Abstract: Ransomware,defined by its mechanism of encrypting critical data to extort payment from victims,results in global ransom payments exceeding $1 billion in 2023.Precise classification of ransomware is crucial for effective security defense.How-ever,ransomware samples are often small.To address this challenge,this paper proposes a cross-modal fusion few-shot ransomware classifier named CMFu,comprising a feature construction module,an encoding module,and a fusion module.The feature construction module generates cross-modal features.The encoding module employs two pre-trained models to construct encoders that encode features from different modalities.The fusion module integrates the encoded data to achieve the final classification.Experimental evaluation assesses model performance under training sample ratios of 10%,30%,and 50%.CMFu outperforms all baseline model across all metrics.At a 30% sample ratio,CMFu achieves precision,recall,and F1-score of 0.91,0.91,and 0.90,respectively,demonstrating superior performance.When the sample ratio decreases to 10%,these metrics remain high at 0.78,0.84,and 0.80,confirming its ability in few-shot ransomware classification.Furthermore,ablation studies validate both the viabili-ty of the pre-training-based encoders and the necessity of employing backbone networks for fusion.

Key words: Ransomware, Few samples, Multiple modalities, Pre-trained models, Deep learning