# A Few-Shot Meta-Learning based Siamese Neural Network using Entropy Features
for Ransomware Classification

Jinting Zhu
Cybersecurity Lab
Massey University
Auckland, NEW ZEALAND
<EMAIL_ADDRESS>
& Julian Jang-Jaccard
Cybersecurity Lab
Massey University
Auckland, NEW ZEALAND
& Amardeep Singh
Cybersecurity Lab
Massey University
Auckland, NEW ZEALAND
& Ian Welch
School of Engineering and Computer Science
Victoria University of Wellington
Wellington,New ZEALAND
& Harith AI-Sahaf
School of Engineering and Computer Science
Victoria University of Wellington
Wellington,New ZEALAND
& Seyit Camtepe
Data61 CSIRO
AUSTRALIA

###### Abstract

Ransomware defense solutions that can quickly detect and classify different
ransomware classes to formulate rapid response plans have been in high demand
in recent years. Though the applicability of adopting deep learning techniques
to provide automation and self-learning provision has been proven in many
application domains, the lack of data available for ransomware (and other
malware) samples has been raised as a barrier to developing effective deep
learning-based solutions. To address this concern, we propose a few-shot meta-
learning based Siamese Neural Network that not only detects ransomware attacks
but is able to classify them into different classes. Our proposed model
utilizes the entropy feature directly extracted from ransomware binary files
to retain more fine-grained features associated with different ransomware
signatures. These entropy features are used further to train and optimize our
model using a pre-trained network (e.g. VGG-16) in a meta-learning fashion.
This approach generates more accurate weight factors, compared to feature
images are used, to avoid the bias typically associated with a model trained
with a limited number of training samples. Our experimental results show that
our proposed model is highly effective in providing a weighted F1-score
exceeding the rate >86% compared to other similar methods.

_Keywords_ Ransomware Classification Siamese Neural Network Few-Shot Learning
Meta-Learning Artificial Intelligence Deep Learning Entropy Graph

##  1 Introduction

Ransomware is a type of malware designed to attack the victim’s system and
denies access to the victim’s sensitive data until a ransom is paid Davies et
al. (2021). With the popularity of bitcoin that hides the true identity of the
account used by attackers along with the prevalence of encryption techniques,
this type of malware has proliferated recently, causing millions of dollars in
losses for businesses and consumers.

There are two approaches for performing ransomware (and other malware)
detection: static and dynamic-based analysis. The dynamic analysis-based
detection method can provide a high detection rate Al-Sahaf and Welch (2019);
Abbasi et al. (2020), but requires the execution of malicious code. However,
this may cause a serious scalability issue to process the large number of
previously unseen binaries that come across the desk of malware analysts. In
addition, they are not able to extract significant behavioral patterns of the
ransomware due to anti-emulation techniques such as fingerprinting or time
bombs Rhode et al. (2018). Furthermore, different ransomware families vary
significantly thus make difficult to profile their behavior pattern Davies et
al. (2021); Camp et al. (2019). Static analysis overcomes some of the dynamic
analysis detection issues by detecting ransomware attacks prior to their
execution. This is done by analyzing bytes or instruction sequences to carry
out the malicious activity (i.e., the signature of ransomware in the code).
For this reason, we utilize static code analysis to obtain unique features of
ransomware despite the obvious advantages present in the dynamic analysis.

With the popularity of Artificial Intelligence (AI) techniques, many (shallow)
machine learning and deep learning methods have been proposed. We argue that
there are two significant drawbacks to the existing state-of-the-art. The
first issue is the majority of existing research tends to focus on learning
from the generic features of malware images from different malware families
and building feature profiles Nataraj et al. (2011); Kim et al. (2020); Chen
(2018); Lo et al. (2019); Yue (2017). Here the feature profiles represent the
(static) features contained in a malware sample to provide an important clue
as to whether the image sample is malicious or not. Using the common static
information (e.g., program byte sequences, instructions in the form of
disassembled opcodes, functional calls) as data input points to feed into a
deep neural network cannot capture unique characteristics of each malware
family signature thus they will not be able to accurately classify many
variants driven from the same malware family Milosevic et al. (2017); Vasan et
al. (2020); Yuan et al. (2020). The second issue with the existing approaches
is the demand for large data inputs to find more relevant correlations across
the features Zhu et al. (2021a). They are unable to detect and classify the
malware families trained with a limited number of samples Cao et al. (2018);
Zhu et al. (2020, 2021b).

In this research work, we propose a few-shot learning based method Siamese
Neural Network (SNN) that is capable of not only detecting different
ransomware families but also accurately classifying ransomware variants
belonging to the same ransomware family even in the presence of only a small
number of training samples available.

The contribution of our proposed model is following:

  * •

Our proposed model can learn unique ransomware signatures from different
ransomware classes even if the number of ransomware samples for each class is
very small.

  * •

Different from existing models typically use image features, we use entropy
features directly extracted from each ransomware binary file as inputs to our
model. This prevents information loss typically associated with image feature
conversion. The use of entropy features thus significantly contributes towards
accurately distinguishing different ransomware signatures represented in
different ransomware classes addressing the first issue we discussed earlier.

  * •

To solve the second issue associated with the existing approaches, we use a
pre-trained VGG-16 network as a part of the meta-learning process to generate
more accurate weights that accurately capture the characteristics of each
ransomware sample. This not only contributes to improving the classification
accuracy but also avoids the potential bias associated with the use of a
limited number of training samples in a deep learning model.

