Explainable ransomware detection through static analysis and machine learning

Cybersecurity has recently become crucial in daily life routines due to several attacks performed by malicious users. Over the years, researchers and experts have proposed several solutions leveraging artificial intelligence to curb these problems. This research proposes a malware detector able to classify malware, ransomware, and trusted Windows executable files leveraging machine learning. As the first step, we created a dataset of approximately 15,000 Portable Executable files from which we extracted opcodes and computed feature vectors like the frequency and the distribution of each opcode for each file taken under analysis. Once we concluded the dataset creation phase, multiple classifiers were trained and evaluated, with the Gradient Boosting achieving the highest accuracy of 0.870. To ensure robustness, we performed 5-fold cross-validation. Moreover, we identified the best two models and applied explainability using Local Interpretable Model-Agnostic Explanations to understand better which features were most relevant for a specific classification. In conclusion, we also analyzed the most frequently used opcode classes to aid in their classification.