Ransomware Detection in Android Using Machine Learning

As the number of android applications available in the market are increasing rapidly, various types of security attacks using the android apps have also increased at the same pace. The ransomware attack is one of these kinds of security attacks in which the attackers lock the user's phone, encrypts user's data or blocks the user's access to their own data and threatens the user to pay a ransom to gain the access back. Android devices are more prone to these ransomware attacks when compared to Windows and IOS devices. In this work, a novel hybrid ransomware detection method is proposed that analyses image data, text, and application code to extract plain or encrypted threat text. Threatening text is a potential tool and could be one of the most effective features for ransomware detection. Our approach to ransomware detection combines static and dynamic analysis, along with multiple machine learning models acting as classifiers. Notably, our experiments show promising results with an accuracy rate reaching up to 91% and a low rate of false negatives.