Uma abordagem interpretável para a detecção de ransomware baseada no consenso de SHAP

Abstract

This study investigates the detection of ransomware malware based on artifacts extracted from memory using machine learning techniques. The Canadian Institute for Cybersecurity Malware Memory Dataset 2022 (CIC-MalMem-2022) was used, containing behavioral information on benign processes and ransomware variants. Initially, data preprocessing was performed, including class balancing, the removal of irrelevant attributes, and the elimination of redundancies among highly correlated features. Subsequently, four supervised algorithms—Decision Tree, Random Forest, K-Nearest Neighbors (KNN), and AdaBoost—were evaluated through 10-fold stratified cross-validation, using metrics such as accuracy, precision, recall, F1-score, and confusion matrices. Subsequently, the explainability technique SHapley Additive exPlanations (SHAP) was applied to identify the importance of the features used by the models. Based on this analysis, a reduced set of attributes was generated through consensus among the models, enabling retraining and performance comparison. The results demonstrated that the reduced feature set maintained performance equivalent to that of the complete set, achieving an accuracy above 99.9% across all evaluated models. It is concluded that explainability-based feature selection can reduce data dimensionality without compromising detection capability, favoring lighter and more interpretable solutions for ransomware detection.