[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-127928-en":3,"doc-seo-127928-105":31,"detail-sidebar-cat-0-en-105":92},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":21,"is_downloadable":21,"audit_status":21,"page_count":22,"language":23,"language_code":24,"site_id":25,"html_lang":24,"table_of_contents":26,"faqs":27,"seo_title":28,"seo_description":14,"update_tm":29,"read_time":30},127928,687207024478,"Liam","https://ap-avatar.wpscdn.com/davatar_a8503ba1806abce46bf441b54a3ca4cd",8,"Research & Report","Ransomware detection with Machine Learning algorithms using file segments and statistics - Master Thesis in Cybersecurity","The growing danger posed by ransomware has become a pressing concern for public and private sectors, as new strains often outpace effective defenses. Static and dynamic analysis frameworks are frequently limited against advanced obfuscation and evasion. A key observation is that encrypted file data exhibits more random byte distributions than legitimate files, measurable via Shannon Entropy and related differential areas. This thesis proposes a lightweight approach that extracts small fixed-length segments, computes entropy or differential features, and trains machine learning models. It further tests resilience against entropy neutralization techniques by actively tampering ransomware headers.","University of Padova  \nDepartment of Mathematics “Tullio Levi-Civita”  \nMaster Thesis in Cybersecurity  \nRansomware detection with Machine Learning algorithms using file segments  \nand statistics  \nSupervisor Master Candidate  \nProf. Mauro Conti Emanuele Miotto  \nUniversity of Padova  \nCo-supervisor Student ID  \nPhD. Alberto Giaretta 2023575  \nÖrebro University  \nAcademic Year  \n2023-2024  \nii  \n“Of what there is, nothing is missing.”  \n—Antonio Peruzzo, My GrandFather  \niv  \nAbstract  \nThe growing danger posed by ransomware has been a signi昀椀cant concern for both the public and private sectors. The emergence of new strains of this malware has outpaced the development ofe昀昀ective defense mechanisms. Despite the numerous proposed frameworks that employ static and dynamic analysis, these approaches frequently prove ine昀昀ective in the face of advanced obfuscation and evasion techniques.  \nOne common characteristic among di昀昀erent ransomware strains is the need to encrypt the 昀椀lesystem data at some point. The bytes’ distribution of encrypted 昀椀les seems random, while in normal 昀椀les it tends to be more structured. By measuring such unpredictability through statistical tools, it is possible to leverage this characteristic and distinguish between encrypted and normal 昀椀les. One of the metrics used to perform this task is the Shannon Entropy.  \nResearchers tend to compute the Entropy of the bytes’ distribution using the entire 昀椀le, which is not precise, slow, and requires a lot of resources. To overcome these limits, Davies et al. [ 1] proposed the use of only a 昀椀xed segment at the start of the 昀椀le, called the header. Given the promising results of their ransomware classi昀椀cation method, it seems that computing the 昀椀les’ header Entropy provides relevant information to successfully deploy a working defense mechanism.  \nHowever, computing the Entropy of a bytes sequence, whether for the entire 昀椀le or only the header, is prone to Entropy neutralization techniques. Such attacks aim to reduce the Entropy of the encrypted 昀椀le by encoding it in a di昀昀erent format, for example, Base64 . Various works have explored sophisticated neutralization strategies, and over the years it has become clear that if a defense mechanism uses some form of Entropy values, its performance needs to be tested against such techniques. Among past works, only two Entropy-based ransomware detection methods proposed by Lee et al. [2] and Venturini et al. [ 3] included such veri昀椀cation in their proposals, leaving all the others potentially vulnerable.  \nBy collecting small 昀椀xed-length segments of the 昀椀les, this thesis proposes a lightweight, fast, and reliable ransomware detection method. The proposed defense mechanism uses only small portions of the 昀椀les, from which Entropy or the Di昀昀erential Areas (between real and ideal 昀椀le’s Entropy graphs) are computed and provided to a machine learning algorithm. The use of such features allows for e昀昀ectively distinguishing between ransomware-encrypted 昀椀les and legitimate 昀椀les, and requires very few system resources. To strengthen the feature extraction process and make it more resistant to Entropy tampering, three additional random 昀椀le segments selection strategies were implemented.  \nUnlike past works, each feature, machine learning algorithm, and feature extraction strategy were tested against di昀昀erent Entropy neutralization techniques to highlight which combination is the most resilient against such attacks. To do so, the ransomware headers were tampered  \nwith to lower their Entropy, and the models were tested once more. This allows the development ofan Entropy-based ransomware detection method capable of adapting to both known ransomware strains and future ransomware designed to neutralize their header Entropy values.  \nContents  \nAbstract v  \nList of figures ix  \nList of tables xvii  \nListing of acronyms xix  \n1 Introduction 1  \n1. 1 Ransomware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .","cbCaijgO8iNHJtXQ","https://ap.wps.com/l/cbCaijgO8iNHJtXQ","pdf",9047012,3,1,157,"English","en",105,"# Abstract\n# Introduction\n## Ransomware\n## Ransomware Detection\n## Encryption and Randomness\n## Related Works\n## File Segments Analysis\n# Background\n## Shannon Entropy\n## Composite Trapezoidal Rule\n## Differential Area (DA)\n## Ransomware Classification with Differential Area Analysis (DAA)\n## Machine Learning\n## SVM\n## Random Forests\n## Neural Networks\n## Metrics\n# Methodology\n## Hypotheses\n## Design\n## Datasets\n## OldNapierOne\n## NapierOne\n## Attacks Dataset\n## Implementation\n## Entropy\n## DA\n## DAA\n## Attacks\n## Mitigations\n## Machine Learning\n# Evaluation\n## Entropy, DA and DAA Correctness\n## DAA\n## Mitigations\n## Machine Learning Algorithms\n## Entropy\n## DA\n## Entropy + DA","[{\"question\":\"Why do entropy and entropy-based features help detect ransomware?