AN EVALUATION OF MACHINE LEARNING CLASSIFICATION ALGORITHMS FOR RANSOMWARE VARIANT CLASSIFICATION USING API CALL SEQUENCE CORRELATIONS

Abstract

Although considerable research has focused on ransomware variant classification, extracting robust features from malware samples remains challenging, which limits the accuracy of current methods. This study introduces a novel classification approach that uses the Pearson correlation coefficient between Application Programming Interface (API) group frequencies as input to Random Forest and Support Vector Machine (SVM) classifiers. The rationale for this approach is that distinct ransomware families exhibit unique behavioral patterns during dynamic execution that cannot be adequately captured by static analysis or simple feature counts alone. Empirical evaluations demonstrate that the Random Forest classifier achieved an accuracy of 99.9%, slightly outperforming the SVM classifier, which achieved an accuracy of 98.6%. These results indicate that the proposed feature extraction method allows for highly accurate ransomware family classification.