Ransomware Classification Framework Using the Behavioral Performance Visualization of Execution Objects

A ransomware attack that interrupted the operation of Colonial Pipeline (a large U.S. oil pipeline company), showed security threats by malware have become serious enough to affect industries and social infrastructure rather than individuals alone. The agents characteristics attacks should be identified, appropriate strategies established accordingly in order respond such attacks. For this purpose, first task must performed is classification. Malware creators are well aware apply various concealment avoidance techniques, making it difficult classify malware. This study focuses on new features classification techniques overcome these difficulties. We propose a behavioral performance visualization method using utilization patterns system resources, as central processing unit, memory, input/output, commonly used analysis or tuning programs. extracted usage resources for perform visualization. results evaluation indicate an accuracy at least 98.94% with 3.69% loss rate. Furthermore, we designed implemented framework entire process—from data extraction measurement—that expected contribute related studies future.