ANDROID RANSOMWARE CLASSIFICATION USING MACHINE LEARNING

Abstract

In the era of technology, the common use of Android smartphones has led to increased cybercrime activities, including Ransomware attacks that target user-sensitive data. Ransomware, which encrypts data and demands a ransom for decryption, poses serious risks such as financial losses and business disruptions. This motivates the development of both ML and DL techniques to detect ransomware attacks on Android networks. This thesis will mainly focus on the classification of ransomware and benign traffic, as well as distinguishing between various ransomware types. In this thesis, utilizing a real-world dataset from Kaggle with 392.034 rows, including benign traffic and 10 types of Android ransomware attacks. Android ransomware classification was carried out with two experiments. In Experiment 1, all features were used, while in Experiment 2, after applying feature selection techniques, only the top 19 most important features were utilized. There are seven algorithms for training, like Decision Tree (DT), Support Vector Machine (SVM), K-Nearest Neighbors (KNN), an Ensemble of (DT, SVM, KNN), Feed Forward Neural Network (FNN), Tabular Attention Network (TabNet), and CNN-LSTM, which combines a 1D Convolutional Neural Network (CNN) with Long Short-Term Memory (LSTM). Afterward, there are the ten most important attributes that can be used to classify Android ransomware types. Information gain techniques were applied during the data preprocessing phase, followed by the implementation of effective classification algorithms such as Decision Tree (DT), Naive Bayes, and OneR. Of the three classifiers, the decision tree classifier produced the best classification results.