A Survey of Machine Learning Algorithms for Detecting Ransomware
  Encryption Activity
  A survey of machine learning techniques trained to detect ransomware is
presented. This work builds upon the efforts of Taylor et al. in using
sensor-based methods that utilize data collected from built-in instruments like
CPU power and temperature monitors to identify encryption activity. Exploratory
data analysis (EDA) shows the features most useful from this simulated data are
clock speed, temperature, and CPU load. These features are used in training
multiple algorithms to determine an optimal detection approach. Performance is
evaluated with accuracy, F1 score, and false-negative rate metrics. The
Multilayer Perceptron with three hidden layers achieves scores of 97% in
accuracy and F1 and robust data preparation. A random forest model produces
scores of 93% accuracy and 92% F1, showing that sensor-based detection is
currently a viable option to detect even zero-day ransomware attacks before the
code fully executes.