  * •

Our proposed model uses a combination of two center loss and a softmax loss to
accurately capture the similarity between ransomware samples belonging to the
same class (i.e., intra-class variance) and the di-similarity across
ransomware samples across different ransomware classes (i.e., inter-class
variance).

  * •

Our experiments tested on the total of 1,046 ransomware samples with 11
different classes show that the proposed model is highly effective for
correctly classifying different ransomware samples by achieving the
classification with the weighted F1-score exceeding 86%, which outperformed
other existing benchmark methods.

The rest of the paper is organized as follows. Section LABEL:sec:related_work
presents related works for ransomware detection and classification. Section 3
provides the details of the proposed model. Section 4, describes experimental
setup and evaluation metrics. In Section 5, the experimental results are
presented and discussed. Lastly, Section 6 draws a conclusion from our
proposed method and describe the future work that is planned.

##  2 Related work

Dynamic analysis avoids the problem of having to preprocess samples using an
unpacker. However, it has several limitations. First, there it requires either
partial or full execution of the malware itself using an emulator or sandbox.
Second, the malware sample may use anti-virtualization techniques that detect
and prevent its execution in a sandbox or have particular conditions before
running that are not triggered in a sandbox environment. Third, there is no
guarantee that you will achieve sufficient code coverage for the purposes of
accurate classification.

Static analysis based upon reverse engineering also suffers from costs
associated with dealing with obfuscation or performing data or control flow
techniques. Therefore, researchers have looked for effective but efficient
static analysis techniques that do not require reverse engineering such as
disassembly of the malware samples. Nataraj et al. 2011 Nataraj et al. (2011)
proposed a less expensive but effective static analysis technique based upon
image processing methods. Their central insight was to treat binary programs
like images and use a visual similarity to avoid either execution or
disassembly of the malware. Their preliminary work showed promising results,
and other researchers have subsequently expanded upon their ideas. More
recently Kim et al. Kim et al. (2020) proposed a binary classification system
that takes a hybrid approach that extracts features from the portable
executable (PE) file as well as using both black and white and color images
created from the file’s binary representation. The features derived from the
PE file header and sections include entropy and packers, where the packers are
classified using YARA rules. Decision tree, random forest, and gradient
boosting algorithms are used to classify the malware based upon the features
from the PE file.

Several machine learning approaches have been attempted to automate the
learning of different malware signatures. SigMal Kirat et al. (2013) extracts
features from the PE structure of malware executable. SigMal transforms these
features into a digital image. Signatures are extracted from images and
investigated with similarity measures using the KNN technique. They claimed
above 99% precision evaluated on the samples they collected. Baldwin and
Dehghantanha Baldwin and Dehghantanha (2018) used static analysis to extract
opcode characteristics as input features for support vector machine (SVM)
classifier to classify five class ransomware families with $96.5\%$ accuracy.
In the same vein, Zhang et al. Zhang et al. (2019) transformed raw opcode
sequences into N-gram-based input features for random forest algorithm to
achieve $91.43\%$ accuracy. The downside of these techniques is they need to
use reverse engineering with two main problems - scalability to convert binary
representations into opcodes and anti-disassembly techniques used to generate
incorrect opcode sequences.

To capitalize image based features proposed by Nataraj et al. (2011), various
end-to-end deep learning solutions based on convolutional neural network (CNN)
architecture are proposed are in literature Cui et al. (2018, 2019).
Furthermore, these works were extended to have a capability of CNN under
limited input samples available for training with transfer learning such as
Chen Chen (2018) who proposed the training of their model with Inception
neural network’s pre-trained weights. In this work, low-level features were
borrowed from the Inception model and applied that transferred knowledge to
malware classification. In the same vein, Lo et al. Lo et al. (2019) employed
pre-trained weights from Xception neural network with malware classification.
Likewise, Yue Yue (2017) proposed weighted softmax loss for the CNN model to
classify malware in an unbalanced dataset along with VGG pre-trained weights
to fine-tune the CNN model.

The static analysis offers early detection of ransomware but sometimes
ransomware use obfuscation and polymorphism techniques that avoid signature
detection through static analysis McIntosh et al. (2018). To address this, a
various hybrid solution is proposed that combines static and dynamic
techniques such as system resource usages and statistics with opcode frequency
Ferrante et al. (2018); Shaukat and Ribeiro (2018). A CNN algorithm was used
to classify the malware based upon the images. A final decision algorithm uses
majority voting to come to a final classification as malicious or benign. This
approach achieved promising accuracy but requires an extra step of
preprocessing the PE file itself whereas we focus on a single image and can
deal with the scarcity of training data. Zhu et al. Zhu et al. (2020) proposed
an SNN-based model to classify different android malware types. They use batch
normalization layer and multiple loss functions to address the overfitting
issue associated with a model trained with a limited number of samples. These
existing models tend to be effective at capturing malware samples when the
common attribute of malicious code is distinct but often do not consider when
there are slight differences in features of the malware as is the case of many
obfuscated malware variants.

