Adversarial Vulnerabilities in Ransomware Detection: Enhancing Machine Learning Model Robustness

Machine learning (ML) models are increasingly employed in cybersecurity to detect and prevent malicious activities such as ransomware attacks. However, these models are vulnerable to adversarial attacks, where subtle modifications to input data can cause a model to make incorrect predictions, potentially allowing threats to evade detection. This paper investigates the robustness of an ML model used for ransomware detection, demonstrating how adversarially modified samples can lead to a complete failure in detection despite high initial accuracy. We explore the effectiveness of retraining the model with these adversarial samples to restore its detection capabilities. Our findings reveal that while retraining can improve the model's performance, it also introduces new dependencies that may be exploited in future attacks. The results underscore the need for continuous evaluation and adaptation of ML models in cybersecurity, particularly in the face of evolving threats. This study highlights the importance of developing more resilient models and offers insights into potential strategies for enhancing the robustness of ML systems in cybersecurity applications.