DefinePK

Abstract

This paper presents a two-level machine learning model for early crypto-ransomware detection to detect threats prior to encryption. The proposed system includes a Signature Recognition (SR) module, and a Learning Agent (LA), both utilizing the Random Forest classifier. The model is highly accurate with a 90% average accuracy and an ROC AUC of 0.94. The SR module can detect known attack patterns, and the LA can effectively detect nascent emerging threats, hence the model is adaptive to various threat situations. For performance evaluation, the paper uses extensive evaluation metrics such as accuracy, precision, recall, F1 score, and ROC AUC. The proposed N-DIMEL model provides a proactive, balanced, and reliable solution that gives valuable insights to the cybersecurity teams in selecting and deploying effective ransomware detection systems