[Paper Review] Ransomware Analysis using Feature Engineering and Deep Neural Networks

Arslan Ashraf, Abdul Aziz+3 more|arXiv (Cornell University)|Oct 1, 2019

Advanced Malware Detection Techniques23 references17 citations

TL;DR

This paper proposes a ransomware detection framework combining feature engineering and deep learning, using static and dynamic datasets to identify critical behavioral patterns—particularly registry deletions, API calls, and DLL usage. It demonstrates that ransomware exhibits distinct, repeatable sequences in registry operations, unlike benign software, enabling high-accuracy detection via both traditional ML and transfer learning-based CNNs, with F1-scores exceeding 0.95 on the dynamic dataset.

ABSTRACT

Detection and analysis of a potential malware specifically, used for ransom is a challenging task. Recently, intruders are utilizing advanced cryptographic techniques to get hold of digital assets and then demand a ransom. It is believed that generally, the files comprise of some attributes, states, and patterns that can be recognized by a machine learning technique. This work thus focuses on the detection of Ransomware by performing feature engineering, which helps in analyzing vital attributes and behaviors of the malware. The main contribution of this work is the identification of important and distinct characteristics of Ransomware that can help in detecting them. Finally, based on the selected features, both conventional machine learning techniques and Transfer Learning based Deep Convolutional Neural Networks have been used to detect Ransomware. In order to perform feature engineering and analysis, two separate datasets (static and dynamic) were generated. The static dataset has 3646 samples (1700 Ransomware and 1946 Goodware). On the other hand, the dynamic dataset comprised of 3444 samples (1455 Ransomware and 1989 Goodware). Through various experiments, it is observed that the Registry changes, API calls, and DLLs are the most important features for Ransomware detection. Additionally, important sequences are found with the help of the N-Gram technique. It is also observed that in the case of Registry Delete operation, if a malicious file tries to delete registries, it follows a specific and repeated sequence. However, for the benign file, it doesnt follow any specific sequence or repetition. Similarly, an interesting observation made through this study is that there is no common Registry deleted sequence between malicious and benign files. And thus this discernible fact can be readily exploited for Ransomware detection.

Motivation & Objective

• To identify distinguishing behavioral and structural features of ransomware for improved detection.
• To address the challenge of detecting advanced ransomware using cryptographic techniques that evade traditional signature-based methods.
• To develop a hybrid detection approach combining feature engineering with deep learning for enhanced accuracy.
• To generate and utilize dual datasets (static and dynamic) to capture diverse ransomware behaviors.

Proposed method

• Feature engineering was applied to extract 3646 static and 3444 dynamic samples, including API calls, registry changes, and DLL usage.
• N-gram analysis was used to detect sequential patterns in system calls, especially in registry deletion operations.
• Transfer learning with deep convolutional neural networks (CNNs) was employed to classify ransomware based on engineered features.
• Both conventional machine learning models and pre-trained CNNs were evaluated on the generated datasets for comparative performance.
• The study focused on identifying repetitive and unique sequences in registry operations as discriminative indicators of malicious behavior.
• Evaluation was conducted using standard metrics including F1-score, precision, and recall on both static and dynamic datasets.

Experimental results

Research questions

• RQ1 What system-level features (e.g., API calls, registry changes, DLLs) are most indicative of ransomware behavior?
• RQ2 Can sequential patterns in system operations—particularly registry deletions—distinguish ransomware from benign software?
• RQ3 How effective is transfer learning with deep CNNs in detecting ransomware when combined with engineered features?
• RQ4 Do malicious and benign files exhibit different patterns in registry deletion sequences?
• RQ5 Can feature engineering significantly improve detection accuracy compared to baseline methods?

Key findings

• Registry deletion operations in ransomware follow specific, repeatable sequences, while benign files show no consistent or repeated patterns.
• No common registry deletion sequence was observed between malicious and benign files, indicating this behavior is a strong discriminative signal.
• API calls, registry changes, and DLL usage were identified as the most important features for ransomware detection.
• The deep learning model achieved an F1-score above 0.95 on the dynamic dataset, demonstrating high detection accuracy.
• N-gram analysis successfully captured critical behavioral sequences, especially in malicious registry operations.
• The combination of feature engineering and transfer learning-based CNNs outperformed conventional machine learning models in detection performance.