Strengthening Ransomware Classification: The Role of SMOTE-ENN in ML Classifiers

Ransomware is a significant cybersecurity threat, particularly due to the difficulty in detecting new and evolving variants. Traditional detection methods often fail to keep up with the dynamic nature of ransomware, creating a need for more advanced solutions. This research investigates the application of machine learning techniques to improve ransomware detection, with a specific focus on handling class imbalance in ransomware datasets. Class imbalance can lead to biased models that favor the majority classes, reducing detection accuracy for minority (ransomware) instances. To address this, we employed a hybrid resampling technique known as SMOTE-ENN (Synthetic Minority Oversampling Technique and Edited Nearest Neighbor) to balance the dataset more effectively. Three classifiers were then tested: Random Forest (RF), Support Vector Machine (SVM), and Extreme Gradient Boosting (XGBoost). The performance of each model was assessed using a variety of measures, including as F1-scor, recall, accuracy, and precision. The XGBoost model, in particular, demonstrated substantial improvement in ransomware classification, achieving a score of 99% in all key metrics, highlighting its robustness and stability in handling imbalanced data. Results across all models showed varying degrees of enhanced classification accuracy and consistency, underscoring the potential of hybrid resampling techniques in refining ransomware detection systems. This study suggests that machine learning models, when combined with advanced resampling strategies, can significantly enhance the effectiveness of ransomware detection, providing a potential path for cybersecurity frameworks in the future. The results highlight the effectiveness of XGBoost in conjunction with SMOTE-ENN as a potent weapon against ransomware, bolstering cybersecurity defenses.