Effective Ransomware Detection Method Using PE Header and YARA Rules

As information technology has become more ingrained in people’s lives, data protection has become more and more crucial. On the other hand, malicious programs are being created that could tamper with sensitive and important information and restrict the access to it. A perfect example for such is ransomware, it locks down a computer and prevents users from using it until a ransom is paid. Every 11–14 s, a brand-new organization gets assaulted. Faster recovery is facilitated by early ransomware detection. In this paper, to detect ransomware, several machine learning models are trained using information derived from portable executable (PE) file structure. The proposed approach classifies ransomware applications with 99.4% accuracy by using 14 features. These 14 features are important, and it is enough to provide the accurate classification result. And, to improve the efficiency, the classified file is further examined to check for any bitcoin addresses being present or not through YARA rules.