Entropy-Based Deep Learning Framework for Classifying Ransomware Families in Windows Environments

Abstract

Ransomware poses a critical cybersecurity challenge, exploiting strong encryption to deny access to data and evade traditional detection methods. Conventional techniques such as signature and heuristic-based detection often fail against modern variants due to polymorphism, obfuscation, and ransomware-as-a-service (RaaS) models. This study proposes an entropy-based deep learning framework for classifying Windows ransomware families, leveraging entropy’s ability to quantify the randomness introduced by encryption. Encrypted files exhibit higher entropy values (>7.5) compared to benign files (4.5–6.0), making entropy a reliable feature for ransomware detection. In this work, ransomware samples from 18 families were executed in a controlled virtual box windows 10 environment to generate encrypted datasets across multiple file types. Shannon, Rényi, and sample entropy measures, alongside statistical descriptors, were extracted and transformed into normalized feature vectors for classification using a multi-layer perceptron (MLP) model. Experimental results revealed distinct entropy patterns across ransomware families, with the proposed framework achieving efficient training convergence and robust generalization. The model achieved accuracy 94.7%, 94.3% precision, 93.8% recall and FI-score of 94.0%. The findings confirm entropy’s effectiveness as a scalable and resilient feature, supporting accurate ransomware family classification and enhancing real-time detection and forensic analysis.