Ransomware Detection Using Light Gradient Boosting Machine Classifier

Abstract

Ransomware continues to represent a critical cybersecurity threat across various sectors, leading to significant financial and operational disruptions. Traditional detection techniques, such as signaturebased and behavior-based approaches, often fall short in identifying advanced ransomware variants that utilize polymorphism, obfuscation, and zero-day exploits. To overcome these limitations, this study proposes a machine learning-based framework for multi-class ransomware detection using the Light Gradient Boosting Machine (LightGBM) classifier. The model was trained and evaluated on a labeled Android dataset comprising diverse ransomware families alongside benign applications. To address the issue of class imbalance, the Synthetic Minority Oversampling Technique with Edited Nearest Neighbors (SMOTEENN) was employed, followed by thorough feature preprocessing and hyperparameter optimization. The optimized LightGBM model achieved an accuracy of 90.78% and a weighted F1-score of 90.73%, outperforming baseline classifiers such as Decision Tree and Random Forest. This study offers both theoretical and practical contributions by presenting a lightweight yet highly accurate detection system suitable for real-world deployment, and by validating the effectiveness of SMOTEENN when combined with LightGBM for handling imbalanced, multiclass cybersecurity datasets.