API Call Based Ransomware Dynamic Detection Approach Using TextCNN

In recent years, the number of ransomware attacks has grown exponentially. Ransomware detection for Windows platforms has become extremely important. In the field of malware detection, the API call is used in many methods, and the API call sequence can be regarded as a sentence in the language. In this paper, the TextCNN model in the Natural Language Processing field is used to detect ransomware and the chunk-based max-pooling is used to improve the pooling layer of the TextCNN model. This paper proposes a Dynamic Ransomware Detector based on the improved TextCNN(DRDT). DRDT is trained with ransomware and benign software's API call sequences. Then API call sequences from unknown programs can be sent to DRDT to determine whether the files are ransomware. The experimental result shows that the detection speed of DRDT is faster than traditional methods, with the accuracy and F1 score of 0.959.