Machine Learning-Based Ransomware Detection Through Static Analysis of PE File Features - Bachelor Thesis

Aug 4, 2026

Upload by Quinn

This bachelor thesis presents a machine learning framework for ransomware detection using static analysis of executable (PE) file attributes, aiming to reduce false positives for practical cybersecurity deployment. It evaluates multiple models using the EMBER 2018 benchmark with balanced sampling across 50,000 variants (25,000 benign and 25,000 malicious). Cross-validation and a 7,500-sample holdout show ensemble methods, especially an optimized XGBoost model, achieving 94.5% accuracy with a low 5.4% false-positive rate.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages57

Reading Time2 h 24 min

AccessFree to download

Introduction

Research Objectives

Scope and Limitations

Thesis Organization

Literature Review

Traditional Detection Approaches

Machine Learning in Cybersecurity

Ransomware-Specific Detection Research

Methodology

Data Collection and Dataset

Feature Extraction

Model Selection and Design

Implementation

Development Environment

System Architecture

Feature Extraction Implementation

Model Training Implementation

Evaluation Framework

Results and Analysis

Comprehensive Performance Comparison of Machine Learning Algorithms

Model Performance Comparison

Feature Importance Analysis

Cross-Validation Results

Discussion

Practical Implications

Limitations and Future Work

Conclusion

Key Achievements

Future Work

References

Appendices

Muhammad Ali Machine Learning-Based Ransomware Detection Through Static Analysis of PE File Features Metropolia Ammattikorkeakoulu Bachelor of Engineering, Information Technology Bachelor Thesis 21.07.2025 1 Abstract Author: Muhammad Ali Title: Machine Learning-Based Ransomware Detection Through Static Analysis of PE File Features Number of Pages: 56 Pages Date: 05 August 2025 This thesis introduces a machine learning framework for ransomware detection based on static analysis of executable file attributes. The primary contribution of the thesis is the introduction of a useful low-false-positive detection system, a gap-filling mechanism between the performance claims of the academic space and the real-world deployment needs of the cybersecurity applications. Using the EMBER 2018 dataset [1], which is a benchmark collection of real malware samples, this thesis comprehensively tests a number of machine learning models against a balanced sampling of 50,000 variants, 25,000 benign, and 25,000 malicious. The novelty of the work is the extensive feature engineering approach, extracting 50 different structural features from PE files, including entropy distribution, import features, header features, and histogram statistics, with a deliberate emphasis on minimizing false positives. This thesis demonstrates through cross-validation and a large holdout set (7,500 samples) that ensemble methods, in particular, XGBoost [2], significantly outperform traditional methods. The optimized XGBoost model achieved 94.5% accuracy, 94.6% precision, and 94.4% recall, with a low false positive rate of 5.4% which was a significant improvement from previous methods, which were plagued by excessive false alarms. Based on the feature importance analysis, the three best classifiers for ransomware detection were the GUI application flag, entropy in certain byte ranges, and imported features. These findings re-evaluate long-held beliefs about which file attributes were the strongest indicators of malicious code and present new challenges for security practitioners. This thesis adds value to cybersecurity research by establishing realistic performance standards for static analysis-based malware detection, provides a systematic testing comparison of six machine learning algorithms under the same conditions, and displays that current ensemble methods can obtain practically deployable detection rates with 2 manageable false positive rates. The proposed approach and findings connect theoretical research to operational security considerations and provide a pragmatic way to discover new ransomware variants that are unknown to traditional signature-based methods [3] . Keywords: Machine Learning, Ransomware Detection, Static Analysis, PE Files, Cybersecurity, XGBoost 3 Table of Contents 1. Introduction 5 1.2 Research Objectives 6 1.3 Scope and Limitations 7 1.4 Thesis Organization 8 2. Literature Review 8 2.1 Traditional Detection Approaches 8 2.1.1 Signature-Based Detection 9 2.1.2 Heuristic Analysis 10 2.1.3 Behavioral Analysis 11 2.1.4 Network-Based Detection 11 2.1.5 Limitations of Traditional Approaches 11 2.2 Machine Learning in Cybersecurity 12 2.2.1 Early Applications 12 2.2.2 Traditional Machine Learning Approaches 12 2.2.3 Deep Learning Revolution 13 2.2.4 Challenges and Limitations 13 2.3 Ransomware-Specific Detection Research 14 2.3.1 Static Analysis Approaches 14 2.3.2 Dynamic Analysis Methods 14 2.3.3 Hybrid Approaches 15 3. Methodology 15 3.1 Data Collection and Dataset 15 3.1.1 EMBER 2018 Dataset Overview 15 3.1.2 Dataset Selection and Sampling 16 3.2 Feature Extraction 16 3.2.1 PE Header Analysis 16 3.2.2 Import Table Analysis 17 3.2.3 Entropy Analysis 17 3.3 Model Selection and Design 18 3.3.1 Algorithm Comparison 18 4. Implementation 18 4.1 Development Environment 18 Table 4.1 : Development Environment and Library Dependencies 18 4.2 System A

FAQs

What detection approach does the thesis propose for ransomware?

It proposes a machine learning framework that performs ransomware detection through static analysis of executable PE file attributes rather than relying on dynamic execution or signatures.

Which dataset and evaluation setup are used?

The thesis uses the EMBER 2018 dataset and tests models on a balanced set of 50,000 samples, followed by cross-validation and a large holdout set of 7,500 samples.

How well does the best-performing model perform, and what is the false-positive rate?

The optimized XGBoost model reaches 94.5% accuracy with precision and recall around 94.6% and 94.4%, respectively, and achieves a false-positive rate of 5.4%.

Aug 4, 2026

Upload by Quinn