Evolving malice scoring models for ransomware detection: An automated approach by utilising genetic programming and cooperative coevolution. Issue 129 (June 2023)

• Record Type: Journal Article
• Authors: John, Taran Cyriac; Abbasi, Muhammad Shabbir; Al-Sahaf, Harith; Welch, Ian; Jang-Jaccard, Julian
• Is Part Of: Computers & security. Issue 129(2023)
• Publication Date: 2023-06
• Subjects: Ransomware detection -- Evolutionary computation -- Symbolic regression -- Genetic programming -- Malice score -- Cooperative coevolution; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2023.103215
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: Malice scoring is a technique that is present throughout the literature to quantify a software malignance through the assignment of a malice score. However, the majority of existing malice scoring models are synthesised using manually selected features and weights, where a domain specialist is needed. Hence, this paper aim at utilising Genetic Programming and cooperative coevolution to automatically evolve an ensemble of symbolic regression functions to assign a malice score to an instance of software data. Using a publicly available dataset, the effectiveness of the proposed method is assessed and compared to that of the state-of-the-art malice scoring method. The experimental results show that the proposed method has significantly outperformed the benchmark method and exhibits the best-performing model that produces an overall balanced accuracy of 95.80%, correctly classifying 94.21% and 97.39% of unseen malicious and benign instances, respectively. Furthermore, various aspects of the proposed method and experimental results have been analysed in-depth to provide insight into the evolutionary process and some of the automatically evolved models.