CNN2D Algorithm for Detection of Ransomware Attacks Using Processor and Disk Usage Data

Commonly, ransomware encrypts data, turns off antivirus protection, and destroys the target computer and everything on it. The techniques used today to detect this kind of WannaCry include monitoring the files, system requests, and processes on the system that is being targeted and analysing the data collected. Monitoring numerous processes has a substantial overhead; more current ransomware may interfere with the monitoring and alter the collected data. A dependable and practical technique for locating ransomware operating within a virtual machine, also called a VM, is provided in this study. We construct a framework for detection by applying an automated machine learning (ML) evaluation to the whole virtual machine (VM) using data collected from the physical host computer pertaining to specific processors and disc I/O events. This approach eliminates the need to continuously watch every action on the system that is being targeted and lessens the likelihood that ransomware would contaminate data. It also endures shifts in the amount of labour that users must do. It provides fast and very likely detection of known ransomware (used to train this machine learning model) and also of unknown ransomware (not utilised for teaching the model). Out of the seven artificial neural network classifiers that we looked at, the randomly generated forest (RF) classification gave the best results. Across six different customer loads plus 22 instances of ransomware, the RF model detected malware with a 0.98 confidence in 400 milliseconds.