##  3 Materials and methodology

Siamese Neural Network (SNN) has been applied in many applications such as
computer vision and natural language processing. Its core function involves
estimating the similarity between two images represented by feature embedding
space and generating a similarity score. A generic SNN is comprised of two
sub-networks, as shown in Figure 1, where the weights and hyperparameter
settings are shared. Both sub-networks take one image belonging to the same
class (i.e., positive pairs) as input and output the features it learned.
These features are projected in the feature embedding of the fully connected
layer while a loss function is used to predict whether the images processed by
two sub-networks belong to the same class or not.

Figure 1: The overview of Siamese Neural Network

It can also predict if the different features learned are complementary to
different instances within the same class. For example, it can correctly
predict that different ransomware instances still belong to the same
ransomware family as they share the unique ransomware signature.

###  3.1 Entropy Feature

The main innovation of our proposed model is using entropy features with SNN
to train and optimize the model in a meta-learning fashion that utilizes
already trained machine learning algorithms (e.g., VGG-16). The entropy
features we use are directly computed from binary ransomware files therefore
they retain unique characteristics involved in each ransomware signature much
better, compared to image features Nataraj et al. (2011) typically used in the
existing state-of-the-art. This has a clear advantage over using image
features as inputs which tends to lose precise information through conversion
processes in order to produce the size of images that works better for a
specific model. By using the entropy feature, any computations our model goes
through to find feature correlations across different ransomware samples
become more robust compared to when the image features were used. This is
because image features can be easily influenced by white noise and complex
texture features while entropy features are less sensitive to the spatial
distribution of the small changes made to the generic code thus able to
recognize any arbitrary changes better (i.e., obfuscation methods applied to
avoid detection) Hamid et al. (2018); Zhu et al. (2020, 2021b). Thus, the
entropy feature resulted in more accurate classification and is especially
useful to find ransomware variants derived from the generic code of the same
ransomware family.

(a)

(b)

(c)

(d)

Figure 2: Examples of entropy graphs of two malware families.

To illustrate the usefulness of using entropy features, Figure 2 shows the
entropy graphs, containing entropy values from entropy features, obtained from
two different ransomware families each of which has two variants. Figures 2(a)
and 2(b) are two ransomware variants from the same ransomware family “dalexia”
while Figures 2(c) and 2(d) are two ransomware variants from the ransomware
family “WannaCry”. There is a significant difference in the shape of the
entropy graphs between two families thus providing very unique feature
information when trained. Among the variants of the same ransomware family,
there is a slight difference in the entropy graphs but the general pattern
shown in each entropy graph is similar to each other thus our model recognizes
them to the instances belonging to the same ransomware family.

Our model utilizes the entropy values extracted from the entropy graph to
train our proposed model to find different ransomware classes. The overall
algorithm involved to produce an entropy graph from a ransomware binary file
is depicted in Algorithm 1.

Input : $f$: malware binary file; $l$: segment length; $n$: the number of
files

Output : entropy graph matrix $m$

while  _not reach to n_ do

1\. read $l$ bytes from $f$, and defined as segment $s$;

2\. for $i=0$ to $255$ do

3\. compute the probability $p_{i}$ of $i$ appearing in $s$;

4\. compute the Shannon entropy

Generate entropy graph $m$

Algorithm 1 Generating Entropy Graph

To construct an entropy graph, we first read a ransomware binary file as a
stream of bytes. The bytes are made into multiple segments each of which is
comprised of 200 bytes. We further count the frequency of unique byte value
followed by computing the entropy using Shannon’s formula as follows:

$\mathit{Ent}=-\sum_{i}\sum_{j}M(i,j)logM(i,j)$ (1)

where $M$ is the probability of an occurrence of a byte value.

The entropy obtains the minimum value of 0 when all the byte values in a
binary file of ransomware are the same while the maximum entropy value of byte
value 8 is obtained when all the byte values are different. The entropy values
are then concatenated as a stream of values which can be formed as an entropy
graph.

###  3.2 Our proposed Model

The overview of our proposed model is shown in Figure 3. The entropy values
from each entropy graph are fed into each sub-network of SNN. At each sub-
network, we use a pre-trained VGG-16 whose weights and parameters were trained
on ImageNet and use it in a meta-learning fashion (i.e., the pre-trained model
assists the training of our proposed model).

The VGG-16 architecture we use has 5 blocks each of which comprises several
convolution layers and a pooling layer. The first two blocks contain 2
convolution layers of the receptive size of 3 $\times$ 3 with ReLU activation
functions. The first block contains the convolution layer with 64 filters
while the second block contains the convolution layer with 128 filters. The
next three blocks contain 3 convolution layers, again with the receptive size
of 3 $\times$ 3 with ReLU activation functions. The convolution layer in the
third block contains 256 filters while the last two blocks (i.e., fourth and
fifth) contain 512 filters at each convolution layer. The convolution stride
is fixed at 1 pixel as well as the padding size at 1 pixel. We use max-pooling
at each block over a 2 $\times$ 2 pixel window with a stride of 2 pixels.

This pre-trained VGG-16 architecture is further trained and optimized with the
entropy values inputted as 2-dimensional vectors of a fixed size 224 $\times$
224\. By first utilizing weights and parameters well trained with the image
samples and further fine-tuning the parameters of our proposed model with
entropy features. This way can avoid potential bias associated with training a
deep learning model with a limited number of samples. Note that each sub-
network takes one entropy graph as input from the same ransomware family.

