Abstract:

Current ransomware detection techniques based on API call sequence analysis have been extensively validated for their effectiveness. However, most existing solutions overlooked the impact of runtime parameters in API calls on behavioral analysis, resulting in limited generalization capabilities of the trained models. The article proposed a novel detection method that integrates both unsupervised and supervised learning approaches, considering both API call sequences and runtime parameter configurations. The proposed mechanism first employed feature hashing to map the diverse API call sequences into a finite, controllab le feature space. An unsupervised pre-training approach was then utilized to generate a model capable of learning rich, complex semantic relationships from a large corpus of unlabeled API parameter sequence samples. Subsequently, the model was fine-tuned using labeled ransomware samples to enhance its detection capability. Through extensive experiments, the proposed model achieved an accuracy of 0.978 on a real-world test dataset, demonstrating superior performance compared to other state-of-the-art detection methods.

Key words: program behavior modeling, unsupervised learning, ransomware, malware detection, API sequence