Authors:
Jiaxing Zhou
1
;
Miyuki Hirose
1
;
Yoshio Kakizaki
1
and
Atsuo Inomata
2
Affiliations:
1
Tokyo Denki University, 5 Senju Asahicho, Adachiku, Tokyo, Japan
;
2
Osaka University, 1-1 Yamadaoka, Suita, Osaka, Japan
Keyword(s):
Ransomware, Subspecies, SVM, Pearson Correlation Coefficient.
Abstract:
Research into ransomware subspecies classification is ongoing in many organizations, but it is proving difficult to extract feature quantities from specimens and the accuracy achieved thus far remains unsatisfactory. In this paper, we propose a method to classify subspecies that using the correlation coefficient between API groups calculated by Application Programming Interfaces (API) frequencies as the Support Vector Machines’ (SVM) feature quantities. The motivation for using the correlation coefficient between API groups as the feature quantity is that different ransomware families have different behavior patterns that can be reflected by the correlation between API groups. Based on the results of an evaluation experiment, we found that the accuracy of the proposed method was 98%, proving that the subspecies were classified correctly. Otherwise, it is determined that the contribution of each API for classifying ransomware families is different via analysis of the contribution of A
PI.
(More)