Ransomware Detection: Ensemble Machine Learning Models Using Disjoint Data

The ransomware attack has become a lucrative business for cybercriminals and has impacted several companies, as data hijacking interrupts business continuity. Several Machine Learning models have been developed that capture some techniques used by malware. However, these models limit the scope of detection to features observed in individual data sets, which can reduce the detection rate of ransomware families and variants. This research aimed to develop a strategy to increase the spectrum of ransomware detection through the ensemble technique that combines machine learning models to achieve superior results compared to isolated models. Furthermore, we introduce a data set combination strategy, aiming to observe a broader range of features that mirror the real-world behavior of ransomware. Open datasets were collected to train previously selected machine learning models, and this data was combined. The results indicated that the combination of models produced better results than applying the models alone.