2021/10/14 by Erik Larsen, David Noever, Larsen, Erik +4 · 1 voice
Computer Science · #Advanced Malware Detection Techniques #Anomaly Detection Techniques and Applications #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Machine Learning (cs.LG) #Network Security and Intrusion Detection #cs.CR #cs.LG
paper · pdf · doi:10.48550/arxiv.2110.07636
9 pages, 8 figures, 3 tables
arxiv created 2021/10/14 · openalex publication_date 2021/10/14 · arxiv published 2021/10/14 · arxiv updated 2021/10/18 · openalex created_date 2022/07/25 · openalex updated_date 2026/07/28
A survey of machine learning techniques trained to detect ransomware is presented. This work builds upon the efforts of Taylor et al. in using sensor-based methods that utilize data collected from built-in instruments like CPU power and temperature monitors to identify encryption activity. Exploratory data analysis (EDA) shows the features most useful from this simulated data are clock speed, temperature, and CPU load. These features are used in training multiple algorithms to determine an optimal detection approach. Performance is evaluated with accuracy, F1 score, and false-negative rate metrics. The Multilayer Perceptron with three hidden layers achieves scores of 97% in accuracy and F1 and robust data preparation. A random forest model produces scores of 93% accuracy and 92% F1, showing that sensor-based detection is currently a viable option to detect even zero-day ransomware attacks before the code fully executes.