# Leveraging Machine Learning Techniques for Windows Ransomware Network Traffic Detection

arXiv: https://arxiv.org/abs/1807.10440 · HTML: https://mlsanity.com/paper/1807.10440/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 27 Jul 2018.

## Built on by (most cited first, 2 of 2)

- [Radial Spike and Slab Bayesian Neural Networks for Sparse Data in Ransomware Attacks](https://mlsanity.com/paper/2205.14759/) (2022)
- [On the Generalizability of Machine Learning-based Ransomware Detection in Block Storage](https://mlsanity.com/paper/2412.21084/) (2024)

## Abstract (arXiv)

Ransomware has become a significant global threat with the ransomware-as-a-service model enabling easy availability and deployment, and the potential for high revenues creating a viable criminal business model. Individuals, private companies or public service providers e.g. healthcare or utilities companies can all become victims of ransomware attacks and consequently suffer severe disruption and financial loss. Although machine learning algorithms are already being used to detect ransomware, variants are being developed to specifically evade detection when using dynamic machine learning techniques. In this paper, we introduce NetConverse, a machine learning analysis of Windows ransomware network traffic to achieve a high, consistent detection rate. Using a dataset created from conversation-based network traffic features we achieved a true positive detection rate of 97.1% using the Decision Tree (J48) classifier.