Screening Ransomware Through APK Analysis: Implementation of CNN Models

Ransomware is a growing threat to the security of Android devices. In this context, the development of effective methods for detecting ransomware is essential. This paper presents an approach for screening ransomware through APK analysis by implementing Convolutional Neural Network (CNN) models. The methodology involves collecting APK datasets for both benign and ransomware samples. The collected APKs are then processed, and their corresponding dalvik executable files are carefully converted into grayscale images through 8-bit binary vectors. Three CNN models - Inception v3, ResNet50, and VGG16 - are trained to classify the grayscale images. Additionally, two ensemble models are developed based on the three CNN models. Our findings reveal that the VGG16 model outperforms the others, achieving the highest accuracy and lowest validation loss. The ensemble model with the average of the three CNN models also performed well, showing the second-best performance in detecting ransomware. The results demonstrate the potential of using CNN models for screening ransomware through APK analysis.