Search

Ransomware continues to pose a significant threat to cybersecurity by extorting money from users by locking their devices and personal data. The attackers force the payment of a ransom in order to restore access to personal files. Because of the structural similarity, detection of ransomware and benign applications becomes vulnerable to evasion attacks. Ensemble learning can provide countermeasures, while attackers can use the same technique to improve the effectiveness of their respective attacks. This motivates us to investigate whether the distinct ensemble method can achieve better performance when combined with the voting-based method. This research proposes a hybrid approach that examines permissions, text, and network-based features both statically and dynamically by monitoring memory usage, system call logs, and CPU usage. Ensemble machine learning analyzers on static and dynamic features extracted from Android malware applications (ransomware and non-ransomware) are then trained in the designed model. Our experimental results show that the proposed ensemble classification and detection technique can classify unknown static and dynamic ransomware behavior to mitigate adversarial evasion attacks. [Display omitted] • The designed model extracts and analyzes static network-based features. • Two ML-based ensemble models are proposed for static and dynamic feature sets. • The model is for Android ransomware adversarial evasion attacks. [ABSTRACT FROM AUTHOR]

Recently, numerous Machine Learning (ML) algorithms have been applied in many areas of cybersecurity. However, most of these systems can only be seen as a black box to users. To improve our understanding of such systems, adversarial machine learning approaches can be used. The main features are detected by analyzing the extent of such changes, which helps in identifying the main reasons for misclassification. In this paper, the presented approach has obtained satisfactory results that accurately explains the reasons for misclassifications. Some features of the presented method can be applied to any classifier with defined gradients without the need for modifications. The proposed model can be extended to perform more diagnoses and it can be used for a deeper analysis of systems, obtaining more than 95% accuracy classification on the used datasets in the experiments. [Display omitted] • Explains misclassifications by data-driven AI models using an adversarial approach. • Compute the minimum number of changes to input features required. • Increased average classification accuracy by 2.5% post modification. • Designed a black-box attack to test the correctness and trustworthiness. • Used explanation maps to examine the effectiveness of attacks. [ABSTRACT FROM AUTHOR]