# A Survey of Machine Learning Algorithms for Detecting Ransomware Encryption Activity

arXiv: https://arxiv.org/abs/2110.07636 · HTML: https://mlsanity.com/paper/2110.07636/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 2 of its 11 references that are in the map.
- First posted on arXiv 14 Oct 2021.

## Builds on (most cited first, 2 of 2)

- [Malware Analysis with Artificial Intelligence and a Particular Attention on Results Interpretability](https://mlsanity.com/paper/2107.11100/) (2021)
- [POSSE: Patterns of Systems During Software Encryption](https://mlsanity.com/paper/2109.12162/) (2021)

## Built on by (most cited first, 1 of 1)

- [Radial Spike and Slab Bayesian Neural Networks for Sparse Data in Ransomware Attacks](https://mlsanity.com/paper/2205.14759/) (2022)

## Abstract (arXiv)

A survey of machine learning techniques trained to detect ransomware is presented. This work builds upon the efforts of Taylor et al. in using sensor-based methods that utilize data collected from built-in instruments like CPU power and temperature monitors to identify encryption activity. Exploratory data analysis (EDA) shows the features most useful from this simulated data are clock speed, temperature, and CPU load. These features are used in training multiple algorithms to determine an optimal detection approach. Performance is evaluated with accuracy, F1 score, and false-negative rate metrics. The Multilayer Perceptron with three hidden layers achieves scores of 97% in accuracy and F1 and robust data preparation. A random forest model produces scores of 93% accuracy and 92% F1, showing that sensor-based detection is currently a viable option to detect even zero-day ransomware attacks before the code fully executes.