ENHANCING RANSOMWARE CLASSIFICATION USING LIGHT WEIGHT MACHINE LEARNING ALGORITHM AND ENSEMBLE METHODS

Abstract

The increasing sophistication and frequency of ransomware attacks pose significant challenges to cybersecurity, particularly in resource-constrained environments where computational efficiency is essential. Traditional detection models often struggle to maintain high accuracy while minimizing false positives and computational overhead, limiting their practical deployment in real-time systems. Addressing this challenge, this research aims to develop a lightweight, efficient, and adaptive machine learning framework that enhances ransomware classification by integrating ensemble learning with advanced feature selection techniques. The study’s objectives include designing a soft voting ensemble model that combines multiple high-performing classifiers to improve accuracy and reduce misclassification rates, applying Recursive Feature Elimination (RFE) to systematically identify and retain the most relevant features for improved efficiency and reduced overfitting, and employing Principal Component Analysis (PCA) to compress the feature space into a set of uncorrelated components while preserving critical detection information. The proposed framework was trained and tested on the “Ransomware-All” subset of the CIC-AndMal2017 dataset containing 348,943 samples with 84 features, and its performance was evaluated using accuracy, precision, recall, and F1 score as metrics. Results show that the soft voting ensemble achieved an accuracy of 99.10%, with both precision and recall at 0.989, outperforming all individual classifiers while significantly lowering false positive and false negative rates. These outcomes demonstrate that the integration of lightweight algorithms, ensemble learning, and feature selection offers a robust and scalable solution for ransomware detection, making it highly suitable for deployment in environments such as IoT devices, mobile platforms, and edge computing systems.