使用和不使用RFECV特征选择技术对勒索软件分类的可解释机器学习模型的比较性能分析
A Comparative Performance Analysis of Explainable Machine Learning Models With And Without RFECV Feature Selection Technique Towards Ransomware Classification
摘要：
勒索软件已成为最近几天的主要全球威胁之一。勒索软件攻击和新的勒索软件变体的惊人增长率促使该领域的研究人员不断研究勒索软件的显著特征，并改进其检测或分类策略。在广泛的不同行为特征中，应用程序编程接口（API）调用和网络行为的特征已被广泛用作勒索软件检测或分类的区分因素。虽然许多现有方法在利用这些特征而不应用任何特征选择技术来检测和分类勒索软件家族方面已经显示出有希望的结果，但是，特征选择是朝向高效检测或分类机器学习模型的潜在步骤之一，因为它通过去除冗余数据来降低过拟合的概率，通过去除不相关的特征来提高模型的准确性，因此减少了训练时间。到目前为止，已经有大量的特征选择技术被用于不同的安全场景，以优化机器学习模型的性能。因此，本研究的目的是提供广泛使用的监督机器学习模型的比较性能分析，使用和不使用RFECV特征选择技术，利用API调用和网络流量特征进行勒索软件分类。因此，这项研究提供了深入了解的效率的RFECV特征选择技术的勒索软件分类的情况下，可以使用同行作为参考，为今后的工作中选择的特征选择技术在这个领域。
英文摘要：
Ransomware has emerged as one of the major global threats in recent days. The alarming increasing rate of ransomware attacks and new ransomware variants intrigue the researchers in this domain to constantly examine the distinguishing traits of ransomware and refine their detection or classification strategies. Among the broad range of different behavioral characteristics, the trait of Application Programming Interface (API) calls and network behaviors have been widely utilized as differentiating factors for ransomware detection, or classification. Although many of the prior approaches have shown promising results in detecting and classifying ransomware families utilizing these features without applying any feature selection techniques, feature selection, however, is one of the potential steps toward an efficient detection or classification Machine Learning model because it reduces the probability of overfitting by removing redundant data, improves the model's accuracy by eliminating irrelevant features, and therefore reduces training time. There have been a good number of feature selection techniques to date that are being used in different security scenarios to optimize the performance of the Machine Learning models. Hence, the aim of this study is to present the comparative performance analysis of widely utilized Supervised Machine Learning models with and without RFECV feature selection technique towards ransomware classification utilizing the API call and network traffic features. Thereby, this study provides insight into the efficiency of the RFECV feature selection technique in the case of ransomware classification which can be used by peers as a reference for future work in choosing the feature selection technique in this domain.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
