ransom_ware.zip (1.84 GB)


Download (1.84 GB)
posted on 30.08.2019 by Amir Atapour Abarghouei, Stephen Bonner, Andrew Stephen McGough
While various recent security-based approaches have focused on detecting and classifying ransomware at the network or system level, easy-to-use post-infection ransomware classification for the lay user has not been attempted before. In this vein, we investigate the possibility of classifying the ransomware a system is infected with simply based on a screenshot of the splash screen or the ransom note captured using a consumer camera commonly found in any modern mobile device. To train and evaluate our system, we have created a sample dataset of the splash screens of 50 well-known ransomware variants. In this dataset, only a single training image is available per ransomware. Instead of creating a large training dataset of ransomware screenshots, we simulate screenshot capture conditions via carefully designed data augmentation techniques, enabling simple and efficient one-shot learning. Moreover, using model uncertainty obtained via Bayesian approximation, we ensure special input cases such as unrelated non-ransomware images and previously-unseen ransomware variants are correctly identified for special handling and not misclassified.

A publication outlining the findings of our research is available here:

Instructions on how this data set can be used is found here:



Computer Science and Informatics