\",\"answer\":\"Encrypted ransomware data tends to show a more random byte distribution than legitimate files. Statistical measures like Shannon Entropy—and differential features derived from entropy graphs—capture that unpredictability to separate encrypted and normal files.\"},{\"question\":\"Why does the thesis avoid computing entropy over the entire file?\",\"answer\":\"Computing entropy on the whole file is described as imprecise, slow, and resource-intensive. The proposed method instead uses small fixed-length segments (e.g., headers or selected portions) to compute features efficiently.\"},{\"question\":\"How is the approach evaluated against entropy neutralization attacks?\",\"answer\":\"The thesis implements verification by tampering ransomware headers to lower their entropy and then re-testing feature extraction and machine learning models. This identifies which feature/algorithm/strategy combination remains most resilient.\"}]","Ransomware detection with Machine Learning algorithms using file segments and statistics - Master Thesis in Cybersecurity | PDF",1785943045,396,{"code":4,"msg":32,"data":33},"ok",{"site_id":25,"language":24,"slug":34,"title":13,"keywords":35,"description":14,"schema_data":36,"social_meta":87,"head_meta":89,"extra_data":91,"updated_unix":29},"ransomware-detection-with-machine-learning-algorithms-using-file-segments-and-statistics-master-thesis-in-cybersecurity","",{"@graph":37,"@context":86},[38,54,69],{"@type":39,"itemListElement":40},"BreadcrumbList",[41,45,49,51],{"item":42,"name":43,"@type":44,"position":21},"https://docshare.wps.com","Home","ListItem",{"item":46,"name":47,"@type":44,"position":48},"https://docshare.wps.com/document/","Document",2,{"item":50,"name":12,"@type":44,"position":20},"https://docshare.wps.com/document/research-report/",{"item":52,"name":13,"@type":44,"position":53},"https://docshare.wps.com/document/ransomware-detection-with-machine-learning-algorithms-using-file-segments-and-statistics-master-thesis-in-cybersecurity/127928/",4,{"url":52,"name":13,"@type":55,"author":56,"headline":13,"publisher":58,"fileFormat":61,"inLanguage":24,"description":14,"dateModified":62,"datePublished":63,"encodingFormat":61,"isAccessibleForFree":64,"interactionStatistic":65},"DigitalDocument",{"name":9,"@type":57},"Person",{"url":42,"name":59,"@type":60},"DocShare","Organization","application/pdf","2026-08-23","2026-08-05",true,{"@type":66,"interactionType":67,"userInteractionCount":20},"InteractionCounter",{"@type":68},"ViewAction",{"@type":70,"mainEntity":71},"FAQPage",[72,78,82],{"name":73,"@type":74,"acceptedAnswer":75},"Why do entropy and entropy-based features help detect ransomware?","Question",{"text":76,"@type":77},"Encrypted ransomware data tends to show a more random byte distribution than legitimate files. Statistical measures like Shannon Entropy—and differential features derived from entropy graphs—capture that unpredictability to separate encrypted and normal files.","Answer",{"name":79,"@type":74,"acceptedAnswer":80},"Why does the thesis avoid computing entropy over the entire file?",{"text":81,"@type":77},"Computing entropy on the whole file is described as imprecise, slow, and resource-intensive. The proposed method instead uses small fixed-length segments (e.g., headers or selected portions) to compute features efficiently.",{"name":83,"@type":74,"acceptedAnswer":84},"How is the approach evaluated against entropy neutralization attacks?",{"text":85,"@type":77},"The thesis implements verification by tampering ransomware headers to lower their entropy and then re-testing feature extraction and machine learning models. This identifies which feature/algorithm/strategy combination remains most resilient.","https://schema.org",{"og:url":52,"og:type":88,"og:title":13,"og:site_name":59,"og:description":14},"article",{"robots":90,"canonical":52},"index,follow",{"doc_id":7,"site_id":25},{"code":4,"msg":5,"data":93},[94,98,102,106,111,116,121,124,129,132,136],{"id":21,"doc_module":4,"doc_module_name":47,"category_name":95,"show_sort_weight":96,"slug":97},"Story & Novel",90,"story-novel",{"id":48,"doc_module":4,"doc_module_name":47,"category_name":99,"show_sort_weight":100,"slug":101},"Literature",80,"literature",{"id":53,"doc_module":4,"doc_module_name":47,"category_name":103,"show_sort_weight":104,"slug":105},"Exam",70,"exam",{"id":107,"doc_module":4,"doc_module_name":47,"category_name":108,"show_sort_weight":109,"slug":110},5,"Comic",60,"comic",{"id":112,"doc_module":4,"doc_module_name":47,"category_name":113,"show_sort_weight":114,"slug":115},6,"Technology",50,"technology",{"id":117,"doc_module":4,"doc_module_name":47,"category_name":118,"show_sort_weight":119,"slug":120},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":47,"category_name":12,"show_sort_weight":122,"slug":123},30,"research-report",{"id":125,"doc_module":4,"doc_module_name":47,"category_name":126,"show_sort_weight":127,"slug":128},9,"Religion & Spirituality",20,"religion-spirituality",{"id":127,"doc_module":4,"doc_module_name":47,"category_name":130,"show_sort_weight":127,"slug":131},"World Cup","world-cup",{"id":133,"doc_module":4,"doc_module_name":47,"category_name":134,"show_sort_weight":133,"slug":135},10,"Lifestyle","lifestyle",{"id":137,"doc_module":4,"doc_module_name":47,"category_name":138,"show_sort_weight":107,"slug":139},19,"General","general"]