arrow
Return

MIRAD: A Method for Interpretable Ransomware Attack Detection

delete2024-01-01
delete1
delete
OA
AI
B
Bartosz Marcinkowski
M
Maja Goschorska *
N
Natalia Wileńska
J
Jakub Siuta
T
Tomasz Kajdanowicz
DOI:10.1109/ACCESS.2024.3461322delete
deleteOriginal
deleteOriginal request for help
deleteShare
deleteSave
Abstract

Abstract

En 中文
In the face of escalating crypto-ransomware attacks, we introduce MIRAD, a novel dynamic detection method. MIRAD leverages machine learning to continuously monitor API calls and registry entries, detecting ransomware at all stages of infection while maintaining system performance. What sets MIRAD apart is its strong focus on interpretability. This feature allows for quick, informed adaptation to the dynamically changing threat landscape and enables the detection and elimination of errors and biases that plague black-box models. In preliminary tests on data generated in a simulated user environment, our method demonstrates a high ROC AUC, outperforming standard interpretable models such as Gaussian Naive Bayes, KNN, and Decision Trees. Importantly, MIRAD achieves a low false positive rate, addressing a common issue in dynamic ransomware detection. Our contributions also include a Python library for easy implementation of MIRAD and a comprehensive, publicly available ransomware detection dataset, facilitating broader research and implementation in ransomware defense.
Keywords:
Ransomware
Training
Heuristic algorithms
Radio frequency
Medical services
Long short term memory
Binary sequences
Explainable AI
Binary classification
ransomware detection
explainable artificial intelligence

Journal

IEEE Access cover
IEEE Access
IF:
3.6
Papers:
9.8W
Citations:
29.4W

Organization

L
Lodz University of Technology
Scholars:
4.7K
Papers: 4.5K
Citations: 4.2K
W
wroclaw university of science & technology
Scholars:
7.4K
Papers: 7.1K
Citations: 2
Cited Papers

Cited Papers

Ransomware detection based on machine learning using memory features
err2024-03-01
err4
errOAAI
errAljabri, Malak; Alhaidari, Fahd; Albuainain, Aminah; Alrashidi, Samiyah; Alansari, Jana; Alqahtani, Wasmiyah; Alshaya, Jana
errShare
errSave
Analysis of Crypto-Ransomware Using ML-Based Multi-Level Profiling
err2021-01-01
err20
errOAAI
errPoudyal, Subash; Dasgupta, Dipankar
errShare
errSave
Know Abnormal, Find Evil: Frequent Pattern Mining for Ransomware Threat Hunting and Intelligence
err2020-04-01
err97
errOAAI
errHomayoun, Sajad; Dehghantanha, Ali; Ahmadzadeh, Marzieh; Hashemi, Sattar; Khayami, Raouf
errShare
errSave
The Age of Ransomware: A Survey on the Evolution, Taxonomy, and Research Directions
err2023-01-01
err38
errOAAI
errRazaulla, Salwa; Fachkha, Claude; Markarian, Christine; Gawanmeh, Amjad; Mansoor, Wathiq; Fung, Benjamin C. M.; Assi, Chadi
errShare
errSave
researcher View more