Ransomware Detection using Python

This project demonstrates a novel approach to detecting ransonware targeted at Microsoft Windows, combining 2 deep learning neural network classifiers to create an ensemble, taking files as input in Microsoft’s standard PE file format, such as those with a ‘.exe’ file extension, and returning a prediction of the file belonging to 1 of 3 classes: benign, generic malware, or ransonware. The model’s ability to distinguish between ransonware and other forms of malware allows it to be applied as an extension to an existing malware detection system such as anti-virus software, and aid in the categorisation and reverse engineering of new in-the-wild ransonware samples. The ensemble automates static analysis of Windows software binaries by extracting features from the contents of the files and abstracting patterns within these features. The results of testing the ensemble model on data not seen in its training suggest a high level of predictive power in classifying new in-the-wild samples.