In recent years, the threat and damage caused by ransomware have been steadily increasing. Although many detection methods have been proposed, network security remains a severe challenge due to the continuous emergence of new attack techniques, data imbalance, low detection rates of existing methods, and the lack of interpretability in model decision-making. This study proposes a Case-Based Reasoning with Diffusion Model for Ransomware Detection (CBR-DRD), which classifies network traffic information without feature loss or redundancy by converting it into RGB images. The dataset is then augmented using image generation based on a U-Net diffusion model. Features extracted by a Swin Transformer are used to construct a case base, and a weighted K-Nearest Neighbors (KNN) algorithm is employed to classify the traffic by computing the similarity between a given sample and existing cases, to determine whether it is associated with ransomware activity. Compared with two similar ransomware detection approaches and commonly used generative models, namely the GAN model and a ResNet-based diffusion model designed to address data imbalance, the proposed method achieves superior performance on both the USTC-TFC2016 and ISOT datasets.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Case-Based Reasoning with Diffusion Model for Ransomware Detection

  • Haofan Wang,
  • Jarrod Hardy,
  • Farah Kandah

摘要

In recent years, the threat and damage caused by ransomware have been steadily increasing. Although many detection methods have been proposed, network security remains a severe challenge due to the continuous emergence of new attack techniques, data imbalance, low detection rates of existing methods, and the lack of interpretability in model decision-making. This study proposes a Case-Based Reasoning with Diffusion Model for Ransomware Detection (CBR-DRD), which classifies network traffic information without feature loss or redundancy by converting it into RGB images. The dataset is then augmented using image generation based on a U-Net diffusion model. Features extracted by a Swin Transformer are used to construct a case base, and a weighted K-Nearest Neighbors (KNN) algorithm is employed to classify the traffic by computing the similarity between a given sample and existing cases, to determine whether it is associated with ransomware activity. Compared with two similar ransomware detection approaches and commonly used generative models, namely the GAN model and a ResNet-based diffusion model designed to address data imbalance, the proposed method achieves superior performance on both the USTC-TFC2016 and ISOT datasets.