON OPERATING SYSTEMS DESIGN AND IMPLEMENTATION, P265
[2]  
Alhawi O.M. K., 2018, Cyber threat intelligence
[3]   A Multi-Classifier Network-Based Crypto Ransomware Detection System: A Case Study of Locky Ransomware [J].
Almashhadani, Ahmad O. ;
Kaiiali, Mustafa ;
Sezer, Sakir ;
O'Kane, Philip .
IEEE ACCESS, 2019, 7 :47053-47067
[4]   Graph-based malware detection using dynamic analysis [J].
Anderson, Blake ;
Quist, Daniel ;
Neil, Joshua ;
Storlie, Curtis ;
Lane, Terran .
JOURNAL OF COMPUTER VIROLOGY AND HACKING TECHNIQUES, 2011, 7 (04) :247-258
[5]  
[Anonymous], Alernative.me Who Uses Scikit-Learn, Scikit-Learn
[6]  
[Anonymous], 2018, Weka 3: Machine Learning Software in Java
[7]  
Bae S.I., 2019, CONCURR COMP-PRACT E, V32
[8]  
Baig M., 2012, 2012 World Congress on Internet Security (WorldCIS-2012), P99
[9]  
Chang J.-C., 2018, P 2018 3 INT C COMPU
[10]  
Chen L., 2019, P KDD 2019