Mitigating adversarial evasion attacks of ransomware using ensemble learning. (May 2022)

• Record Type: Journal Article
• Authors: Ahmed, Usman; Lin, Jerry Chun-Wei; Srivastava, Gautam
• Is Part Of: Computers & electrical engineering. Volume 100(2022)
• Publication Date: 2022-05
• Subjects: Android ransomware -- Adversarial evasion attacks -- Machine learning-based ensemble analysis -- Attack mitigation -- Ransomware detection; Computer engineering -- Periodicals; Electrical engineering -- Periodicals; Electrical engineering -- Data processing -- Periodicals; Ordinateurs -- Conception et construction -- Périodiques; Électrotechnique -- Périodiques; Électrotechnique -- Informatique -- Périodiques; Computer engineering; Electrical engineering; Electrical engineering -- Data processing; Periodicals; Electronic journals; 621.302854
• DOI: 10.1016/j.compeleceng.2022.107903
• Languages: English
• ISSNs: 0045-7906

Abstract

Abstract: Ransomware continues to pose a significant threat to cybersecurity by extorting money from users by locking their devices and personal data. The attackers force the payment of a ransom in order to restore access to personal files. Because of the structural similarity, detection of ransomware and benign applications becomes vulnerable to evasion attacks. Ensemble learning can provide countermeasures, while attackers can use the same technique to improve the effectiveness of their respective attacks. This motivates us to investigate whether the distinct ensemble method can achieve better performance when combined with the voting-based method. This research proposes a hybrid approach that examines permissions, text, and network-based features both statically and dynamically by monitoring memory usage, system call logs, and CPU usage. Ensemble machine learning analyzers on static and dynamic features extracted from Android malware applications (ransomware and non-ransomware) are then trained in the designed model. Our experimental results show that the proposed ensemble classification and detection technique can classify unknown static and dynamic ransomware behavior to mitigate adversarial evasion attacks. Graphical abstract: Highlights: The designed model extracts and analyzes static network-based features. Two ML-based ensemble models are proposed for static and dynamic feature sets. The model is for Android ransomware adversarial evasion attacks.