[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-122380-en":3,"doc-seo-122380-105":30,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":27,"seo_description":14,"update_tm":28,"read_time":29},122380,962075114765,"Quinn","https://ap-avatar.wpscdn.com/davatar_a8503ba1806abce46bf441b54a3ca4cd",8,"Research & Report","Machine Learning-Based Ransomware Detection Through Static Analysis of PE File Features - Bachelor Thesis","This bachelor thesis presents a machine learning framework for ransomware detection using static analysis of executable (PE) file attributes, aiming to reduce false positives for practical cybersecurity deployment. It evaluates multiple models using the EMBER 2018 benchmark with balanced sampling across 50,000 variants (25,000 benign and 25,000 malicious). Cross-validation and a 7,500-sample holdout show ensemble methods, especially an optimized XGBoost model, achieving 94.5% accuracy with a low 5.4% false-positive rate.","Muhammad Ali  \nMachine Learning-Based Ransomware Detection Through Static Analysis of PE File Features  \nMetropolia Ammattikorkeakoulu  \nBachelor of Engineering, Information Technology Bachelor Thesis  \n21.07.2025  \n1  \nAbstract  \nAuthor: Muhammad Ali  \nTitle: Machine Learning-Based Ransomware Detection Through  \nStatic Analysis of PE File Features  \nNumber of Pages: 56 Pages  \nDate: 05 August 2025  \nThis thesis introduces a machine learning framework for ransomware detection based on static analysis of executable file attributes. The primary contribution of the thesis is the introduction of a useful low-false-positive detection system, a gap-filling mechanism between the performance claims of the academic space and the real-world deployment needs of the cybersecurity applications. Using the EMBER 2018 dataset [1], which is a benchmark collection of real malware samples, this thesis comprehensively tests a number of machine learning models against a balanced sampling of 50,000 variants, 25,000 benign, and 25,000 malicious. The novelty of the work is the extensive feature engineering approach, extracting 50 different structural features from PE files, including entropy distribution, import features, header features, and histogram statistics, with a deliberate emphasis on minimizing false positives.  \nThis thesis demonstrates through cross-validation and a large holdout set (7,500 samples) that ensemble methods, in particular, XGBoost [2], significantly outperform traditional methods. The optimized XGBoost model achieved 94.5% accuracy, 94.6% precision, and 94.4% recall, with a low false positive rate of 5.4% which was a significant improvement from previous methods, which were plagued by excessive false alarms.  \nBased on the feature importance analysis, the three best classifiers for ransomware detection were the GUI application flag, entropy in certain byte ranges, and imported features. These findings re-evaluate long-held beliefs about which file attributes were the strongest indicators of malicious code and present new challenges for security practitioners.  \nThis thesis adds value to cybersecurity research by establishing realistic performance standards for static analysis-based malware detection, provides a systematic testing comparison of six machine learning algorithms under the same conditions, and displays that current ensemble methods can obtain practically deployable detection rates with  \n2  \nmanageable false positive rates. The proposed approach and findings connect theoretical research to operational security considerations and provide a pragmatic way to discover new ransomware variants that are unknown to traditional signature-based methods [3] .  \nKeywords: Machine Learning, Ransomware Detection, Static Analysis, PE Files, Cybersecurity, XGBoost  \n3  \nTable of Contents  \n1. Introduction 5  \n1.2 Research Objectives 6  \n1.3 Scope and Limitations 7  \n1.4 Thesis Organization 8  \n2. Literature Review 8  \n2.1 Traditional Detection Approaches 8  \n2.1.1 Signature-Based Detection 9  \n2.1.2 Heuristic Analysis 10  \n2.1.3 Behavioral Analysis 11  \n2.1.4 Network-Based Detection 11  \n2.1.5 Limitations of Traditional Approaches 11  \n2.2 Machine Learning in Cybersecurity 12  \n2.2.1 Early Applications 12  \n2.2.2 Traditional Machine Learning Approaches 12  \n2.2.3 Deep Learning Revolution 13  \n2.2.4 Challenges and Limitations 13  \n2.3 Ransomware-Specific Detection Research 14  \n2.3.1 Static Analysis Approaches 14  \n2.3.2 Dynamic Analysis Methods 14  \n2.3.3 Hybrid Approaches 15  \n3. Methodology 15  \n3.1 Data Collection and Dataset 15  \n3.1.1 EMBER 2018 Dataset Overview 15  \n3.1.2 Dataset Selection and Sampling 16  \n3.2 Feature Extraction 16  \n3.2.1 PE Header Analysis 16  \n3.2.2 Import Table Analysis 17  \n3.2.3 Entropy Analysis 17  \n3.3 Model