Classification of Ransomware Based on Artificial Neural Networks

  • Noura OuerdiEmail author
  • Tarik Hajji
  • Aurelien Palisse
  • Jean-Louis Lanet
  • Abdelmalek Azizi
Conference paper
Part of the Smart Innovation, Systems and Technologies book series (SIST, volume 111)


Currently, different forms of ransomware are increasingly threatening users. Modern ransomware encrypts important user data and it is only possible to recover it once a ransom has been paid [14]. In this paper, we classify ransomware in 10 classes which are labeled using avclass tool. In this classification, we based on artificial neural networks with multilayer perceptron function. To do this, it was necessary to build the learning base based on ransomware files. We then implemented programs in java allowing the extraction of the key strings from ransomwares files intended for the learning stage and for the test one. Once the learning and testing databases have been prepared, we started the classification with the weka tool. The objective of this contribution is to investigate if the neural networks are an effective means for the classification of this kind of ransomwares or it will be necessary to think to another method of classification.


Classification Artificial neural networks Ransomware Learning Test 


  1. 1.
    Clonezilla: The Free and Open Source Software for DiskImaging and Cloning.
  2. 2.
    Viper: Binary Management and Analysis Framework.
  3. 3.
    Cuckoo Foundation: Cuckoo Sandbox: Automated Malware Analysis.
  4. 4.
    Digital Corpora: Producing the Digital Body.
  5. 5.
    Mbol, F., Robert, J.M., Sadighian, A.: An efficient approach to detect torrent-locker ransomware in computer systems. In: International Conference on Cryptology and Network Security, pp. 532–541. Springer (2016)Google Scholar
  6. 6.
    Jain, A.K.: Data clustering: 50 years beyond K-means. Pattern Recogn. Lett. 31, 651–666 (2010)CrossRefGoogle Scholar
  7. 7.
    Palisse, A., Durand, A., Le Bouder, H., Le Guernic, C., Lanet, J.-L.: Data Aware Defense (DaD): towards a generic and practical ransomware countermeasure. In: NordSec2017 - Nordic Conference on Secure IT Systems, Tartu, Estonia, 8–10 November 2017CrossRefGoogle Scholar
  8. 8.
    Malware Online Repository (2018).
  9. 9.
    Malware Online Repository (2018).
  10. 10.
    Malware Online Repository (2018).
  11. 11.
    Sebastián, M., Rivera, R., Kotzias, P., Caballero, J.: Avclass: a tool for massive malware labeling. In: International Symposium on Research in Attacks, Intrusions, and Defenses, pp. 230–253. Springer (2016)Google Scholar
  12. 12.
    Swasti, S., Monika, J.: A study on WEKA tool for data preprocessing, classification and clustering. Int. J. Innov. Technol. Explor. Eng. (IJITEE) 2(6) (2013). ISSN 2278–3075Google Scholar
  13. 13.
    Marc, P.: Réseaux de Neurones (Le perceptron multicouche et son algorithme de retropropagation des erreurs), Laval University, Laval, 272 p. (2004)Google Scholar
  14. 14.
    Krzysztof, C., Wojciech, M.: Using Software-defined networking for ransomware mitigation: the case of CryptoWall. IEEE Netw. 30(6), 14–20 (2016)Google Scholar
  15. 15.
    Joshua S., Konstantin B.: Deep neural network based malware detection using two dimensional binary program features. In: The 10th International Conference on Malicious and Unwanted Software (MALWARE). IEEE Xplore (2016)Google Scholar

Copyright information

© Springer Nature Switzerland AG 2019

Authors and Affiliations

  • Noura Ouerdi
    • 1
    Email author
  • Tarik Hajji
    • 2
  • Aurelien Palisse
    • 3
  • Jean-Louis Lanet
    • 3
  • Abdelmalek Azizi
    • 1
  1. 1.Faculty of SciencesMohammed First UniversityOujdaMorocco
  2. 2.Faculty of EngineeringPrivate University of FezFezMorocco
  3. 3.Inria, Campus of BeaulieuRennesFrance

Personalised recommendations