Hybrid Machine Learning Approach for Early Detection of Ransomware Behavior

Abstract

The pervasive and escalating threat of ransomware necessitates the development of extremely flexible and robust detection systems that exceed the restrictions of present signature-based and heuristic techniques. This thesis introduces a novel hybrid machine learning framework for the early identification of ransomware activity, specifically exploiting Application Programming Interface (API) call patterns. The main new idea is a smart way to set the weights for Recurrent Neural Networks (RNNs) at the beginning. This is done by using coefficients from a pre-trained Logistic Regression model as the initial input-to-hidden weights. This strategic integration tries to address common difficulties in neural network training, such as vanishing/exploding gradients and sluggish convergence, while enhancing overall detection accuracy and efficiency. The recommended model was thoroughly examined on a complete dataset comprising both malicious and benign API call sequences, assessing its performance across both balanced and imbalanced data distributions. Experimental results demonstrate the greater efficacy of the hybrid technique. On a balanced dataset, the model acquired an accuracy of 83% with a greatly reduced optimal loss value of 0.44, outperforming a baseline RNN seeded with Xavier weights (loss of 3.47). When analyzed on an imbalanced dataset, which more closely matches real-world settings, the hybrid model attained an incredible 98% accuracy, topping the Xavier baseline's 92%, while preserving comparable low loss levels. These findings underline the model's robustness and its capacity to generalize effectively across different data aspects. This research contributes a valuable viewpoint on boosting neural network training by intelligent weight initialization, giving a more resilient and efficient strategy for tackling the dynamic environment of ransomware attacks in cybersecurity.