Evaluating shallow and deep networks for ransomware detection and classification

Ransomware is one type of malware that covertly installs and executes a cryptovirology attack on a victims computer to demand a ransom payment for restoration of the infected resources. This kind of malware has been growing largely in recent days and causes tens of millions of dollars losses to consumers. In this paper, we evaluate shallow and deep networks for the detection and classification of ransomware. To characterize and distinguish ransomware over benign and various other families of ransomwares, we leverage the dominance of application programming interface (API) invocations. To select a best architecture for the multi-layer perceptron (MLP), we done various experiments related to network parameters and structures. All the experiments are run up to 500 epochs with a learning rate in the range [0.01-0.5]. Result obtained on our data set is more promising to distinguish ransomware not only from benign from its families too. On distinguishing the .EXE as either benign or ransomware, MLP has attained highest accuracy 1.0 and classifying the ransomware to their categories obtained highest accuracy 0.98. Moreover, MLP has performed well in detecting and classifying ransomwares in comparison to the other classical machine learning classifiers.