Ensemble-Based Transfer Learning for Enhanced Ransomware Detection Using PE Header

Ransomware is an extortion malware which has impacted magnanimously both organizations and individuals. All sectors have been immensely targeted such as healthcare, IT, manufacturing, education all over the world. In this paper, we present an improved ransomware detection technique using transfer and ensemble learning with Xception deep learning pretrained model. We utilize PE header of ransomware and benign files as our datasets for our experiments. We have converted the PE headers into colored images and leverage the advantages of using images and deep learning for ransomware detection. Xception model has depth wise separable convolutions instead of standard convolutions which reduces the number of parameters and computation. In this work we propose a framework where instead of training the Xception model from scratch, we use transfer learning and then an ensemble. We achieve an accuracy of 98.79 which is better than the other existing peer models for detecting ransomware which use static features. We further provide a detailed comparative analysis with other existing pretrained, deep learning and machine learning models to support the effectiveness of our approach.