A Kings Ransom for Encryption: Ransomware Classification using Augmented
  One-Shot Learning and Bayesian Approximation
  Newly emerging variants of ransomware pose an ever-growing threat to computer
systems governing every aspect of modern life through the handling and analysis
of big data. While various recent security-based approaches have focused on
detecting and classifying ransomware at the network or system level,
easy-to-use post-infection ransomware classification for the lay user has not
been attempted before. In this paper, we investigate the possibility of
classifying the ransomware a system is infected with simply based on a
screenshot of the splash screen or the ransom note captured using a consumer
camera commonly found in any modern mobile device. To train and evaluate our
system, we create a sample dataset of the splash screens of 50 well-known
ransomware variants. In our dataset, only a single training image is available
per ransomware. Instead of creating a large training dataset of ransomware
screenshots, we simulate screenshot capture conditions via carefully designed
data augmentation techniques, enabling simple and efficient one-shot learning.
Moreover, using model uncertainty obtained via Bayesian approximation, we
ensure special input cases such as unrelated non-ransomware images and
previously-unseen ransomware variants are correctly identified for special
handling and not mis-classified. Extensive experimental evaluation demonstrates
the efficacy of our work, with accuracy levels of up to 93.6% for ransomware
classification.
