Enhancing Cybersecurity against Ransomware Attacks Using LSTM Deep Learning Method: A Case Study on Android Devices

Hatice Karaca; Adem Tekerek

Makale detayları

Enhancing Cybersecurity against Ransomware Attacks Using LSTM Deep Learning Method: A Case Study on Android Devices

Yazarlar:

Hatice Karaca | Adem Tekerek

Yayıncı:

Gazi University

Ana Başlıklar:

Derin Öğrenme | Yapay Zeka (Diğer)

Dergi:

Politeknik Dergisi Vol.28 Issue 2, pp.491-502

Belge Tipi:

Makale

Yayın Tarihi:

3/2025

Belge Dili:

İngilizce

Document ID (Org No.):

2001344347

pISSN:

2147-9429

Anahtar kelimeler:

Özet:

 The rapid advancement of technology brings new threats to the digital world. One of these threats is malicious ransomware attacks. Ransomware is malicious software that demands ransom from innocent users by blocking access to information systems. Since traditional methods are limited to predefined blacklists, they may be ineffective against unknown ransomware types. Deep learning methods, on the other hand, offer a sensitive defense mechanism against anomalies by learning normal behavior patterns. In this study, the Internet logs of Android devices consisting of 392,034 rows and 86 columns were studied using the Long Short-Term Memory LSTM model. The dataset contains 14 different Android ransomware families and harmless traffic. Data preprocessing steps include missing data management, outlier analysis, feature selection, coding operations, and data normalizationstandardization. The dataset was split at 80 training - 20 test ratio, and it was determined that the 80 training - 20 test split had the highest accuracy. The developed LSTM based classification model achieved successful results with 99 accuracy rate and 0.99 F1-score.

 The rapid advancement of technology brings new threats to the digital world. One of these threats is malicious ransomware attacks. Ransomware is malicious software that demands ransom from innocent users by blocking access to information systems. Since traditional methods are limited to predefined blacklists, they may be ineffective against unknown ransomware types. Deep learning methods, on the other hand, offer a sensitive defense mechanism against anomalies by learning normal behavior patterns. In this study, the Internet logs of Android devices consisting of 392,034 rows and 86 columns were studied using the Long Short-Term Memory LSTM model. The dataset contains 14 different Android ransomware families and harmless traffic. Data preprocessing steps include missing data management, outlier analysis, feature selection, coding operations, and data normalizationstandardization. The dataset was split at 80 training - 20 test ratio, and it was determined that the 80 training - 20 test split had the highest accuracy. The developed LSTM based classification model achieved successful results with 99 accuracy rate and 0.99 F1-score.

 The rapid advancement of technology brings new threats to the digital world. One of these threats is malicious ransomware attacks. Ransomware is malicious software that demands ransom from innocent users by blocking access to information systems. Since traditional methods are limited to predefined blacklists, they may be ineffective against unknown ransomware types. Deep learning methods, on the other hand, offer a sensitive defense mechanism against anomalies by learning normal behavior patterns. In this study, the Internet logs of Android devices consisting of 392,034 rows and 86 columns were studied using the Long Short-Term Memory LSTM model. The dataset contains 14 different Android ransomware families and harmless traffic. Data preprocessing steps include missing data management, outlier analysis, feature selection, coding operations, and data normalizationstandardization. The dataset was split at 80 training - 20 test ratio, and it was determined that the 80 training - 20 test split had the highest accuracy. The developed LSTM based classification model achieved successful results with 99 accuracy rate and 0.99 F1-score.

 Teknolojinin hızla ilerlemesi dijital dünyada yeni tehditleri de beraberinde getiriyor. Bu tehditlerden biri kötücül fidye yazılımı saldırılarıdır. Fidye yazılımları, bilgi sistemlerine erişimi engelleyerek masum kullanıcılardan fidye talep eden kötü amaçlı yazılımlardır. Geleneksel yöntemler önceden tanımlanmış kara listelerle sınırlı olduğundan, bilinmeyen fidye yazılımı türlerine karşı etkisiz kalabilir. Derin öğrenme yöntemleri ise normal davranış kalıplarını öğrenerek anormalliklere karşı hassas bir savunma mekanizması sunar. Bu çalışmada Uzun Kısa Süreli Bellek LSTM modeli kullanılarak, 392.034 satır ve 86 sütundan oluşan Android cihazların İnternet günlükleri üzerinde çalışılmıştır. Veri seti, 14 farklı Android fidye yazılımı ailesi ve zararsız trafik içermektedir. Veri ön işleme adımları arasında eksik verilerin yönetimi, aykırı değer analizi, özellik seçimi, kodlama işlemleri ve veri normalleştirmestandartlaştırma bulunmaktadır. Veri kümesi 80 eğitim - 20 test oranında bölünmüş ve 80 eğitim - 20 test ayrımının en yüksek doğruluğa sahip olduğu belirlenmiştir. Geliştirilen LSTM tabanlı sınıflandırma modeli 99 doğruluk oranı ve 0,99 F1-skoru ile başarılı sonuçlar elde etmiştir.

Makale detayları

Enhancing Cybersecurity against Ransomware Attacks Using LSTM Deep Learning Method: A Case Study on Android Devices

Yazarlar:

Hatice Karaca | Adem Tekerek

Yayıncı:

Gazi University

Ana Başlıklar:

Derin Öğrenme | Yapay Zeka (Diğer)

Dergi:

Politeknik Dergisi Vol.28 Issue 2, pp.491-502

Belge Tipi:

Makale

Yayın Tarihi:

3/2025

Belge Dili:

İngilizce

Document ID (Org No.):

2001344347

pISSN:

2147-9429

Ransomware Attacks

Deep Learning

AndroidFidye Yazılımı

Derin Öğrenme

Android

Sayı

Makale detayları

Enhancing Cybersecurity against Ransomware Attacks Using LSTM Deep Learning Method: A Case Study on Android Devices

Yazarlar: Hatice Karaca | Adem Tekerek

Yayıncı: Gazi University

Ana Başlıklar: Derin Öğrenme | Yapay Zeka (Diğer)

Dergi: Politeknik Dergisi Vol.28 Issue 2, pp.491-502

Belge Tipi: Makale

Yayın Tarihi: 3/2025

Belge Dili: İngilizce

Document ID (Org No.): 2001344347

pISSN: 2147-9429

Ransomware Attacks

Deep Learning

AndroidFidye Yazılımı

Derin Öğrenme

Android

Sayı

Yazarlar:

Hatice Karaca | Adem Tekerek

Yayıncı:

Gazi University

Ana Başlıklar:

Derin Öğrenme | Yapay Zeka (Diğer)

Dergi:

Politeknik Dergisi Vol.28 Issue 2, pp.491-502

Belge Tipi:

Makale

Yayın Tarihi:

3/2025

Belge Dili:

İngilizce

Document ID (Org No.):

2001344347

pISSN:

2147-9429