Evaluating Open-Source Machine Learning Ransomware Detection Techniques

Ransomware remains one of the most disruptive and damaging form of cyber threat affecting both larger and smaller organizations. It is becoming increasingly more important to find tools to mitigate this threat, and one route that is much more prevalent is using machine learning techniques for detection. This work explores open-source work geared towards ransomware detection with the aid of artificial intelligence as a means to provide a cost-effective alternative for organizations that may not have the funding to purchase the commercial solutions. Many tools and malware repositories were investigated, and one was further analyzed with a dataset specifically catered to the features it requires. The dataset was created through the collection of ransomware executable samples gathered from VirusTotal, a public repository of malware. Due to missing features in the dataset, there were two experimental setups used, one using the data as is and one with the present features weighted. The results of this convey that it is important to acknowledge what aspects may affect the accuracy and overall effectiveness of these kinds of tools, and explores what could be done to lessen this impact.