A Study on Countermeasures against Neutralizing Technology: Encoding Algorithm-Based Ransomware Detection Methods Using Machine Learning
Ransomware, which emerged in 1989, has evolved to the present in numerous variants and new forms. For this reason, serious damage caused by ransomware has occurred not only within our country but around the world, and, according to the analysis of ransomware trends, ransomware poses an ongoing and s...
| Main Authors: | , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2024-03-01
|
| Series: | Electronics |
| Subjects: | |
| Online Access: | https://www.mdpi.com/2079-9292/13/6/1030 |
| _version_ | 1797241388773933056 |
|---|---|
| author | Jaehyuk Lee Jinseo Yun Kyungroul Lee |
| author_facet | Jaehyuk Lee Jinseo Yun Kyungroul Lee |
| author_sort | Jaehyuk Lee |
| collection | DOAJ |
| description | Ransomware, which emerged in 1989, has evolved to the present in numerous variants and new forms. For this reason, serious damage caused by ransomware has occurred not only within our country but around the world, and, according to the analysis of ransomware trends, ransomware poses an ongoing and significant threat, with major damage expected to continue to occur in the future. To address this problem, various approaches to detect ransomware have been explored, with a recent focus on file entropy estimation methods. These methods exploit the characteristic increase in file entropy that is caused by ransomware encryption. In response, a method was developed to neutralize entropy-based ransomware detection technology by manipulating entropy using encoding methods from the attacker’s perspective. Consequently, from the defender’s standpoint, countermeasures are essential to minimize the damage caused by ransomware. Therefore, this article proposes a methodology that utilizes diverse machine learning models such as K-Nearest Neighbors (KNN), logistic regression, decision tree, random forest, gradient boosting, support vector machine (SVM), and multi-layer perception (MLP) to detect files infected with ransomware. The experimental results demonstrate empirically that files infected with ransomware can be detected with approximately 98% accuracy, and the results of this research are expected to provide valuable information for developing countermeasures against various ransomware detection technologies. |
| first_indexed | 2024-04-24T18:22:32Z |
| format | Article |
| id | doaj.art-957324b657e9416886d2ead42dd67449 |
| institution | Directory Open Access Journal |
| issn | 2079-9292 |
| language | English |
| last_indexed | 2024-04-24T18:22:32Z |
| publishDate | 2024-03-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Electronics |
| spelling | doaj.art-957324b657e9416886d2ead42dd674492024-03-27T13:34:48ZengMDPI AGElectronics2079-92922024-03-01136103010.3390/electronics13061030A Study on Countermeasures against Neutralizing Technology: Encoding Algorithm-Based Ransomware Detection Methods Using Machine LearningJaehyuk Lee0Jinseo Yun1Kyungroul Lee2Process Development Team, Fescaro, Suwon 16512, Republic of KoreaFaculty of Interdisciplinary Studies, Chonnam National University, Gwangju 61186, Republic of KoreaDepartment of Information Security, Mokpo National University, Muan 58554, Republic of KoreaRansomware, which emerged in 1989, has evolved to the present in numerous variants and new forms. For this reason, serious damage caused by ransomware has occurred not only within our country but around the world, and, according to the analysis of ransomware trends, ransomware poses an ongoing and significant threat, with major damage expected to continue to occur in the future. To address this problem, various approaches to detect ransomware have been explored, with a recent focus on file entropy estimation methods. These methods exploit the characteristic increase in file entropy that is caused by ransomware encryption. In response, a method was developed to neutralize entropy-based ransomware detection technology by manipulating entropy using encoding methods from the attacker’s perspective. Consequently, from the defender’s standpoint, countermeasures are essential to minimize the damage caused by ransomware. Therefore, this article proposes a methodology that utilizes diverse machine learning models such as K-Nearest Neighbors (KNN), logistic regression, decision tree, random forest, gradient boosting, support vector machine (SVM), and multi-layer perception (MLP) to detect files infected with ransomware. The experimental results demonstrate empirically that files infected with ransomware can be detected with approximately 98% accuracy, and the results of this research are expected to provide valuable information for developing countermeasures against various ransomware detection technologies.https://www.mdpi.com/2079-9292/13/6/1030ransomwareinformation entropyencoding algorithmsneutralization strategiesencodingmachine learning |
| spellingShingle | Jaehyuk Lee Jinseo Yun Kyungroul Lee A Study on Countermeasures against Neutralizing Technology: Encoding Algorithm-Based Ransomware Detection Methods Using Machine Learning Electronics ransomware information entropy encoding algorithms neutralization strategies encoding machine learning |
| title | A Study on Countermeasures against Neutralizing Technology: Encoding Algorithm-Based Ransomware Detection Methods Using Machine Learning |
| title_full | A Study on Countermeasures against Neutralizing Technology: Encoding Algorithm-Based Ransomware Detection Methods Using Machine Learning |
| title_fullStr | A Study on Countermeasures against Neutralizing Technology: Encoding Algorithm-Based Ransomware Detection Methods Using Machine Learning |
| title_full_unstemmed | A Study on Countermeasures against Neutralizing Technology: Encoding Algorithm-Based Ransomware Detection Methods Using Machine Learning |
| title_short | A Study on Countermeasures against Neutralizing Technology: Encoding Algorithm-Based Ransomware Detection Methods Using Machine Learning |
| title_sort | study on countermeasures against neutralizing technology encoding algorithm based ransomware detection methods using machine learning |
| topic | ransomware information entropy encoding algorithms neutralization strategies encoding machine learning |
| url | https://www.mdpi.com/2079-9292/13/6/1030 |
| work_keys_str_mv | AT jaehyuklee astudyoncountermeasuresagainstneutralizingtechnologyencodingalgorithmbasedransomwaredetectionmethodsusingmachinelearning AT jinseoyun astudyoncountermeasuresagainstneutralizingtechnologyencodingalgorithmbasedransomwaredetectionmethodsusingmachinelearning AT kyungroullee astudyoncountermeasuresagainstneutralizingtechnologyencodingalgorithmbasedransomwaredetectionmethodsusingmachinelearning AT jaehyuklee studyoncountermeasuresagainstneutralizingtechnologyencodingalgorithmbasedransomwaredetectionmethodsusingmachinelearning AT jinseoyun studyoncountermeasuresagainstneutralizingtechnologyencodingalgorithmbasedransomwaredetectionmethodsusingmachinelearning AT kyungroullee studyoncountermeasuresagainstneutralizingtechnologyencodingalgorithmbasedransomwaredetectionmethodsusingmachinelearning |