Machine learning based detection system for Ransomware classification of Bitcoin Transactions

Abstract: Ransomware attacks are increasingly prevalent, posing a severe threat to global cybersecurity. Cybercriminals use cryptocurrencies, particularly Bitcoin, to collect ransom payments, capitalizing on their pseudo-anonymous and decentralized properties to evade detection and law enforcement. This study addresses the detection of Bitcoin transactions linked to ransomware using the BitcoinHeist dataset, which includes transactions from 28 ransomware families categorized as Princeton, Montreal, Padua, and legitimate 'white' transactions. We introduce a hybrid machine learning framework integrating supervised and semi-supervised approaches. The supervised component employs a stacking ensemble with XGBoost, Random Forest, Decision Trees and as base learners and a Multilayer Perceptron as the meta-learner. The semi-supervised component uses Labeled K-means and biased classifiers to identify previously unseen ransomware instances. Hyperparameter optimization via Optuna ensures model robustness. Evaluated through comprehensive metrics, including accuracy, precision, recall, F1-score, ROC score, and prediction time, our approach achieves a state-of-the-art accuracy of 97% in classifying known ransomware transactions and demonstrates robust performance in detecting unknown ransomware within the BitcoinHeist dataset. This research advances efforts to mitigate ransomware’s impact on the cryptocurrency ecosystem. . IndexTerms – Ransomware, Bitcoin transactions, Anamoly Detection , Machine Learning