Entropy-Guided Neural Architecture for Family-Level Classification of Windows Ransomware

• Zainab B. LAPAI

  Department of Cyber Security Science, Federal University of Technology, Minna, Nigeria

  Author

• Joseph A. OJENIYI

  Department of Cyber Security Science, Federal University of Technology, Minna, Nigeria

  Author

• Ismail IDRIS

  Department of Cyber Security Science, Federal University of Technology, Minna, Nigeria

  Author

• Abdulkadir O. ABDULBAKI

  Department of Telecommunications Engineering, Federal University of Technology, Minna, Nigeria

  Author

• Jennifer BALA

  Department of Cyber Security Science, Federal University of Technology, Minna, Nigeria

  Author

Ransomware attacks continue to escalate globally, exploiting strong encryption to block access to essential data and disrupt operations. Despite substantial research efforts, accurately distinguishing between ransomware families, especially in lightweight, resource-constrained environments remains a significant challenge. This study addresses that gap by developing a Multi-Layer Perceptron (MLP) classifier that leverages entropy-derived features for automated identification of 18 Windows ransomware families. Using 229 encrypted file samples, Shannon, Rényi, and sample entropy metrics were extracted, enhanced with statistical descriptors such as mean, variance, skewness, and kurtosis. These features formed the input to an MLP architecture with two ReLU-activated hidden layers, dropout regularization, and softmax output. The model was trained using Adam optimization, categorical cross-entropy loss, early stopping, and 5-fold cross-validation. The proposed approach achieved 94.7% accuracy, 94.3% precision, 93.8% recall, and ROC-AUC values above 0.90, demonstrating its effectiveness and suitability for scalable ransomware family classification.

• FJET_12_93_86

Copyright (c) 2025 FUDMA Journal of Engineering and Technology

This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.