Transfer Learning for Ransomware Attack Detection

Ransomware is a type of malware that encrypts files or locks infected devices to prevent users from access to their systems. Ransomware is rapidly evolving, and there are limited numbers of training examples because it is usually delivered using spear-phishing attacks meaning it evades collection. These two problems limit the accuracy of existing work on applying machine learning because of changes in the probability distribution (features or labels) between the training and test data as well as lack of recent training examples. Transfer learning is a technique that performs well despite these problems. We have applied a transfer learning-based approach to detect the unknown ransomware malware families. In particular we have proposed a computational intelligence based dynamic ransomware prediction approach to predict the distinct type of ransomware families. The transfer-learning approach allows the training and test data to be drawn from different probability distributions as well as expands the number of training examples available. Our experiments show we can predict up to 92% of unknown ransomware families compared to deep learning approach for the next best existing machine learning approach