A Dual Stage Malicious User Detection Method By Using Adaptive Threshold Testing and Machine Learning Technique

With the advent of big data and cloud computing, the security of users' private data has become a pressing issue. Despite the availability of several detection and prevention solutions, ransomware has developed with the intention of extorting victims for money in exchange for their data. Experts have investigated methods of detecting ransomware based on both files and behaviours. Unfortunately, ransomware remains a concern because of the challenges associated in to identify and avoid it. One important limitation of existing methods is that they cannot detect ransomware in backup systems, such as cloud services. It is pointless, for instance, to synchronise malicious files with system backups since ransomware cannot be decoded from backed-up data. In this work, we build a Dual Stage Malicious User Detection (DSMU) method to provide the highest level of security in the vast data cloud. First, the data is separated into two groups, "Normal" and "Suspicious," using Adaptive Entropy barrier testing. The next step is to identify whether or not the suspicious data are authentic by applying a classifier built around a Support Vector Machine (SVM). The recommended method allows users to restore encrypted files from a backup system even if malware has infected their primary workstation. The files infected that were copied to the backup systems may be removed this way. The proposed method has been shown in analytical comparisons to standard detection methods to have a higher detection rate and a lower false positive and false negative rate.