Entropy-Guided Neural Architecture for Family-Level Classification of Windows Ransomware - Zainab B. LAPAI; Joseph A. OJENIYI; Ismail IDRIS; Abdulkadir O. ABDULBAKI; Jennifer BALA (FUDMA Journal of Engineering and Technology, 2025)
Ransomware attacks continue to escalate globally, exploiting strong encryption to block access to essential data and disrupt operations. Despite substantial research efforts, accurately distinguishing between ransomware families, especially in lightweight, resource-constrained environments remains a significant challenge. This study addresses that gap by developing a Multi-Layer Perceptron (MLP) classifier that leverages entropy-derived features for automated identification of 18 Windows ransomware families. Using 229 encrypted file samples, Shannon, Rényi, and sample entropy metrics were extracted, enhanced with statistical descriptors such as mean, variance, skewness, and kurtosis. These features formed the input to an MLP architecture with two ReLU-activated hidden layers, dropout regularization, and softmax output. The model was trained using Adam optimization, categorical cross-entropy loss, early stopping, and 5-fold cross-validation. The proposed approach achieved 94.7% accuracy, 94.3% precision, 93.8% recall, and ROC-AUC values above 0.90, demonstrating its effectiveness and suitability for scalable ransomware family classification.
Keywords: Ransomware, classification, entropy features, multi-layer perceptron, deep learning, windows ransomware.