FeSAD Ransomware Detection Framework with Machine Learning - using Adaption to Concept Drift

Aug 3, 2026

FeSAD proposes a machine learning framework to detect evolutionary ransomware under concept drift, addressing the risk that behavioral changes cause frequent misclassifications with potential harm to individuals and businesses. The approach integrates a feature selection layer, a drift calibration layer, and a drift decision layer to reliably identify and classify drifting samples. It evaluates performance across multiple concept drift scenarios and also measures how the framework extends classifier lifespan by reducing the time between retraining. Results show reliable classification of ransomware and benign samples while maintaining robustness during drift.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages29

Reading Time1 h 13 min

AccessFree to download

Introduction

Motivation

City Research Online City, University of London Institutional Repository | Citation: Fernando, D. W. & Komninos, N. (2024) . FeSAD ransomware detection framework with machine learning using adaption to concept drift. Computers & Security,
137, 103629. doi: 10. 1016/j.cose.2023.103629 This is the accepted version of the paper.
This version of the publication may differ from the final published version. | | --- | | Permanent repository link: [https://openaccess.city.ac.uk/id/eprint/31860/](https://openaccess.city.ac.uk/id/eprint/31860/)
Link to published version: [https://doi.org/10.1016/j.cose.2023.103629](https://doi.org/10.1016/j.cose.2023.103629)
[Copyright:](Copyright: City Research Online aims to make research outputs of City)[ City Research Online aims to make research outputs of City](Copyright: City Research Online aims to make research outputs of City), University of London available to a wider audience. Copyright and Moral Rights remain with the author(s) and/or copyright holders. URLs from City Research Online may be freely distributed and linked to.
Reuse: Copies of full items can be used for personal research or study, educational, or not-for-profit purposes without prior permission or charge. Provided that the authors, title and full bibliographic details are credited, a hyperlink and/or URL is given for the original metadata page and the content isnot changed in any way. | | City Research Online: | [http://openaccess.city.ac.uk/](http://openaccess.city.ac.uk/) | [publications@city.ac.uk](publications@city.ac.uk) | | --- | --- | --- | | | | | FeSAD Ransomware Detection Framework with Machine Learning using Adaption to Concept Drift Damien Warren Fernando, Nikos Komninos Department of Computer Science, School of Mathematics, Computer Science and Engineering, City, University of London, UK Abstract This paper proposes FeSAD, a framework that will allow a machine learning classifier to detect evolutionary ransomware. Ransomware is a critical player in the malware space that causes hundreds of millions of dollars of damage globally and evolves quickly. The evolution of ransomware in machine learning classifiers is often calculated as concept drift. Concept drift is dangerous as changes in the behaviour of ransomware can easily lead to misclassifications, and misclassification can harm individuals and businesses. Our proposed framework consists of a feature selection layer, drift calibration layer and drift decision layer that allows a machine learning classifier to detect and classify concept drift samples reliably. We evaluate the FeSAD framework in various concept drift scenarios and observe its ability to detect drifting samples effectively. The FeSAD framework is also evaluated on its ability to extend the lifespan of a classifier. The results obtained by this research show that FeSAD can successfully and reliably classify ransomware and benign samples while under concept drift and can extend the time between retraining. © 2011 Published by Elsevier Ltd. Keywords: Ransomware detection, Machine Learning, Concept Drift, Malware Evolution, Genetic Algorithm 1. Introduction Ransomware is a malware type that restricts a user’s access to their files by either locking the computing device or encrypting its files. According to Symantec, the cost of ransomware attacks globally amounts to damages running into the hundreds of millions of dollars [2], and BlackBlaze reports that the average cost of a ransomware attack on a business is 1.85 million dollars [3] . Modern ransomware is particularly difficult to deal with due to the usage of sophisticated encryption schemes that keep encryption and decryption keyson a remote command and control server [4] . Modern ransomware users use techniques beyond encryption to persuade victims to pay by threatening to dox victims and organizations that they successfully attack [5] . An attacker will access sensitive information related to victims

FAQs

What problem does the FeSAD framework target in ransomware detection?

FeSAD targets the challenge that ransomware evolves over time, which manifests as concept drift and can lead to misclassifications in machine learning classifiers.

How does FeSAD detect concept drift samples?

FeSAD uses three layers: a feature selection layer, a drift calibration layer to set abnormal drift thresholds, and a drift decision layer to classify drift samples.

How does FeSAD help extend the lifespan of a classifier?

FeSAD calibrates drift thresholds and monitors incoming test samples; retraining is triggered only when abnormal drift samples exceed the defined threshold, increasing the time between retraining.

Aug 3, 2026

Uploaded by Olivia Brown