PEDLA Detection Model for Crypto-Ransomware

Oluwasogo Adekunle Okunade¹, Raymond Ternenge Igbudu¹ and Emmanuel Gbenga Dada²

¹Department of Computer Science, Faculty of Computing, National Open University of Nigeria, Abuja, Nigeria
²Department of Computer Science, Faculty of Physical Sciences, University of Maiduguri, Nigeria

*Corresponding author’s Email: igbuduraymond@gmail.com, doi.org/10.55639/607.05040303

---

ABSTRACT

Crypto ransomware is a challenging cybersecurity threat that encrypts the files of the victim and demands a ransom in exchange for the decryption key. Traditional signature-based protection methods, such as antivirus and anti￾malware, have proven in-effective at preventing crypto-ransomware attacks; therefore the production of ransomware is on the rise. Existing methods for early detection of crypto-ransomware attacks during the pre-encryption phase before encryption happens rely on a timing thresholding methodology to set the border of the pre-encryption stage. However, the fixed time threshold strategy, suggests that the samples begin encryption at the exact moment. This is not always the case since timing varies between crypto-ransomware families as a result of the obfuscation techniques used to evade detection. This research work therefore, proposed the creation of a Pre-Encryption Detection-Learning Algorithm (PEDLA). PEDLA monitors the pre-encryption stage for every case separately relying on the initial appearance of any API‟s related to cryptography to establish the pre-encryption stage boundary, whereby features are extracted and used in training a prediction model using the Random Forest machine learning algorithm. The sample data was obtained from widely used ransomware repositories such as VirusShare, Virus total and kaggle.com. The model achieved a detection accuracy of 98.6% with False Positive Rate (FPR) of 1.9%. Four classifiers including Support Vector Machines (SVM), K￾Nearest Neighbour (KNN), Multi Layer Perceptron (MLP), and AdaBoost, were used to evaluate the model’s classification abilities. Furthermore, a comparison was done between the related works and PEDLA. The findings show that PEDLA performed better across most calculated metrics, such as accuracy, precision and recall.

Keywords:

Crypto-ransomware,
Encryption,
Early detection,
Pre-encryption stage,
Signature-based