RanDoctor: System-Level Ransomware Detection with ProbSparse Self-Attention

Abstract

Ransomware attacks pose significant threats and have caused substantial economic losses across various industries worldwide. Existing defense mechanisms typically focus on detecting ransomware in environments free from interference by other legitimate programs. However, in real-world applications, ransomware often coexists with normal programs, resulting in fragmented behavioral patterns that reduce detection accuracy. To address this issue, we propose a system-level ransomware detection approach, named RanDoctor. This method leverages long-time series analysis to capture the behavioral characteristics of ransomware, thereby improving the comprehensiveness and accuracy of detection. To further enhance system performance, we design the Ranformer model, incorporating the ProbSparse self-attention mechanism and a distillation process. Experimental results demonstrate that the RanDoctor system achieves a detection accuracy of 99.5%, representing a 8.0% improvement over state-of-the-art detection models.