The Application of Machine Learning in Bitcoin Ransomware Family Prediction

In recent years, ransomware attacks have become increasingly rampant, resulting in many large companies or financial institutions suffering heavy losses from ransomware attacks. Bitcoin, is a means of payment demanded by the Ransomware Family. By comparing and analyzing the characteristics of bitcoin transactions, we can predict the types of Ransomware Family. Therefore, in this paper, the algorithm of machine learning is used to put forward the prediction method of Ransomware Family, so as to achieve the better effect of helping the attacked institutions to avoid being extorted effectively. In the traditional method, the judgment of Ransomware Family can only rely on human experience and subjective judgment, instead of accurate and batch analysis of Bitcoin transactions and prediction results. In this paper, a large number of known data sets of bitcoin's transaction features are used for analysis and modeling. First, we carried out descriptive statistical analysis to explore the differences between different Ransomware Families in bitcoin trading behavior. Next, we used a series of machine learning models to build the prediction model of Ransomware Family and conduct identification and classification, so as to help avoid financial losses from the Ransomware. Finally, we found that Ransomware family species were most significantly affected by year. In addition, it can be found that the accuracy of the Boosting model is the highest, and the test error is only about 3%.