An ensemble machine learning framework for accurate ransomware detection and family classification using LightGBM and random forest

Abstract

Abstract Ransomware is a critical cybersecurity threat that leverages advanced encryption techniques to compromise individuals, organizations, and even national infrastructure. Ransomware incidents have increased exponentially in the past 5 years, with recent studies indicating that the likelihood of an organization being affected by such an attack at 59%; the average cost per event is $2.73 million USD. Despite ongoing advancements, available detection mechanisms remain insufficient to address the evolving and adaptive nature of ransomware attacks, thereby necessitating the development of more robust and intelligent detection approaches. To address this gap, we introduce the Ransomware Detection and Classification (RDC) model, a supervised machine learning ensemble model that uses the UGRansome dataset to detect and classify ransomware efficiently. Through soft voting, the RDC model combines Random Forest (RF) and Light Gradient Boosting Machine (LightGBM) classifiers to improve accuracy and generalizability. Our framework incorporates GridSearchCV for hyperparameter optimization, 5-fold cross-validation, and feature importance analysis. Experimental results demonstrate the proposed model achieves outstanding performance in both detection and classification. With a 99.92% accuracy rate in ransomware detection, the RDC model outperforms both standalone RF (99.91%) and LightGBM (99.84%) classifiers. The model obtained (100%) performance across all evaluation metrics for ransomware family classification, achieving a noticeable performance improvement over what is found in the current literature. Additionally, the RDC provides a comprehensive analysis by incorporating family-level classification, thereby enhancing incident response capabilities, unlike existing studies that primarily focus on binary ransomware detection.