<i>e</i>MIFS: A Normalized Hyperbolic Ransomware Deterrence Model Yielding Greater Accuracy and Overall Performance
Early detection of ransomware attacks is critical for minimizing the potential damage caused by these malicious attacks. Feature selection plays a significant role in the development of an efficient and accurate ransomware early detection model. In this paper, we propose an enhanced Mutual Informati...
| Main Authors: | , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2024-03-01
|
| Series: | Sensors |
| Subjects: | |
| Online Access: | https://www.mdpi.com/1424-8220/24/6/1728 |
| _version_ | 1797239394896183296 |
|---|---|
| author | Abdullah Alqahtani Frederick T. Sheldon |
| author_facet | Abdullah Alqahtani Frederick T. Sheldon |
| author_sort | Abdullah Alqahtani |
| collection | DOAJ |
| description | Early detection of ransomware attacks is critical for minimizing the potential damage caused by these malicious attacks. Feature selection plays a significant role in the development of an efficient and accurate ransomware early detection model. In this paper, we propose an enhanced Mutual Information Feature Selection (<i>e</i>MIFS) technique that incorporates a normalized hyperbolic function for ransomware early detection models. The normalized hyperbolic function is utilized to address the challenge of perceiving common characteristics among features, particularly when there are insufficient attack patterns contained in the dataset. The Term Frequency–Inverse Document Frequency (TF–IDF) was used to represent the features in numerical form, making it ready for the feature selection and modeling. By integrating the normalized hyperbolic function, we improve the estimation of redundancy coefficients and effectively adapt the MIFS technique for early ransomware detection, i.e., before encryption takes place. Our proposed method, <i>e</i>MIFS, involves evaluating candidate features individually using the hyperbolic tangent function (tanh), which provides a suitable representation of the features’ relevance and redundancy. Our approach enhances the performance of existing MIFS techniques by considering the individual characteristics of features rather than relying solely on their collective properties. The experimental evaluation of the <i>e</i>MIFS method demonstrates its efficacy in detecting ransomware attacks at an early stage, providing a more robust and accurate ransomware detection model compared to traditional MIFS techniques. Moreover, our results indicate that the integration of the normalized hyperbolic function significantly improves the feature selection process and ultimately enhances ransomware early detection performance. |
| first_indexed | 2024-04-24T17:50:51Z |
| format | Article |
| id | doaj.art-aa00a9a531554ede9bf44dbe0afe6b4a |
| institution | Directory Open Access Journal |
| issn | 1424-8220 |
| language | English |
| last_indexed | 2024-04-24T17:50:51Z |
| publishDate | 2024-03-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Sensors |
| spelling | doaj.art-aa00a9a531554ede9bf44dbe0afe6b4a2024-03-27T14:03:35ZengMDPI AGSensors1424-82202024-03-01246172810.3390/s24061728<i>e</i>MIFS: A Normalized Hyperbolic Ransomware Deterrence Model Yielding Greater Accuracy and Overall PerformanceAbdullah Alqahtani0Frederick T. Sheldon1College of Computer Science and Information Systems, Najran University, Najran 61441, Saudi ArabiaDepartment of Computer Science, University of Idaho, Moscow, ID 83844, USAEarly detection of ransomware attacks is critical for minimizing the potential damage caused by these malicious attacks. Feature selection plays a significant role in the development of an efficient and accurate ransomware early detection model. In this paper, we propose an enhanced Mutual Information Feature Selection (<i>e</i>MIFS) technique that incorporates a normalized hyperbolic function for ransomware early detection models. The normalized hyperbolic function is utilized to address the challenge of perceiving common characteristics among features, particularly when there are insufficient attack patterns contained in the dataset. The Term Frequency–Inverse Document Frequency (TF–IDF) was used to represent the features in numerical form, making it ready for the feature selection and modeling. By integrating the normalized hyperbolic function, we improve the estimation of redundancy coefficients and effectively adapt the MIFS technique for early ransomware detection, i.e., before encryption takes place. Our proposed method, <i>e</i>MIFS, involves evaluating candidate features individually using the hyperbolic tangent function (tanh), which provides a suitable representation of the features’ relevance and redundancy. Our approach enhances the performance of existing MIFS techniques by considering the individual characteristics of features rather than relying solely on their collective properties. The experimental evaluation of the <i>e</i>MIFS method demonstrates its efficacy in detecting ransomware attacks at an early stage, providing a more robust and accurate ransomware detection model compared to traditional MIFS techniques. Moreover, our results indicate that the integration of the normalized hyperbolic function significantly improves the feature selection process and ultimately enhances ransomware early detection performance.https://www.mdpi.com/1424-8220/24/6/1728ransomwarecyber securityfeature selectionMIFScrypto-ransomwareearly detection |
| spellingShingle | Abdullah Alqahtani Frederick T. Sheldon <i>e</i>MIFS: A Normalized Hyperbolic Ransomware Deterrence Model Yielding Greater Accuracy and Overall Performance Sensors ransomware cyber security feature selection MIFS crypto-ransomware early detection |
| title | <i>e</i>MIFS: A Normalized Hyperbolic Ransomware Deterrence Model Yielding Greater Accuracy and Overall Performance |
| title_full | <i>e</i>MIFS: A Normalized Hyperbolic Ransomware Deterrence Model Yielding Greater Accuracy and Overall Performance |
| title_fullStr | <i>e</i>MIFS: A Normalized Hyperbolic Ransomware Deterrence Model Yielding Greater Accuracy and Overall Performance |
| title_full_unstemmed | <i>e</i>MIFS: A Normalized Hyperbolic Ransomware Deterrence Model Yielding Greater Accuracy and Overall Performance |
| title_short | <i>e</i>MIFS: A Normalized Hyperbolic Ransomware Deterrence Model Yielding Greater Accuracy and Overall Performance |
| title_sort | i e i mifs a normalized hyperbolic ransomware deterrence model yielding greater accuracy and overall performance |
| topic | ransomware cyber security feature selection MIFS crypto-ransomware early detection |
| url | https://www.mdpi.com/1424-8220/24/6/1728 |
| work_keys_str_mv | AT abdullahalqahtani ieimifsanormalizedhyperbolicransomwaredeterrencemodelyieldinggreateraccuracyandoverallperformance AT fredericktsheldon ieimifsanormalizedhyperbolicransomwaredeterrencemodelyieldinggreateraccuracyandoverallperformance |