Android ransomware detection using reduced opcode sequence and image similarity

Nowadays Ransomwares are not limited to personal computers. Increasing the number of people accessing cell phones, availability of mobile phone application markets along with lack of an effective way for identifying Ransomwares have accelerated their growth and expansion in the field of mobile phones and IOT. In the following article, an optimal approach is presented that transforms the sequence of executable instructions into a grayscale image and then LDA is used in two phases. LDA is a statistical method that is used for separating two or more classes along with dimension reduction. In the first phase, because the image size is large and it contains information that reduces accuracy rate, its best features are exploited using LDA. In the next phase, LDA is fit to train data and the sample tests are feeded for prediction. The experimental results on two well-known Ransomware families and an unknown group of Ransomwares show that the suggested method is capable of identifying with 97 percent of accuracy.