Dynamic Ransomware Classification: Leveraging Sandbox and Machine Learning

Abstract

The surge in ransomware attacks in recent years has elevated this malware to one of the foremost cybersecurity threats. This article presents a dynamic ransomware classification approach, leveraging the malware analysis environment provided by Cuckoo Sandbox and machine learning techniques. We introduce a methodology encompassing steps for malicious code sample collection, environment configuration for sample execution, data collection, and dataset construction for ransomware detection and experimentation. Six machine learning classifiers were employed to identify ransomware families and individual cases, furnishing valuable tools for threat detection. The results underscore the effectiveness of tree-based methods, such as Random Forests and Decision Trees, in delineating between different ransomware families.