Title Page
Abstract
Contents
Chapter 1. INTRODUCTION 11
1.1. Overview 11
1.2. Research purposes and directions 14
Chapter 2. RELATED RESEARCHES 16
2.1. Previous studies 16
2.2. Machine learning and Gradient Boost Decision Tree 21
2.2.1. Machine learning 21
2.2.2. Gradient Boosting Decision Tree 22
Chapter 3. LIGHTGBM-BASED RANSOMWARE DETECTION 24
3.1. LightGBM Algorithm 24
3.1.1. Gradient-based One-Side Sampling 26
3.1.2. Exclusive Feature Bundling 27
3.2. Proposed Ransomware detection method 28
Chapter 4. EXPERIMENTAL RESULTS AND ANALYSIS 30
4.1. Database gathering and analysis 30
4.2. Experimental conduction process 34
4.3. Experimental result and Analysis 40
4.3.1. Evaluation criteria 40
4.3.2. Experiment results 42
4.3.3. Analysis and Discussion 46
Chapter 5. CONCLUSION 48
REFERENCES 50
APPENDIX 53
Abstract 67
〈Table 1〉 The number of file collected from each source 31
〈Table 2〉 Ransomware families 32
〈Table 3〉 The number of API calls used by PE file 32
〈Table 4〉 List of class labels 36
〈Table 5〉 The dataset after combine all API call of entire samples 37
〈Table 6〉 The dataset after transformation 38
〈Table 7〉 Classification evaluation results 42
〈Table 8〉 The use of API call by PE files 45
〈Figure 1〉 The increasing of ransomware attacks 12
〈Figure 2〉 Ransomware payments by quarter 13
〈Figure 3〉 The application of Machine learning 21
〈Figure 4〉 Boosting algorithm 22
〈Figure 5〉 Gradient boosting decision tree 23
〈Figure 6〉 Comparison between level-wise and leaf-wise tree 25
〈Figure 7〉 Ransomware multiple classification proposal method 29
〈Figure 8〉 Ransomware along with number of API calls used 33
〈Figure 9〉 Benign along with number of API calls used 34
〈Figure 10〉 Experimental process 35
〈Figure 11〉 The Cuckoo sandbox's architecture 35
〈Figure 12〉 The data transformation 38
〈Figure 13〉 Confusion matrix 43
〈Figure 14〉 The top 30 important features in our experiment 44