[Paper Review] Application of Explainable Machine Learning in Detecting and Classifying Ransomware Families Based on API Call Analysis

Rawshan Ara Mowri, Madhuri Siddula+1 more|arXiv (Cornell University)|Oct 16, 2022

Advanced Malware Detection Techniques4 citations

TL;DR

This paper proposes an explainable machine learning framework for detecting and classifying 15 ransomware families using API call frequency analysis from dynamically executed binaries. By employing a custom web crawler to collect samples, applying two-phase feature engineering with RFECV and RandomSearchCV, and leveraging SHAP for model interpretability, the study achieves 99.15% accuracy using Logistic Regression, with NtAlpcSendWaitReceivePort identified as the most influential feature.

ABSTRACT

Ransomware has appeared as one of the major global threats in recent days. The alarming increasing rate of ransomware attacks and new ransomware variants intrigue the researchers to constantly examine the distinguishing traits of ransomware and refine their detection strategies. Application Programming Interface (API) is a way for one program to collaborate with another; API calls are the medium by which they communicate. Ransomware uses this strategy to interact with the OS and makes a significantly higher number of calls in different sequences to ask for taking action. This research work utilizes the frequencies of different API calls to detect and classify ransomware families. First, a Web-Crawler is developed to automate collecting the Windows Portable Executable (PE) files of 15 different ransomware families. By extracting different frequencies of 68 API calls, we develop our dataset in the first phase of the two-phase feature engineering process. After selecting the most significant features in the second phase of the feature engineering process, we deploy six Supervised Machine Learning models: Na"ive Bayes, Logistic Regression, Random Forest, Stochastic Gradient Descent, K-Nearest Neighbor, and Support Vector Machine. Then, the performances of all the classifiers are compared to select the best model. The results reveal that Logistic Regression can efficiently classify ransomware into their corresponding families securing 99.15% overall accuracy. Finally, instead of relying on the 'Black box' characteristic of the Machine Learning models, we present the post-hoc analysis of our best-performing model using 'SHapley Additive exPlanations' or SHAP values to ascertain the transparency and trustworthiness of the model's prediction.

Motivation & Objective

• Address the growing threat of ransomware by improving detection and classification accuracy across diverse families.
• Automate the collection of Windows PE files for 15 ransomware families to reduce manual effort in dataset curation.
• Develop a robust, explainable machine learning pipeline that enhances trust and transparency in ransomware classification.
• Optimize model performance through rigorous hyperparameter tuning and feature selection to outperform existing methods.

Proposed method

• Built a custom web crawler, 'GetRansomware', to automatically collect Portable Executable (PE) files of 15 distinct ransomware families from public repositories.
• Executed ransomware and benign binaries in a sandbox environment to extract API call frequencies, forming the basis of the dataset.
• Applied a two-phase feature engineering process: first extracting 68 API call frequencies, then using Recursive Feature Elimination with Cross-Validation (RFECV) to select the most relevant features.
• Optimized six supervised machine learning models—Naïve Bayes, Logistic Regression, Random Forest, SGD, K-Nearest Neighbor, and SVM—using RandomSearchCV for hyperparameter tuning.
• Selected Logistic Regression as the best-performing model based on comparative evaluation across accuracy, precision, recall, F1-score, and AUROC.
• Conducted post-hoc explainability analysis using SHapley Additive exPlanations (SHAP) to interpret feature contributions and validate model decisions.

Experimental results

Research questions

• RQ1 Can automated collection of ransomware samples improve the scalability and reproducibility of malware detection research?
• RQ2 Which machine learning model achieves the highest accuracy in classifying multiple ransomware families based on API call frequencies?
• RQ3 How do different API calls contribute to the classification decision, and which features are most predictive of ransomware behavior?
• RQ4 To what extent does SHAP-based explainability enhance the trustworthiness and transparency of machine learning models in ransomware detection?

Key findings

• Logistic Regression achieved the highest overall accuracy of 99.15% in classifying 15 distinct ransomware families using API call frequency data.
• The frequency of the API call 'NtAlpcSendWaitReceivePort' was identified as the most influential feature, with the highest mean absolute SHAP value.
• When restricted to only the 20 most contributing features, the Logistic Regression model maintained a high accuracy of 95.48%, indicating that the remaining 21 features further improved performance.
• The SHAP analysis revealed that lower values of 'NtAlpcSendWaitReceivePort' had a negative impact on model output, while lower values of 'NtFsControlFile' had a positive impact, showing directional feature influence.
• The proposed method outperformed existing API-based classification approaches in both accuracy and multi-class capability, with 99.15% accuracy compared to a maximum of 98.65% in prior work.
• The integration of SHAP explainability provides actionable insights into model behavior, enhancing transparency and trust in automated ransomware classification systems.