Reliability of Entropy-based Malware Detection as a Single Method in Preventing Ransomware Attacks
Year: 2024
Type: article
Abstract: As the complexity of ransomware attacks increases, traditional detection methodologies are often insufficient for detecting and preventing threats. Therefore, modern malware detection methods are used. These are the behavior-, system-, resource-, connection- and entropy-based ransomware detection methods. In this study, we evaluated the effectiveness of an entropy-based malware detection method in detecting ransomware attacks by evaluating the entropy values of malware detected using Binalayze AIR and Binalayze Tactical software. As revealed in the results of our comprehensive field study in which 41477 malware were evaluated, although the entropy-based malware detection method has advantages in that it is easily applicable, can be integrated with other methods, and provides fast results, it can give high rates of false-positive and false-negative results when used alone. The entropy-based method is unreliable unless it is used with hybrid models. More advanced and holistic approaches must be adopted for effective cybersecurity defense.
Source: Journal of Polytechnic
Institution: Gazi University
Language: English
Subfield: Signal Processing
Field: Computer Science
Domain: Physical Sciences
Open Access status: diamond
OpenAlex ID: W4403290652