# MLRan: A Behavioural Dataset for Ransomware Analysis and Detection

arXiv: https://arxiv.org/abs/2505.18613 · HTML: https://mlsanity.com/paper/2505.18613/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 8 of its 67 references that are in the map.
- First posted on arXiv 24 May 2025.

## Builds on (most cited first, 8 of 8)

- [TESSERACT: Eliminating Experimental Bias in Malware Classification across Space and Time](https://mlsanity.com/paper/1807.07838/) (2018)
- [SoK: The Impact of Unlabelled Data in Cyberthreat Detection](https://mlsanity.com/paper/2205.08944/) (2022)
- [On the Limitations of Continual Learning for Malware Classification](https://mlsanity.com/paper/2208.06568/) (2022)
- [Semi-supervised Classification of Malware Families Under Extreme Class Imbalance via Hierarchical Non-Negative Matrix Factorization with Automatic Model Selection](https://mlsanity.com/paper/2309.06643/) (2023)
- [Machine Learning (In) Security: A Stream of Problems](https://mlsanity.com/paper/2010.16045/) (2020)
- [Automated Dynamic Analysis of Ransomware: Benefits, Limitations and use for Detection](https://mlsanity.com/paper/1609.03020/) (2016)
- [Know Abnormal, Find Evil: Frequent Pattern Mining for Ransomware Threat Hunting and Intelligence](https://mlsanity.com/paper/1808.01957/) (2018)
- [SoK: An Essential Guide For Using Malware Sandboxes In Security Applications: Challenges, Pitfalls, and Lessons Learned](https://mlsanity.com/paper/2403.16304/) (2024)

## Abstract (arXiv)

Ransomware remains a critical threat to cybersecurity, yet publicly available datasets for training machine learning-based ransomware detection models are scarce and often have limited sample size, diversity, and reproducibility. In this paper, we introduce MLRan, a behavioural ransomware dataset, comprising over 4,800 samples across 64 ransomware families and a balanced set of goodware samples. The samples span from 2006 to 2024 and encompass the four major types of ransomware: locker, crypto, ransomware-as-a-service, and modern variants. We also propose guidelines (GUIDE-MLRan), inspired by previous work, for constructing high-quality behavioural ransomware datasets, which informed the curation of our dataset. We evaluated the ransomware detection performance of several machine learning (ML) models using MLRan. For this purpose, we performed feature selection by conducting mutual information filtering to reduce the initial 6.4 million features to 24,162, followed by recursive feature elimination, yielding 483 highly informative features. The ML models achieved an accuracy, precision and recall of up to 98.7%, 98.9%, 98.5%, respectively. Using SHAP and LIME, we identified critical indicators of malicious behaviour, including registry tampering, strings, and API misuse. The dataset and source code for feature extraction, selection, ML training, and evaluation are available publicly to support replicability and encourage future research, which can be found at https://github.com/faithfulco/mlran.