# A Few-Shot Meta-Learning based Siamese Neural Network using Entropy Features for Ransomware Classification

arXiv: https://arxiv.org/abs/2112.00668 · HTML: https://mlsanity.com/paper/2112.00668/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 1 Dec 2021.

## Built on by (most cited first, 4 of 4)

- [IGRF-RFE: A Hybrid Feature Selection Method for MLP-based Network Intrusion Detection on UNSW-NB15 Dataset](https://mlsanity.com/paper/2203.16365/) (2022)
- [Minerva: A File-Based Ransomware Detector](https://mlsanity.com/paper/2301.11050/) (2023)
- [Training a Bidirectional GAN-based One-Class Classifier for Network Intrusion Detection](https://mlsanity.com/paper/2202.01332/) (2022)
- [Generative AI-Based Effective Malware Detection for Embedded Computing Systems](https://mlsanity.com/paper/2404.02344/) (2024)

## Abstract (arXiv)

Ransomware defense solutions that can quickly detect and classify different ransomware classes to formulate rapid response plans have been in high demand in recent years. Though the applicability of adopting deep learning techniques to provide automation and self-learning provision has been proven in many application domains, the lack of data available for ransomware (and other malware)samples has been raised as a barrier to developing effective deep learning-based solutions. To address this concern, we propose a few-shot meta-learning based Siamese Neural Network that not only detects ransomware attacks but is able to classify them into different classes. Our proposed model utilizes the entropy feature directly extracted from ransomware binary files to retain more fine-grained features associated with different ransomware signatures. These entropy features are used further to train and optimize our model using a pre-trained network (e.g. VGG-16) in a meta-learning fashion. This approach generates more accurate weight factors, compared to feature images are used, to avoid the bias typically associated with a model trained with a limited number of training samples. Our experimental results show that our proposed model is highly effective in providing a weighted F1-score exceeding the rate>86% compared