Redundancy coefficient gradual up-weighting-based mutual information feature selection technique for crypto-ransomware early detection

Al-Rimy, BAS, Maarof, MA, Alazab, M, Shaid, SZM, Ghaleb, FA, Almalawi, A, Alimi, AM and Al-Hadhrami, T ORCID: https://orcid.org/0000-0001-7441-604X, 2021. Redundancy coefficient gradual up-weighting-based mutual information feature selection technique for crypto-ransomware early detection. Future Generation Computer Systems, 115, pp. 641-658. ISSN 0167-739X

Preview

Text 1377205_a1171_Al-Hadhrami.pdf - Post-print Download (1MB) | Preview

Abstract

Crypto-ransomware is a type of malware whose effect is irreversible even after detection and removal. Thus, early detection is crucial to protect user files from being encrypted and held to ransom. Several studies have proposed early detection solutions based on the data acquired during the pre-encryption phase of the attacks. However, the lack of sufficient data in the early phases of the attack adversely affects the ability of feature selection techniques in these models to perceive the common characteristics of the attack features, which makes it challenging to reduce the redundant features, consequently decreasing the detection accuracy. Therefore, this study proposes a novel Redundancy Coefficient Gradual Upweighting (RCGU) technique that makes better redundancy–relevancy trade-offs during feature selection. Unlike existing feature significance estimation techniques that rely on the comparison between the candidate feature and the common characteristics of the already-selected features, RCGU compares the mutual information between the candidate feature and each feature in the selected set individually. Therefore, RCGU increases the weight of the redundancy term proportional to the number of already selected features. By integrating the RCGU into the Mutual Information Feature Selection (MIFS) technique, the Enhanced MIFS (EMIFS) was developed. Further improvement was achieved by proposing MM-EMIFS which incorporates the MaxMin approximation with EMIFS to prevent the redundancy overestimation that RCGU could cause when the number of features in the already-selected set increases. The experimental evaluation shows that the proposed techniques achieved accuracy higher than that in related works, which confirms the ability of RCGU to make better redundancy–relevancy trade-offs and select more discriminative pre-encryption attack features compared to existing solutions.

Item Type:	Journal article
Publication Title:	Future Generation Computer Systems
Creators:	Al-Rimy, B.A.S., Maarof, M.A., Alazab, M., Shaid, S.Z.M., Ghaleb, F.A., Almalawi, A., Alimi, A.M. and Al-Hadhrami, T.
Publisher:	Elsevier
Date:	February 2021
Volume:	115
ISSN:	0167-739X
Identifiers:	Number Type 10.1016/j.future.2020.10.002 DOI S0167739X20329794 Publisher Item Identifier 1377205 Other
Divisions:	Schools > School of Science and Technology
Record created by:	Linda Sullivan
Date Added:	14 Oct 2020 15:41
Last Modified:	08 Oct 2022 03:00
URI:	https://irep.ntu.ac.uk/id/eprint/41317

Actions (login required)

Edit View

Statistics

Views

Downloads