Ransomware Early Detection Techniques


  • Asma A. Alhashmi Department of Computer Science, College of Science, Northern Border University, Saudi Arabia
  • Abdulbasit A. Darem Department of Computer Science, College of Science, Northern Border University, Saudi Arabia
  • Ahmed B. Alshammari Department of Computer Science, College of Science, Northern Border University, Saudi Arabia
  • Laith A. Darem Department of Electrical Engineering, Northern Border University, Saudi Arabia
  • Huda K. Sheatah Department of Computer Science, College of Science, Northern Border University, Saudi Arabia
  • Rachid Effghi Department of Big Data Analytics and Management, Bahcesehir University, Turkey
Volume: 14 | Issue: 3 | Pages: 14497-14503 | June 2024 | https://doi.org/10.48084/etasr.6915


Ransomware has become a significant threat to individuals and organizations worldwide, causing substantial financial losses and disruptions. Early detection of ransomware is crucial to mitigate its impact. The significance of early detection lies in the capture of ransomware in the act of encrypting sample files, thus thwarting its progression. A timely response to ransomware is crucial to prevent the encryption of additional files, a scenario not adequately addressed by current antivirus programs. This study evaluates the performance of six machine-learning algorithms for ransomware detection, comparing the accuracy, precision, recall, and F1-score of Logistic Regression, Decision Tree, Naive Bayes, Random Forest, AdaBoost, and XGBoost. Additionally, their computational performance is evaluated, including build time, training time, classification speed, computational time, and Kappa statistic. This analysis provides insight into the practical feasibility of the algorithms for real-world deployment. The findings suggest that Random Forst, Decision Tree, and XGBoost are promising algorithms for ransomware detection due to their high accuracy of 99.37%, 99.42%, and 99.48%, respectively. These algorithms are also relatively efficient in terms of classification speed, which makes them suitable for real-time detection scenarios, as they can effectively identify ransomware samples even in the presence of noise and data variations.


Ransomware, Early Detection, Machine Learning, Computational Performance, Cybersecurity


Download data is not yet available.


D. Dang, F. D. Troia, and M. Stamp, "Malware Classification using Long Short-term Memory Models," in Proceedings of the 7th International Conference on Information Systems Security and Privacy, Apr. 2024, pp. 743–752.

A. Moses and S. Morris, "Analysis of Mobile Malware: A Systematic Review of Evolution and Infection Strategies," Journal of Information Security and Cybercrimes Research, vol. 4, no. 2, pp. 103–131, Dec. 2021.

"Playing with Lives: Cyberattacks on Healthcare are Attacks on People," CyberPeace Institute, 2021.

D. Hummer and J. M. Byrne, Handbook on Crime and Technology. Cheltenham, UK: Edward Elgar Publishing, 2023.

M. Rigaki and S. Garcia, "Bringing a GAN to a Knife-Fight: Adapting Malware Communication to Avoid Detection," in 2018 IEEE Security and Privacy Workshops (SPW), San Francisco, CA, USA, May 2018, pp. 70–75.

"Ponemon Institute reveals 68% of organizations were victims of successful endpoint attacks in 2019," Security Info Watch, Jan. 30, 2020. https://www.securityinfowatch.com/cybersecurity/press-release/21123576/ponemon-institute-ponemon-institute-reveals-68-of-organizations-were-victims-of-successful-endpoint-attacks-in-2019.

"Ransomware Response: Time is More Than Just Money," Security Intelligence. https://securityintelligence.com/posts/ransomware-response-time-more-than-money/securityintelligence.com/posts/ransomware-response-time-more-than-money.

K. Shaukat, S. Luo, V. Varadharajan, I. A. Hameed, and M. Xu, "A Survey on Machine Learning Techniques for Cyber Security in the Last Decade," IEEE Access, vol. 8, pp. 222310–222354, 2020.

J. Hwang, J. Kim, S. Lee, and K. Kim, "Two-Stage Ransomware Detection Using Dynamic Analysis and Machine Learning Techniques," Wireless Personal Communications, vol. 112, no. 4, pp. 2597–2609, Jun. 2020.

A. A. Alhashmi, A. M. Alashjaee, A. A. Darem, A. F. Alanazi, and R. Effghi, "An Ensemble-based Fraud Detection Model for Financial Transaction Cyber Threat Classification and Countermeasures," Engineering, Technology & Applied Science Research, vol. 13, no. 6, pp. 12433–12439, Dec. 2023.

A. Al-Marghilani, "Comprehensive Analysis of IoT Malware Evasion Techniques," Engineering, Technology & Applied Science Research, vol. 11, no. 4, pp. 7495–7500, Aug. 2021.

