Enhanced Ransomware Detection via 1D Convolutional Neural Network Architecture

Abstract

Ransomware has become one of the most common and devastating types of computer attacks that can not only encrypt important information but also interrupt business activities in multiple organizations across the globe. The conventional detection systems that are based on signature-based or rule-based mechanisms have not been effective in keeping pace with the sophisticated and evasive character of the contemporary ransomware. In turn, the given study suggests an improved one-dimensional Convolutional Neural Network (1D-CNN) network exclusively optimized to detect ransomware on the network using traffic analysis. The given model operates on flow-based characteristics of packets in a network in sequence, learning distinctive characteristics of behaviour through which the difference between ransomware and harmless traffic is identified implicitly. The architecture consists of a series of convolutional blocks that perform the hierarchical and then the fully connected layers that perform binary classification. The model evaluated on benchmark ransomware data had an overall detection accuracy of 98.1 with a precision and recall rate of over 96 and an AUC of 0.984. The 1D-CNN model has proven to be more efficient with much less computational cost than the current hybrid and recurrent methods, and thus it can be used in computational machines that detect intrusions in large-scale network applications in real-time. The results validate the notion that one-dimensional convolutional architectures can provide a lightweight and very efficient solution to early ransomware detection as a potentially helpful path towards the creation of the decades to come AI-driven cybersecurity systems.