Automated Behavior-based Malice Scoring of Ransomware Using Genetic Programming

Malice or severity scoring models are a technique for detection of maliciousness. A few ransomware detection studies utilise malice scoring models for detection of ransomware-like behavior. These models rely on the weighted sum of some manually chosen features and their weights by a domain expert. To automate the modelling of malice scoring for ransomware detection, we propose a method based on Genetic Programming (GP) that automatically evolves a behavior-based malice scoring model by selecting appropriate features and functions from the input feature and operator sets. The experimental results show that the best-evolved model correctly assigned a malice score, below the threshold value to over 85% of the unseen goodware instances, and over the threshold value to more than 99% of the unseen ransomware instances.