The five blocks of VGG-16 architecture are followed by two fully connected
layers with a fattening layer in-between. The first fully connected layer has
1024 neurons and the last fully connected layer serves as the output layer and
has 512 neurons. We apply a center loss function to the final output layer to
compute a loss across the inter-class variance (e.g., the combination features
with two sub-networks). Finally, a softmax loss is used for categorical
classification to distinguish different ransomware families.

Figure 3: The overview of our proposed SNN using Entropy features

Algorithm 2 illustrates the pseudocode involved in our proposed model in terms
of training and testing stages.

Input : Entropy Graph Feature $x_{i}$, Sample label $y_{t}^{i}$, Hyper-
parameters $\beta$ , Initialized Centers $c_{y_{t}}$ and Class Weights
$w_{y_{t}}$

Output : Class Probability of Each Class

Dataloader = SelectPostivePairs($y_{t}^{i}$)

for $x_{1}$, $x_{2}$ in Dataloader:

$z_{t}^{1},z_{t}^{2}$ = EncoderNetworks$(x_{t}^{1},x_{t}^{2})$

$z$ = WeightedCenterLayer($[z_{t}^{1},z_{t}^{2}]$, $c_{i}$ ,$w_{i}$)

$s_{z}$ = SoftMaxLayer($z$)

Loss = CrossEntropyLoss($s_{z}$) + 0.3 $\times$ CenterLoss($z$)

Loss.backward()

Optimizer.step()

Algorithm 2 Pseudocode for Our Proposed Algorithm

###  3.3 Classification

A softmax loss function alone cannot recognize intra-class variance (i.e.,
differences of features within a class) and inter-class variance (i.e.,
differences of features across classes). To overcome this problem, we first
use a center loss function proposed by Wen et al. Wen et al. (2016) to make
the distance of the features belonging to different classes be further away
while the distance of the features belonging to the same class be closer.

$L_{s}=-\frac{1}{N}\sum^{N}_{i=1}\sum^{T}_{t=1}log\left[\frac{exp\left(F\left(x_{i};\theta_{t}\right)\right)\cdot
y_{t}^{i}}{\sum^{T}_{j=1}exp\left(F\left(x_{i};\theta_{t}\right)\right)}\right]$
(2)

where $x_{i}$ represents the $i$th sample in the dataset of the size $N$.
$y_{t}\in\\{0,1\\}^{t}$ indicates the one-hot encoding applied to the input
based on the labels. $T$ indicates the number of tasks during training (e.g.,
either in the entire dataset or in the mini-batch).

Additionally, we also use the second term of center loss to create clusters
for different ransomware families. The distance across the training samples
belonging to the same class is shortened around each cluster while the
distance across the training samples of different classes is separated.
However, it also implies that in the course of learning a center cluster and
the feature $x_{i}$, they may have a similar direction in the feature
embedding during the gradually optimizing step. To mitigate the redundancy in
the learning procedure, we assign the different weights on each class cluster,
which is formally defined as follows.

$L_{c}=\frac{1}{2N}\sum_{N}^{i=1}\left\|x_{i}-w_{y_{t}}c_{y_{t}}\right\|_{2}^{2}$
(3)

where $c_{y_{t}}$ denotes the center of a class $i$ while $x_{i}$ denotes the
features of the euclidean distance and $w_{i}$ indicates the class weights
King and Zeng (2001) on each center cluster.

The objective function stands for the squared Euclidean distance. Observed
from Equation (3), the center loss with different weight parameters encourages
instances of the same class to be closer to a learned class center by
different gradient descent directions of each class.

The classification probability is calculated by the use of two terms of center
loss and the softmax loss function, as shown below.

$\begin{split}\mathit{Classification}=&-\frac{1}{N}\sum^{N}_{i=1}\sum^{T}_{t=1}log\left[\frac{exp\left(F\left(x_{i};\theta_{t}\right)\right)\cdot
y_{t}^{i}}{\sum^{T}_{j=1}exp\left(F\left(x_{i};\theta_{t}\right)\right)}\right]\\\
&+\alpha\frac{1}{2N}\sum_{N}^{i=1}\left\|x_{i}-w_{y_{t}}c_{y_{t}}\right\|_{2}^{2}\end{split}$
(4)

where $\alpha$ is the hyperparameter to balance the two terms.

##  4 Experiment Setup and Evaluation Metrics

This section describes the dataset, the experiment setup, and the performance
metrics used to evaluate the proposed approach.

###  4.1 Dataset Description

In order to assess the effectiveness of the proposed method, the following
benchmark dataset is used in this study.

The binaries of this dataset’s instances were obtained from ViruseShare. The
dataset comprises 11 families/classes of ransomware, each of which consists of
a varying number of instances as listed in Table 1. Clearly, the dataset is
highly imbalanced, which reflects reality, as some classes, e.g., Petya and
Dalexis, are largely outnumbered by the other classes, e.g., Zerber, as shown
in the third column of Table 1.

Table 1: Details of the ransomware dataset. Family | Instances | Ratio (%)
---|---|---
Bitman | 99 | 9.45
Cerber | 91 | 8.68
Dalexis | 9 | 0.86
Gandcrab | 100 | 9.54
Locky | 96 | 9.16
Petya | 6 | 0.57
Teslacrypt | 91 | 8.68
Upatre | 18 | 1.72
Virlock | 162 | 15.46
Wannacry | 178 | 16.98
Zerber | 198 | 18.89

###  4.2 Experimental Setup

This study was carried out using a 3.6 GHz 8-core Intel Core i7 processor with
32 GB memory on Windows 10 operating system. The proposed approach is
developed using Python programming language with several statistical and
visualization packages such as Sckit-learn, Numpy, Pandas, Pytorch, and
Matplotlib. Table 2 summarizes the system configuration.

