Enhancing Cybersecurity against Ransomware Attacks Using LSTM Deep Learning Method: A Case Study on Android Devices

Abstract

The rapid advancement of technology brings new threats to the digital world. One of these threats is malicious ransomware attacks. Ransomware is malicious software that demands ransom from innocent users by blocking access to information systems. Since traditional methods are limited to predefined blacklists, they may be ineffective against unknown ransomware types. Deep learning methods, on the other hand, offer a sensitive defense mechanism against anomalies by learning normal behavior patterns. In this study, the Internet logs of Android devices consisting of 392,034 rows and 86 columns were studied using the Long Short-Term Memory (LSTM) model. The dataset contains 14 different Android ransomware families and harmless traffic. Data preprocessing steps include missing data management, outlier analysis, feature selection, coding operations, and data normalization/standardization. The dataset was split at 80% training - 20% test ratio, and it was determined that the 80% training - 20% test split had the highest accuracy. The developed LSTM based classification model achieved successful results with 99% accuracy rate and 0.99 F1-score.

More by Dr. Adem Tekerek

• Limits of Curtailed Wind Utilization by Ferry-Borne Tourist Electric Vehicles: A Milos Island Case StudyProcesses · 2026
• An Explainable Hybrid Deep Learning Framework Combining Fine-Tuned Convolutional Neural Network Ensembles for Dermoscopic Images of Skin LesionsDermatology Practical & Conceptual · 2026
• Detection of Alzheimer's Disease Using Different Machine Learning Models and Performance Comparison of the ModelsInterdisciplinary Conference on Electrics and Computer · 2026
• Raw URL-Based Phishing Detection Using Domain-Separate Evaluation: A Comparison of CharCNN, Transformer, BiGRU, and LexicalMLPInterdisciplinary Conference on Electrics and Computer · 2026