K. Aldriwish, "A Deep Learning Approach for Malware and Software Piracy Threat Detection," Engineering, Technology & Applied Science Research, vol. 11, no. 6, pp. 7757–7762, Dec. 2021.

S. Sechel, "A Comparative Assessment of Obfuscated Ransomware Detection Methods," Informatica Economica, vol. 23, no. 2, pp. 45–62, 2019.

H. Oz, A. Aris, A. Levi, and A. S. Uluagac, "A Survey on Ransomware: Evolution, Taxonomy, and Defense Solutions," ACM Computing Surveys, vol. 54, no. 11s, Jun. 2022, Art. no. 238.

K. Lee, K. Yim, and J. T. Seo, "Ransomware prevention technique using key backup," Concurrency and Computation: Practice and Experience, vol. 30, no. 3, 2018, Art. no. e4337.

U. Urooj, B. A. S. Al-rimy, A. Zainal, F. A. Ghaleb, and M. A. Rassam, "Ransomware Detection Using the Dynamic Analysis and Machine Learning: A Survey and Research Directions," Applied Sciences, vol. 12, no. 1, Jan. 2022, Art. no. 172.

M. Masum, M. J. Hossain Faruk, H. Shahriar, K. Qian, D. Lo, and M. I. Adnan, "Ransomware Classification and Detection With Machine Learning Algorithms," in 2022 IEEE 12th Annual Computing and Communication Workshop and Conference (CCWC), Las Vegas, NV, USA, Jan. 2022, pp. 0316–0322.

E. Larsen, D. Noever, and K. MacVittie, "A Survey of Machine Learning Algorithms for Detecting Ransomware Encryption Activity." arXiv, Oct. 14, 2021.

Q. Chen, S. R. Islam, H. Haswell, and R. A. Bridges, "Automated Ransomware Behavior Analysis: Pattern Extraction and Early Detection," in Science of Cyber Security, Nanjing, China, 2019, pp. 199–214.

O. M. K. Alhawi, J. Baldwin, and A. Dehghantanha, "Leveraging Machine Learning Techniques for Windows Ransomware Network Traffic Detection," in Cyber Threat Intelligence, A. Dehghantanha, M. Conti, and T. Dargahi, Eds. Cham, Switzerland: Springer International Publishing, 2018, pp. 93–106.

N. Pundir, M. Tehranipoor, and F. Rahman, "RanStop: A Hardware-assisted Runtime Crypto-Ransomware Detection Technique." arXiv, Nov. 24, 2020.

A. Singh, R. Ikuesan, and H. Venter, "Ransomware Detection using Process Memory," in Proceedings of the 17th International Conference on Cyber Warfare and Security, Albany, NY, USA, Mar. 2022, vol. 17, pp. 413–422.

B. A. S. Al-rimy et al., "Redundancy Coefficient Gradual Up-weighting-based Mutual Information Feature Selection technique for Crypto-ransomware early detection," Future Generation Computer Systems, vol. 115, pp. 641–658, Feb. 2021.

Y. Sahin and E. Duman, "Detecting credit card fraud by ANN and logistic regression," in 2011 International Symposium on Innovations in Intelligent Systems and Applications, Istanbul, Turkey, Jun. 2011, pp. 315–319.

A. S. Alraddadi, "A Survey and a Credit Card Fraud Detection and Prevention Model using the Decision Tree Algorithm," Engineering, Technology & Applied Science Research, vol. 13, no. 4, pp. 11505–11510, Aug. 2023.

Y. Ding, W. Kang, J. Feng, B. Peng, and A. Yang, "Credit Card Fraud Detection Based on Improved Variational Autoencoder Generative Adversarial Network," IEEE Access, vol. 11, pp. 83680–83691, 2023.

M. Wa Nkongolo, "UGRansome Dataset." Kaggle.

M. Tokmak, "Deep Forest Approach for Zero-Day Attacks Detection," in Innovations and Technologies in Engineering, S. Tasdemir and I. Ali Ozkan, Eds. Istanbul, Turkey: Eğitim Yayinevi, 2022.

D. Shankar, G. V. Sudha, J. N. S. S. Naidu, and P. S. Madhuri, "Deep Analysis of Risks and Recent Trends Towards Network Intrusion Detection System," International Journal of Advanced Computer Science and Applications, vol. 14, no. 1, pp. 262-276, 2023.


How to Cite

A. A. Alhashmi, A. A. Darem, A. B. Alshammari, L. A. Darem, H. K. Sheatah, and R. Effghi, “Ransomware Early Detection Techniques”, Eng. Technol. Appl. Sci. Res., vol. 14, no. 3, pp. 14497–14503, Jun. 2024.


Abstract Views: 192
PDF Downloads: 103

Metrics Information

Most read articles by the same author(s)