TREE-LIKE ALGORITH MS FOR RANSOMWARE ATTACK DETECTION

Abstract

Ransomware attack remains a significant threat to cybersecurity affecting people, businesses, and governments. The prompt and accurate detection of these attacks is crucial in reducing their adverse effects. This paper developed a ransomware attack detection applying some selected tree-like learning algorithms, The study applied three feature selection techniques; selectKBest, recursive feature elimination, and feature importance to the Kaggle ransomware dataset to obtain reduced attributes before the classification phase, which involved the application of Decision Trees (DT), Extra Trees (ET), and LightGBM (LGBM). The model was evaluated in terms of accuracy, precision, recall, F1-score, and ROC AUC. ET and LGBM performed best in detecting ransomware, consistently outperforming the DT. ET achieved the highest F1-score value of 0.9959 and a near-perfect ROC-AUC of 0.9993 without feature selection, showing its ability to maintain a strong balance between precision and recall. LGBM excelled with an F1-score of 0.9957 and the highest ROC AUC of 0.9997, showcasing its superior power to differentiate between benign and malicious actions associated with ransomware. The DT model despite being slightly more effective than ET and LGBM still delivered competitive results, indicating that the simpler models can be valuable for the detection of ransomware, predominantly in applications where the priority is computational efficiency. The impact of feature selection on model performance was also explored, with the best results typically achieved without any feature selection. Finally, it was revealed that tree-like learning algorithms, particularly Extra Trees and LightGBM, are highly effective tools for detecting ransomware, providing a robust defence against the increasing ransomware threat.