Android Ransomware Detection System using Feature Selection with Bootstrap Aggregating MARS

Android ransomware has become one of the most dangerous types of attack that have occurred recently due to the increasing use of the Android operating system. Generally, ransomware is based on the idea of encrypting the files in the victim’s device and then demanding money to provide the decryption password. Machine learning techniques are increasingly used for Android ransomware detection and analysis. In this study, Android ransomware is detected using Bootstrap Aggregating based Multivariate Adaptive Regression Splines (Bagging MARS) for the first time in feature selection. A feature matrix with 134 permissions and API calls in total was reduced to 34 features via the proposed Bagging MARS feature selection technique. Multi-Layer Perceptron (MLP), one of the classification techniques, produced the best accuracy with 90.268%. Additionally, the proposed feature selection method yielded more successful results compared to the filter, wrapper, and embedded methods used. Thus, this method, which was used for the first time to detect the common features of Android Ransomware, will enable the next Android Ransomware detection systems to work faster and with a higher success rate.