نوع مقاله : مقاله پژوهشی
نویسندگان
1 دانشگاه جامع امام حسین ع دانشکده سایبرالکترونیک آزمایشگاه مرجع تحلیل بدافزار
2 معاونت علمی و پژوهشی دانشکده سایبرالکترونیک دانشگاه جامع امام حسین ع
چکیده
کلیدواژهها
عنوان مقاله [English]
نویسندگان [English]
In recent years, the tendency for ransomware-based cyberattacks has increased dramatically. One of the defensive methods is the behavioral detection of the ransomware by system functions. Literature review and related studies and investigations in this field show that these researches are not optimum concerning the accuracy and speed of ransomware detection. Because all datasets used in these studies are limited in scope, they have shortcomings such as high false positive or false negative rates and even high indiscriminate rates. Another drawback of these schemes is the failure to expedite the debate on extortion ransom. Therefore, in this study, the first step is to generate an initial dataset with 126 attributes containing all types of ransomware families. Then, by performing 4-step experiments and tests and applying a feature selection algorithm, this initial set is processed and optimized and reduced to a dataset with 67 attributes without loss of detection precision. In the final step, by providing an optimal and so-called lightweight dataset, the best classification model for the detection of ransomware is obtained being capable of identifying ransomwares with an optimum precision rate of 95.11 in 0.21 seconds, a false positive rate of 0.047 and a true positive rate of 0.951 by using a random forest classification algorithm (using 10-part cross-validation method).
کلیدواژهها [English]
)
