Wrapper-Based Categorical Feature Prioritization: Enhancing Ransomware Detection Agility for Resource-Constrained Infrastructure

Abstract

Ransomware has become a growing menace to online economies and critical infrastructure in nearly every part of the world. Although useful in detecting new ransomware variants, behavioral detection techniques tend to produce highdimensionalfeature spaces, which are computationally expensive and cannot be deployed in real time. To overcome these problems, we propose a new four-stage category-aware wrapper-based feature selection framework for binary ransomware classification. Unlike our previous two-stage approach that relied on a single evaluation algorithm, the proposed method analyzes individual categories of features with several learning algorithms, optimizes category sets, ranks features in the chosen category sets, and uses wrapper-based selection to generate small, informative sets. The proposed approach was able to produce high detection performance and achieve a dramatic dimensionality reduction using a dataset of 30,967 features structured into seven behavioral categories. The Logistic Regression wrapper combined with ensemble learning achieved 98.03% accuracy while an SVM wrapper reduced the feature space by 99.64%. In addition to increased accuracy,the selected subsets have substantial efficiency benefits. In this case, in the ensemble learning classifier the proposed methodwas 45-fold faster in training and 270-fold faster in testing than the full set of features. These results indicate that categoricalfeature prioritization enhances binary detection ability as well as computational efficiency, making this method especiallyapplicable in resource-constrained settings.