  Ransomware has appeared as one of the major global threats in recent days.
The alarming increasing rate of ransomware attacks and new ransomware variants
intrigue the researchers to constantly examine the distinguishing traits of
ransomware and refine their detection strategies. Application Programming
Interface (API) is a way for one program to collaborate with another; API calls
are the medium by which they communicate. Ransomware uses this strategy to
interact with the OS and makes a significantly higher number of calls in
different sequences to ask for taking action. This research work utilizes the
frequencies of different API calls to detect and classify ransomware families.
First, a Web-Crawler is developed to automate collecting the Windows Portable
Executable (PE) files of 15 different ransomware families. By extracting
different frequencies of 68 API calls, we develop our dataset in the first
phase of the two-phase feature engineering process. After selecting the most
significant features in the second phase of the feature engineering process, we
deploy six Supervised Machine Learning models: Na"ive Bayes, Logistic
Regression, Random Forest, Stochastic Gradient Descent, K-Nearest Neighbor, and
Support Vector Machine. Then, the performances of all the classifiers are
compared to select the best model. The results reveal that Logistic Regression
can efficiently classify ransomware into their corresponding families securing
99.15% overall accuracy. Finally, instead of relying on the 'Black box'
characteristic of the Machine Learning models, we present the post-hoc analysis
of our best-performing model using 'SHapley Additive exPlanations' or SHAP
values to ascertain the transparency and trustworthiness of the model's
prediction.
