Ransomware Detection on Windows Systems
摘要
Ransomware is a serious cybersecurity threat, making it important to develop better ways to detect it. This study looks at how behavioural analysis and machine learning, specifically Long Short-Term Memory (LSTM) networks, can help tell the difference between ransomware and legitimate software (goodware). We used a dataset that included 50 samples of ransomware and 50 samples of goodware. Then we extracted detailed behavioural features, like sequences of API calls, changes to the file system, and patterns of network communication. We had tested three machine learning models: Random Forest, Support Vector Machine, and LSTM. In our result, we have shown that LSTM networks have great potential for improving the accuracy and effectiveness of ransomware detection. For future research, we are planning to refine how we can extract features, explore other algorithms, and expand our dataset to include a wider variety of ransomware families and goodware applications. The aim is to strengthen the detection and prevention of ransomware attacks and help us to create a safer computing environment for everyone.