Cybercrime is one of the major digital threats of this century. In
particular, ransomware attacks have significantly increased, resulting in
global damage costs of tens of billion dollars. In this paper, we train and
test different Machine Learning and Deep Learning models for malware detection,
malware classification and ransomware detection. We introduce a novel and
flexible solution that combines two optimized models for malware and ransomware
detection. Our results demonstrate some improvements both in terms of detection
performances and flexibility. In particular, our combined models pave the way
for easier future enhancements using specialized and thus interchangeable
detection modules.

本文介绍了使用不同的机器学习和深度学习模型进行恶意软件检测、恶意软件分类和勒索软件检测的一种新颖且灵活的解决方案，并且将两个优化过的模型组合起来，证明了在检测性能和灵活性方面都有所提高。特别是，我们的综合模型为使用专业的、可互换的检测模块进行简单的未来增强铺平了道路。

基于人工智能的恶意软件和勒索软件检测模型

AI-based Malware and Ransomware Detection Models

Ransomware attacks have increased significantly in recent years, causing
great destruction and damage to critical systems and business operations.
Attackers are unfailingly finding innovative ways to bypass detection
mechanisms, whichencouraged the adoption of artificial intelligence. However,
most research summarizes the general features of AI and induces many false
positives, as the behavior of ransomware constantly differs to bypass
detection. Focusing on the key indicating features of ransomware becomes vital
as this guides the investigator to the inner workings and main function of
ransomware itself. By utilizing access privileges in process memory, the main
function of the ransomware can be detected more easily and accurately.
Furthermore, new signatures and fingerprints of ransomware families can be
identified to classify novel ransomware attacks correctly. The current research
used the process memory access privileges of the different memory regions of
the behavior of an executable to quickly determine its intent before serious
harm can occur. To achieve this aim, several well-known machine learning
algorithms were explored with an accuracy range of 81.38 to 96.28 percents. The
study thus confirms the feasibility of utilizing process memory as a detection
mechanism for ransomware.

对受勒索软件的扫描，采用访问进程内存的特权，利用多种机器学习算法进行分类，以更易准确地检测受勒索软件的特征和行为。