Ransomware Detection Model Using Deep Learning WithEnsemble Technique Approach

Abstract

Ransomware attacks are increasingly prevalent, posing significant cybersecurity challenges. According to the National Cyber and Crypto Agency (BSSN), ransomware incidents surged from 69,853 in 2021 and 69,854 in 2022 to 1,011,209 in 2023. As ransomware variants continue to evolve, effective detection methods are crucial. This research proposes an ensemble deep learning model integrating Deep Neural Networks (DNN), Convolutional Neural Networks (CNN), and Recurrent Neural Networks (RNN) to enhance ransomware detection accuracy. In this framework, DNN captures complex patterns, CNN analyses static features, and RNN processes sequential data. To address class imbalance, the Synthetic Minority Over-sampling Technique (SMOTE) was applied during preprocessing, producing a balanced 50:50 distribution between ransomware and non-ransomware samples. The study uses the UGRansome dataset comprising 149,043 samples (71.44% positive, 28.56% negative) with 13 features. Experimental results demonstrate that the ensemble model significantly outperforms individual models, achieving an accuracy of 98.85%, precision of 98.51%, recall of 98.68%, and an F1-score of 98.59%. These findings highlight the effectiveness of ensemble learning in improving ransomware detection performance.