Redundancy coefficient gradual up-weighting-based mutual information feature selection technique for crypto-ransomware early detection

• Main Authors: Al-rimy, Bander Ali Saleh, Maarof, Mohd. Aizaini, Alazab, Mamoun, Mohd. Shaid, Syed Zainudeen, A. Ghaleb, Fuad, Almalawi, Abdulmohsen, Ali, Abdullah Marish, Al-Hadhrami, Tawfik
• Format: Article
• Language: English
• Published: Elsevier B.V. 2021
• Subjects: QA75 Electronic computers. Computer science
• Online Access: http://eprints.utm.my/id/eprint/94618/1/MohdAizainiMaarof2021_RedundancyCoefficientGradualUpweightingbasedMutual.pdf; http://eprints.utm.my/id/eprint/94618/; http://dx.doi.org/10.1016/j.future.2020.10.002

Crypto-ransomware is a type of malware whose effect is irreversible even after detection and removal. Thus, early detection is crucial to protect user files from being encrypted and held to ransom. Several studies have proposed early detection solutions based on the data acquired during the pre-encryption phase of the attacks. However, the lack of sufficient data in the early phases of the attack adversely affects the ability of feature selection techniques in these models to perceive the common characteristics of the attack features, which makes it challenging to reduce the redundant features, consequently decreasing the detection accuracy. Therefore, this study proposes a novel Redundancy Coefficient Gradual Upweighting (RCGU) technique that makes better redundancy–relevancy trade-offs during feature selection. Unlike existing feature significance estimation techniques that rely on the comparison between the candidate feature and the common characteristics of the already-selected features, RCGU compares the mutual information between the candidate feature and each feature in the selected set individually. Therefore, RCGU increases the weight of the redundancy term proportional to the number of already selected features. By integrating the RCGU into the Mutual Information Feature Selection (MIFS) technique, the Enhanced MIFS (EMIFS) was developed. Further improvement was achieved by proposing MM-EMIFS which incorporates the MaxMin approximation with EMIFS to prevent the redundancy overestimation that RCGU could cause when the number of features in the already-selected set increases. The experimental evaluation shows that the proposed techniques achieved accuracy higher than that in related works, which confirms the ability of RCGU to make better redundancy–relevancy trade-offs and select more discriminative pre-encryption attack features compared to existing solutions.