Table 2: Implementation environment specification. Unit |  Description
---|---
Processor |  3.6 GHz 8-core Inter Core i7
RAM |  32 GB
GPU |  GeForce GTX 1080 Ti
Operating System |  Windows 10
Packages |  Pytorch, Sckit-Learn, Numpy, Pandas, Pyriemannian and Matplotlib

###  4.3 Evaluation Metrics

The proposed method is compared and evaluated using Accuracy, Precision,
Recall, F1-score, and Area under the receiver operating characteristics (ROC)
curve. In this work, we have used the macro and micro average of Recall,
Precision, and F1-score for multi-class classification. All the above metrics
can be obtained using the confusion matrix (CM) which is described in Table 3.

Table 3: Illustration of confusion matrix. | Predicted
---|---
| Classpos | Classneg
Actual | Classpos | True Positive (TP) | False Positive (FP)
Classneg | False Negative (FN) | True Negative (TN)

In Table 3, True positive (TP) means amount of classpos data predicted actual
belong to classpos, True negative (TN) is amount of classneg data predicted is
actually classneg, False positive (FP) indicates data predicted classpos is
actual belong to classneg and False negative (TN) is data predicted as
classneg but actually belong to classpos. Based on the aforementioned terms,
the evaluation metrics are calculated as follows. For a balanced test dataset,
higher accuracy indicates the model is well learned, but for unbalanced test
dataset scenarios relying on accuracy can give the wrong illusion about the
model’s performance. Thus for the unbalanced datasets, recall and F1-score
metrics give a more intuitive explanation of the model’s performance.

Recall (also known as true positive rate) estimates the ratio of the correctly
predicted samples of the class to the overall number of instances of the same
class. It can be computed using Equation 5. A higher Recall value indicates
the good performance of a model.

$\mathit{Recall}=\frac{\mathit{TP}}{\mathit{TP}+\mathit{FN}}$ (5)

Precision measures the quality of the correct predictions. Mathematically, it
is the ratio of correctly predicted samples to the number of all the predicted
samples for that particular class as shown in Equation 6. Precision is usually
paired with Recall to evaluate the performance of a model. Sometimes pairs can
appear contradictory thus comprehensive measure F1-score is considered for
unbalanced test data-sets.

$\mathit{Precision}=\frac{\mathit{TP}}{\mathit{TP}+\mathit{FP}}$ (6)

F1-score computes the trade-off between precision and recall. Mathematically,
it is the harmonic mean of precision and recall, which is computed as

$F1-score=2\times\left(\frac{\mathit{Precision}\times\mathit{Recall}}{\mathit{Precision}+\mathit{Recall}}\right)$
(7)

The area under the curve (AUC) computes the area under the receiver operating
characteristics (ROC) curve which is plotted based on the trade-off between
the true positive rate on the y-axis and the false positive rate on the x-axis
across different thresholds Goodfellow et al. (2016). Mathematically, AUC is
computed as

$\mathit{AUC}_{\mathit{ROC}}=\int_{0}^{1}\frac{\mathit{TP}}{\mathit{TP}+\mathit{FN}}d\frac{\mathit{FP}}{\mathit{TN}+\mathit{FP}}$
(8)

In the case of multi-class and unbalanced test data classification,
performance of models are usually evaluated using weighted and micro-averaging
of recall, precision and F1-score. We have employed weighted-averaging which
in simple terms is the weighted mean of recall, precision, and F1-scores with
weights equal to class probability while sum up the individual recall,
precision, or F1-scores in each class respectively, as shown in Equations
(9)–(11).

$\displaystyle R_{\mathit{weighted}}$
$\displaystyle=\sum^{m}_{i=1}\frac{n_{i}}{\sum_{j=1}^{m}n_{j}}R_{i}$ (9)
$\displaystyle P_{\mathit{weighted}}$
$\displaystyle=\sum^{m}_{i=1}\frac{n_{i}}{\sum_{j=1}^{m}n_{j}}P_{i}$ (10)
$\displaystyle F_{\mathit{weighted}}$
$\displaystyle=\sum^{m}_{i=1}\frac{n_{i}}{\sum_{j=1}^{m}n_{j}}F_{i}$ (11)

##  5 Experimental Results

We evaluated our proposed model on ransomware dataset summarized in Table 1 as
well as bench-marked it with the state-of-the-art deep learning models namely
InceptionV3, Resnet50, and VGG16 used in Malware classification research under
small sample setting.

