RansomSheild: Novel Framework for Effective Data Recovery in Ransomware Recovery Process

Ransomware attacks are very common nowadays and they are meant to disrupt normal operations and businesses which has ultimately led to data stealing and theft. These types of attacks can become a concern for brand image and information loss. This research paper critically analyzes the existing data recovery methodologies employed in industries for recovery from ransomware attacks. Furthermore, a novel framework is proposed to shield the critical information stored in data servers by utilizing network segmentation, a honeypot device for collecting logs and machine learning-trained devices. The proposed network architecture is effective in the early detection of ransomware attacks and taking action against these attacks without manual procedures. The proposed framework is employed for ransomware attack datasets and machine learning algorithms are compared for detection of attack using behavioral analysis of network traffic. The performance evaluation of deployed machine learning algorithms is presented based on metric accuracy, precision, recall and F1 score. The results prove that XGBoost technique is outperforming the deployed machine learning algorithms for early detection ransomware attack.