Selection and Design 18  \n3.3.1 Algorithm Comparison 18  \n4. Implementation 18  \n4.1 Development Environment 18  \nTable 4.1 : Development Environment and Library Dependencies 18  \n4.2 System A","cbCainSBfd2TgOPM","https://ap.wps.com/l/cbCainSBfd2TgOPM","pdf",1630282,1,57,"English","en",105,"# Introduction\n## Research Objectives\n## Scope and Limitations\n## Thesis Organization\n# Literature Review\n## Traditional Detection Approaches\n## Machine Learning in Cybersecurity\n## Ransomware-Specific Detection Research\n# Methodology\n## Data Collection and Dataset\n## Feature Extraction\n## Model Selection and Design\n# Implementation\n## Development Environment\n## System Architecture\n## Feature Extraction Implementation\n## Model Training Implementation\n## Evaluation Framework\n# Results and Analysis\n## Comprehensive Performance Comparison of Machine Learning Algorithms\n## Model Performance Comparison\n## Feature Importance Analysis\n## Cross-Validation Results\n# Discussion\n## Practical Implications\n## Limitations and Future Work\n# Conclusion\n## Key Achievements\n## Future Work\n# References\n# Appendices","[{\"question\":\"What detection approach does the thesis propose for ransomware?\",\"answer\":\"It proposes a machine learning framework that performs ransomware detection through static analysis of executable PE file attributes rather than relying on dynamic execution or signatures.\"},{\"question\":\"Which dataset and evaluation setup are used?\",\"answer\":\"The thesis uses the EMBER 2018 dataset and tests models on a balanced set of 50,000 samples, followed by cross-validation and a large holdout set of 7,500 samples.\"},{\"question\":\"How well does the best-performing model perform, and what is the false-positive rate?\",\"answer\":\"The optimized XGBoost model reaches 94.5% accuracy with precision and recall around 94.6% and 94.4%, respectively, and achieves a false-positive rate of 5.4%.\"}]","Machine Learning-Based Ransomware Detection Through Static Analysis of PE File Features - Bachelor Thesis | PDF",1785810335,144,{"code":4,"msg":31,"data":32},"ok",{"site_id":24,"language":23,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":28},"machine-learning-based-ransomware-detection-through-static-analysis-of-pe-file-features-bachelor-thesis","",{"@graph":36,"@context":85},[37,54,68],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,51],{"item":41,"name":42,"@type":43,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":50},"https://docshare.wps.com/document/research-report/",3,{"item":52,"name":13,"@type":43,"position":53},"https://docshare.wps.com/document/machine-learning-based-ransomware-detection-through-static-analysis-of-pe-file-features-bachelor-thesis/122380/",4,{"url":52,"name":13,"@type":55,"author":56,"headline":13,"publisher":58,"fileFormat":61,"inLanguage":23,"description":14,"dateModified":62,"datePublished":62,"encodingFormat":61,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":57},"Person",{"url":41,"name":59,"@type":60},"DocShare","Organization","application/pdf","2026-08-04",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What detection approach does the thesis propose for ransomware?","Question",{"text":75,"@type":76},"It proposes a machine learning framework that performs ransomware detection through static analysis of executable PE file attributes rather than relying on dynamic execution or signatures.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"Which dataset and evaluation setup are used?",{"text":80,"@type":76},"The thesis uses the EMBER 2018 dataset and tests models on a balanced set of 50,000 samples, followed by cross-validation and a large holdout set of 7,500 samples.",{"name":82,"@type":73,"acceptedAnswer":83},"How well does the best-performing model perform, and what is the false-positive rate?",{"text":84,"@type":76},"The optimized XGBoost model reaches 94.5% accuracy with precision and recall around 94.6% and 94.4%, respectively, and achieves a false-positive rate of 5.4%.","https://schema.org",{"og:url":52,"og:type":87,"og:title":13,"og:site_name":59,"og:description":14},"article",{"robots":89,"canonical":52},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,135],{"id":20,"doc_module":4,"doc_module_name":46,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":53,"doc_module":4,"doc_module_name":46,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":46,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":46,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":46,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":46,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":46,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":136,"doc_module":4,"doc_module_name":46,"category_name":137,"show_sort_weight":106,"slug":138},19,"General","general"]