Entropy-Based Deep Learning Framework for Classifying Ransomware Families in Windows Environment

• Joseph A. OJENIYI

  Department of Cyber Security, Federal University of Technology, Minna, Nigeria

  Author

• Zainab L. BELLO

  Department of Cyber Security, Federal University of Technology, Minna, Nigeria

  Author

• Ismail IDRIS

  Department of Cyber Security, Federal University of Technology, Minna, Nigeria

  Author

• Noel M. DOGONYARO

  Department of Cyber Security, Federal University of Technology, Minna, Nigeria

  Author

• Suleiman AHMAD

  Department of Cyber Security, Federal University of Technology, Minna, Nigeria

  Author

• Sikiru O. SUBAIRU

  Department of Cyber Security, Federal University of Technology, Minna, Nigeria

  Author

Ransomware poses a critical cybersecurity challenge, exploiting strong encryption to deny access to data and evade traditional detection methods. Conventional techniques such as signature and heuristic-based detection often fail against modern variants due to polymorphism, obfuscation, and ransomware-as-a-service (RaaS) models. This study proposes an entropy-based deep learning framework for classifying Windows ransomware families, leveraging entropy’s ability to quantify the randomness introduced by encryption. Encrypted files exhibit higher entropy values (>7.5) compared to benign files (4.5–6.0), making entropy a reliable feature for ransomware detection. In this work, ransomware samples from 18 families were executed in a controlled virtual box windows 10 environment to generate encrypted datasets across multiple file types. Shannon, Rényi, and sample entropy measures, alongside statistical descriptors, were extracted and transformed into normalized feature vectors for classification using a multi-layer perceptron (MLP) model. Experimental results revealed distinct entropy patterns across ransomware families, with the proposed framework achieving efficient training convergence and robust generalization.  The model achieved accuracy 94.7%, 94.3% precision, 93.8% recall and FI-score of 94.0%. The findings confirm entropy’s effectiveness as a scalable and resilient feature, supporting accurate ransomware family classification and enhancing real-time detection and forensic analysis.

• FJET_12_86_79

Copyright (c) 2025 FUDMA Journal of Engineering and Technology

This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.