Classification of ransomware based on artificial neural networks

Abstract

Currently, different forms of ransomware are increasingly threatening users. Modern ransomware encrypts important user data and it is only possible to recover it once a ransom has been paid [14]. In this paper, we classify ransomware in 10 classes which are labeled using avclass tool. In this classification, we based on artificial neural networks with multilayer perceptron function. To do this, it was necessary to build the learning base based on ransomware files. We then implemented programs in java allowing the extraction of the key strings from ransomwares files intended for the learning stage and for the test one. Once the learning and testing databases have been prepared, we started the classification with the weka tool. The objective of this contribution is to investigate if the neural networks are an effective means for the classification of this kind of ransomwares or it will be necessary to think to another method of classification.