Table 4: performance of different models Ref. | Method | Recall | Precision | F1-score | Auc-Roc
---|---|---|---|---|---
Yue (2017) | VGG16 | 74.6 | 77.1 | 75.2 | 94.2
Chen (2018) | Inception V3 | 74.8 | 78.6 | 76.3 | 96.1
Lo et al. (2019) | Xception | 73.4 | 77.8 | 76.5 | 96.3
| Our model | 88.7 | 85.3 | 86.2 | 98.2

In order to have an unbiased comparison, all the models are trained under
bootstrap sampling with 30 repetitions using 80% ransomware data and the
remaining 20% is used for evaluating their performances. Table 4 shows a
performance comparison between our proposed approach and other state-of-the-
art approaches used as a baseline to benchmark our results. As it can be seen
in Table 4, our approach exceeds VGG16 by 14.1%, Inception V3 by 13.9%, and
Xception by 15.3% in terms of weighted average recall metric respectively. In
all the metrics our approach outperformed in comparison to other baseline
models.

Figure 4 shows performance variations in terms of F1-score metric for
different models under 30 repetitions. We can see at 80% of training data size
performance variation (with 20% test set) is very minimal. We were able to
achieve a mean F1-score of more than 88% with the lowest 86% and highest
around 94%. Other models in some repetitions are able to achieve above 80%
weighted F1-score but the average is around 75% which is also reported in
Table 4.

Table 5: Hyper-Parameter setting for different model Training Parameters | XceptionV3 | InceptionV3 | Vgg16 | Our model
---|---|---|---|---
Epoch Number | 50 | 50 | 50 | 50
Batch Size | 32 | 32 | 32 | 24
Optimizer | Adam | Adam | Adam | Adam
Learning rate | 1e-4 | 1e-4 | 1e-4 | 1e-4
Train/Test | 80%/20% | 80%/20% | 80%/20% | 80%/20%
Re-scaling | 1/255 | 1/255 | 1/255 | 1/255
Augmentation | for 3 classes | for 3 classes | for 3 classes | for 3 classes
Loss function | Crossentropy | Crossentropy | Crossentropy | Crossentropy
|  |  |  | +Center loss
Figure 4: Boxplot showing performance variation of different methods under
bootstrap sampling with 80% training and 20% test data

Table 5 list hyper-parameter setting for baseline and our proposed approach.
For instance, All the models were trained with $50$ epochs, which ran for
approximately 1 hour. As Figure 5 illustrates, both train and validation loss
stabilizes during 50 epochs confirming the training is done by this stage.

Figure 5: Loss during Training on Epochs

As we can see by classifying the input samples into 11 ransomware classes, our
model has achieved an F1-score of more than 86%. As observed from Table 1, the
sample number of dalexis, petya, and uptatre is less compared with other
classes, which results in the imbalanced problem in the training stage. To
solve this issue, we employ the data augmentation technique Zhu et al. (2020)
for these 3 classes and achieved better results.Figure 6 shows the area under
the curve for different ransomware classes in receiver operating
characteristics (ROC). The micro and macro average of all the classes is
around 0.98 which indicates our model has good separability between different
classes.

Figure 6: Area under curve performance our proposed approach

Furthermore, We can see different cluster formed under our model after
training.

(a)

(b)

Figure 7: T-SNE visualization of our data before and after training

Figure 7 shows different clusters of ransomware classes in our data that are
visualized using t-sne dimensionality reduction technique. Firstly, t-sne plot
in Figure 7 indicates that entropy is a very informative feature as we can see
different clusters of ransomware attacks at the beginning of our model’s
training. Secondly, some of the ransomware attack classes are easily
distinguishable even at the first epoch of training such as locky, wannacry,
uptatre, zerber and virlock etc. At the end of the training, we can see our
model has learned feature embedding to categorize ransomware samples based on
their similarity with the cluster. This can also be seen in our proposed
approach’s results shown by the confusion matrix for one run in bootstrap
sampling in Figure 8.

Figure 8: Confusion Matrix

As we can see in Figure 8, our model is able to distinguish all the classes of
ransomware except bigman and teslacrypt. This is because these two classes
have very similar signatures that can be seen in t-sne plot after 50 epochs in
Figure 7. Both classes clusters are very close to each other with some samples
very difficult to differentiate, that is why our model performed poorly for
these two classes. We further conduct another experiment to explore the
performance of our model with different ratios of training size, as shown in
Figure 9.

Figure 9: Performance with the different ratio of % training samples

We systematically reduce the training data size from 90% to 10%. This
experiment was repeated 30 times using bootstrapping technique (sampling with
replacement) and the mean F1-score on test data based on training data size is
reported using Figure 9. As we can see, our model is able to achieve a
weighted F1-score greater than 80% at just 50% training size whereas other
state-of-the-art methods required a very large amount of data (approx. 90% of
data for training) to reach more than 70% weighted F1-score. Finally, from all
these experiments we can confirm our model performs well under a small amount
of training data.

##  6 Conclusions

We proposed a few-shot learning method based on the Siamese Neural Network
model which can rapidly detect and classify different ransomware attack
classes even if only a few ransomware samples are available for each class. In
our proposed approach, we use entropy features in addition to image features
to capture more accurately the unique characteristics associated with each
malware signature represented in the feature embedding space of the model. A
pre-trained network such as VGG-16 is utilized to generate more accurate
weights of different ransomware samples in a meta-learning fashion to avoid
the bias typically associated with a model trained with a limited number of
training samples. The experimental results tested on the ransomware samples
containing 11 different ransomware classes show a very high classification
with a weighted F1-score exceeding 86%.

We plan to extend our work to other application domains to evaluate the
generalizability and practicability of our proposed solution. These include
but are not limited to the rapid classification of other types of malware
McIntosh et al. (2018); Wei et al. (2021); Xu et al. (2021); McIntosh et al.
(2019). We also plan to extend our work to a practical market-scale triage
solution to screen different malware rapidly.

