Ransomware Detection with Deep Neural Networks

Abstract

The number of reported malware and their average identification time increases each year, thus increasing the mitigation cost. Static analysis techniques cannot reliably detect polymorphic and metamorphic malware, while dynamic analysis is more effective in detecting advanced malware, especially when the analysis is performed using machine-learning techniques. This paper presents a novel approach for the detection of ransomware, a particular type of malware. The approach uses word embeddings to represent system call features and deep neural networks such as Convolutional Neural Networks (CNN) and Long Short-Term Memory Networks (LSTM). The evaluation, performed on two datasets, shows that the described approach achieves a detection rate of over 99% for ransomware samples.