Comparative Analysis of Machine Learning Models: Ransomware Severity Prediction Using MITRE Cyber Analytics Repository

Ransomware attacks have significantly risen recently, becoming more complex and posing a greater global threat. The contribution of machine learning in this domain is significant. Our literature review reveals that the field of ransomware severity prediction is under-explored, leading to a comparative study of predictive models for ransomware severity. We analyze over 50 verified ransomware strains using the MITRE ATT&CK framework and CAR for behavior and severity analysis and prepare a dataset. This study evaluates six machine learning models to predict ransomware attack severity, using regression and classification methods to identify the most effective predictive model. Performance tests reveal that the Neural Network is the most effective method of predicting ransomware severity, followed by Support Vector Machine (SVM) and XGBoost (XGB), underscoring the importance of machine learning in enhancing cybersecurity and proactive threat severity management. This research also reveals that Yanluowang Ransomware has the highest average severity score, indicating that it is more severe and harmful than other ransomware families. The most frequent ransomware family is identified as LokiLocker Ransomware. These findings provide valuable insights for developing effective countermeasures against ransomware attacks in the future. Making our dataset available open-source on Github . By that researchers can use it for future research and development in Ransomware Severity Prediction.