Comparative Evaluation of Selected Machine Learning Classifier Algorithms for Ransomware Detection in Computer Networks

Abstract

Network based extortion is the first order risk that has become the computer network, and has become a vital part of how organisations communicate, record and provide services. Ransomware wreaks havoc on services, encrypts files, finances, reputational and regulatory damage and signature-based ransomware defenses don't work very well for faster detection. In this study, the objective was to determine the best detector from four popular supervised classifiers for the case of class imbalance and feature redundancy. A quantitative experimental design was used. The UNSW-NB15 benchmark contained approximately 257,000 labelled records and 49 features was obtained. The records were cleaned, encoded and scaled, the class imbalance was corrected using an extreme gradient boosting model with a weighted loss function; the dimensionality was reduced using principal component analysis. The reduced set was then split in the ratio of 70:30 and then classified by four classifiers (SVM, RF, ANN and DT). The reproducibility was calculated with a fixed partitioning and an invariant pipeline and a peer reviewed benchmark. The accuracy rate of the neural network was 99.50 per cent and F1 score of 99.52 per cent, better than the other classifiers, random forest (98.38), support vector machine (98.04) and decision tree (96.00). The study is based on a like for like comparison, the imbalance correction and feature extraction are preserved and only the type of classifiers are changed. The choice of classifiers will have effect on the performance of the detection, however, the difference between good models-preprocessed models is not significant.