## Acknowledgment

This research is supported by the Cyber Security Research Programme—Artificial
Intelligence for Automating Response to Threats from the Ministry of Business,
Innovation, and Employment (MBIE) of New Zealand as a part of the Catalyst
Strategy Funds under the grant number MAUX1912.

## References

  * Davies et al. [2021] Simon R. Davies, Richard Macfarlane, and William J. Buchanan.  Differential area analysis for ransomware attack detection within mixed file datasets.  _Computers & Security_, 108:102377, 2021.  ISSN 0167-4048.  doi:https://doi.org/10.1016/j.cose.2021.102377.  URL https://www.sciencedirect.com/science/article/pii/S0167404821002017.
  * Al-Sahaf and Welch [2019] H. Al-Sahaf and I. Welch.  A genetic programming approach to feature selection and construction for ransomware, phishing and spam detection.  2019\.  ISBN 9781450367486.  doi:10.1145/3319619.3322083.
  * Abbasi et al. [2020] Muhammad Shabbir Abbasi, Harith Al-Sahaf, and Ian Welch.  Particle swarm optimization: A wrapper-based feature selection method for ransomware detection and classification.  _Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)_ , 12104 LNCS:181–196, 4 2020.  doi:10.1007/978-3-030-43722-0_12.  URL https://link.springer.com/chapter/10.1007/978-3-030-43722-0_12.
  * Rhode et al. [2018] Matilda Rhode, Pete Burnap, and Kevin Jones.  Early-stage malware prediction using recurrent neural networks.  _Computers & Security_, 77:578–594, 2018.  ISSN 0167-4048.  doi:https://doi.org/10.1016/j.cose.2018.05.010.  URL https://www.sciencedirect.com/science/article/pii/S0167404818305546.
  * Camp et al. [2019] L Jean Camp, Marthie Grobler, Julian Jang-Jaccard, Christian Probst, Karen Renaud, and Paul Watters.  Measuring human resilience in the face of the global epidemiology of cyber attacks.  In _Proceedings of the 52nd Hawaii International Conference on System Sciences_ , 2019.
  * Nataraj et al. [2011] Lakshmanan Nataraj, Vinod Yegneswaran, Phillip Porras, and Jian Zhang.  A comparative assessment of malware classification using binary texture analysis and dynamic analysis.  _Proceedings of the 4th ACM workshop on Security and artificial intelligence - AISec ’11_ , 2011.  doi:10.1145/2046684.
  * Kim et al. [2020] Sungjoong Kim, Seongkyu Yeom, Haengrok Oh, Dongil Shin, and Dongkyoo Shin.  Automatic malicious code classification system through static analysis using machine learning.  _Symmetry_ , 13, 2020.  ISSN 20738994.  doi:10.3390/sym13010035.
  * Chen [2018] Li Chen.  Deep transfer learning for static malware classification.  _CoRR_ , abs/1812.07606, 2018.  URL http://arxiv.org/abs/1812.07606.
  * Lo et al. [2019] Wai Weng Lo, Xu Yang, and Yapeng Wang.  An xception convolutional neural network for malware classification with transfer learning.  In _2019 10th IFIP International Conference on New Technologies, Mobility and Security (NTMS)_ , pages 1–5, 2019.  doi:10.1109/NTMS.2019.8763852.
  * Yue [2017] Songqing Yue.  Imbalanced malware images classification: a CNN based approach.  _CoRR_ , abs/1708.08042, 2017.  URL http://arxiv.org/abs/1708.08042.
  * Milosevic et al. [2017] Nikola Milosevic, Ali Dehghantanha, and Kim-Kwang Raymond Choo.  Machine learning aided android malware classification.  _Computers & Electrical Engineering_, 61:266–274, 2017\.
  * Vasan et al. [2020] Danish Vasan, Mamoun Alazab, Sobia Wassan, Babak Safaei, and Qin Zheng.  Image-based malware classification using ensemble of cnn architectures (imcec).  _Computers & Security_, 92:101748, 2020.
  * Yuan et al. [2020] Baoguo Yuan, Junfeng Wang, Dong Liu, Wen Guo, Peng Wu, and Xuhua Bao.  Byte-level malware classification based on markov images and deep learning.  _Computers & Security_, 92:101740, 2020.
  * Zhu et al. [2021a] Jinting Zhu, Julian Jang-Jaccard, Tong Liu, and Jukai Zhou.  Joint spectral clustering based on optimal graph and feature selection.  _Neural Processing Letters_ , 53(1):257–273, 2021a.
  * Cao et al. [2018] Jie Cao, Zhe Su, Liyun Yu, Dongliang Chang, Xiaoxu Li, and Zhanyu Ma.  Softmax cross entropy loss with unbiased decision boundary for image classification.  In _2018 Chinese Automation Congress (CAC)_ , pages 2028–2032. IEEE, 2018.
  * Zhu et al. [2020] Jinting Zhu, Julian Jang-Jaccard, and Paul A Watters.  Multi-loss siamese neural network with batch normalization layer for malware detection.  _IEEE Access_ , 8:171542–171550, 2020.
