Abstract: With the rapid development of artificial intelligence, 5G, Internet of Things and other technologies, China has become increasingly vulnerable to attacks from outside the country in the field of cyber security. The number of ransomware attacks has increased significantly, causing huge data losses and economic losses to individuals, enterprises and countries. To effectively classify ransomware families, a ransomware classification method based on entropy image static analysis technology is proposed in this paper, which directly utilizes the entropy features extracted from ransomware binary files for classification. In addtion, a data augmentation method named Ran-GAN is proposed to solve the data imbalance problem among ransomware families. The method proposed in this paper introduces the attention mechanism into the VGG16 neural network architecture to improve the feature extraction ability of the network. Experimental results show that the proposed method achieves 97.16% accuracy and 97.12% weighted average F1-score on 14 ransomware families. Compared with the traditional visualization methods, the proposed method is obviously better than the traditional visualization methods under the four evaluation indicators. At the same time, the ransomware detection performance is significantly improved compared with other neural network methods.

Key words: ransomware, ransomware visualization, entropy features, static analysis, attention mechanism