Machine learning-based anomaly detection in Android network flows for ransomware identification

Abstract

Ransomware continues to pose a significant challenge as it infiltrates networks and employs advanced techniques to encrypt data. To counteract such adversarial endeavors and mitigate any harm, prompt identification of ransomware operations is imperative. The primary objective of this research was to examine the viability of utilizing machine learning techniques for the identification of irregularities in network flows, specifically focusing on the identification of ransomware within Android ecosystems. The fundamental basis of this study was a comprehensive dataset comprising both benign and malicious instances of network traffic originating from several ransomware families. A neural network model was meticulously constructed and trained using a portion of the dataset, followed by thorough testing on novel data to assess its predictive performance. The model has exceptional performance across all classes, as seen by its high levels of accuracy, precision, recall, and F1 Score. Significantly, the model demonstrates a robust ability to extrapolate findings to several categories of ransomware and benign network activity, indicating its potential as a reliable solution for practical implementation. This study establishes the foundation for future endeavors aimed at enhancing the model, exploring real-time detection alternatives, and integrating with comprehensive security solutions.

Keywords: Android Security; anomaly detection; cybersecurity; ransomware identification; machine learning