  * Zhu et al. [2021b] Jinting Zhu, Julian Jang-Jaccard, Amardeep Singh, Paul A Watters, and Seyit Camtepe.  Task-aware meta learning-based siamese neural network for classifying obfuscated malware.  _arXiv preprint arXiv:2110.13409_ , 2021b.
  * Kirat et al. [2013] Dhilung Kirat, Lakshmanan Nataraj, Giovanni Vigna, and B. S. Manjunath.  Sigmal: A static signal processing based malware triage.  In _Proceedings of the 29th Annual Computer Security Applications Conference_ , ACSAC ’13, page 89–98, New York, NY, USA, 2013. Association for Computing Machinery.  ISBN 9781450320153.  doi:10.1145/2523649.2523682.  URL https://doi.org/10.1145/2523649.2523682.
  * Baldwin and Dehghantanha [2018] James Baldwin and Ali Dehghantanha.  _Leveraging Support Vector Machine for Opcode Density Based Detection of Crypto-Ransomware_ , pages 107–136.  Springer International Publishing, Cham, 2018.  doi:10.1007/978-3-319-73951-9_6.  URL https://doi.org/10.1007/978-3-319-73951-9_6.
  * Zhang et al. [2019] Hanqi Zhang, Xi Xiao, Francesco Mercaldo, Shiguang Ni, Fabio Martinelli, and Arun Kumar Sangaiah.  Classification of ransomware families with machine learning based onn-gram of opcodes.  _Future Generation Computer Systems_ , 90:211–221, 2019\.  ISSN 0167-739X.  doi:https://doi.org/10.1016/j.future.2018.07.052.  URL https://www.sciencedirect.com/science/article/pii/S0167739X18307325.
  * Cui et al. [2018] Zhihua Cui, Fei Xue, Xingjuan Cai, Yang Cao, Gai-ge Wang, and Jinjun Chen.  Detection of malicious code variants based on deep learning.  _IEEE Transactions on Industrial Informatics_ , 14(7):3187–3196, 2018.  doi:10.1109/TII.2018.2822680.
  * Cui et al. [2019] Zhihua Cui, Lei Du, Penghong Wang, Xingjuan Cai, and Wensheng Zhang.  Malicious code detection based on cnns and multi-objective algorithm.  _Journal of Parallel and Distributed Computing_ , 129:50–58, 2019.  ISSN 0743-7315.  doi:https://doi.org/10.1016/j.jpdc.2019.03.010.  URL https://www.sciencedirect.com/science/article/pii/S0743731518308529.
  * McIntosh et al. [2018] Timothy R McIntosh, Julian Jang-Jaccard, and Paul A Watters.  Large scale behavioral analysis of ransomware attacks.  In _International Conference on Neural Information Processing_ , pages 217–229. Springer, 2018.
  * Ferrante et al. [2018] Alberto Ferrante, Miroslaw Malek, Fabio Martinelli, Francesco Mercaldo, and Jelena Milosevic.  Extinguishing ransomware - a hybrid approach to android ransomware detection.  In Abdessamad Imine, José M. Fernandez, Jean-Yves Marion, Luigi Logrippo, and Joaquin Garcia-Alfaro, editors, _Foundations and Practice of Security_ , pages 242–258, Cham, 2018. Springer International Publishing.
  * Shaukat and Ribeiro [2018] Saiyed Kashif Shaukat and Vinay J. Ribeiro.  Ransomwall: A layered defense system against cryptographic ransomware attacks using machine learning.  In _2018 10th International Conference on Communication Systems Networks (COMSNETS)_ , pages 356–363, 2018.  doi:10.1109/COMSNETS.2018.8328219.
  * Hamid et al. [2018] T Hamid, D Al-Jumeily, and J Mustafina.  Evaluation of the dynamic cybersecurity risk using the entropy weight method.  In _Technology for Smart Futures_ , pages 271–287. Springer, 2018\.
  * Wen et al. [2016] Yandong Wen, Kaipeng Zhang, Zhifeng Li, and Yu Qiao.  A discriminative feature learning approach for deep face recognition.  In _European conference on computer vision_ , pages 499–515. Springer, 2016.
  * King and Zeng [2001] Gary King and Langche Zeng.  Logistic regression in rare events data.  _Political analysis_ , 9(2):137–163, 2001.
  * Goodfellow et al. [2016] Ian Goodfellow, Yoshua Bengio, and Aaron Courville.  _Deep Learning_.  MIT Press, 2016.  http://www.deeplearningbook.org.
  * Wei et al. [2021] Yuanyuan Wei, Julian Jang-Jaccard, Fariza Sabrina, Amardeep Singh, Wen Xu, and Seyit Camtepe.  Ae-mlp: A hybrid deep learning approach for ddos detection and classification.  _IEEE Access_ , to appear, 2021.
  * Xu et al. [2021] Wen Xu, Julian Jang-Jaccard, Amardeep Singh, Yuanyuan Wei, and Fariza Sabrina.  Improving performance of autoencoder-based network anomaly detection on nsl-kdd dataset.  _IEEE Access_ , 9:140136–140146, 2021.  doi:10.1109/ACCESS.2021.3116612.
  * McIntosh et al. [2019] Timothy McIntosh, Julian Jang-Jaccard, Paul Watters, and Teo Susnjak.  The inadequacy of entropy-based ransomware detection.  In _International Conference on Neural Information Processing_ , pages 181–189. Springer, 2019.