Realtime Ransomware Detection Based on Host System Utilizing Machine Learning and Windowing Threshold

The rise of ransomware attacks and the emergence of new variants are serious threats to cybersecurity. Phishing emails, malicious software, illegal downloads, and the use of system vulnerabilities are common methods for spreading ransomware. Ransomware detection research focuses on static and dynamic analysis, but challenges remain, especially in the face of zero-day exploits and attack identification delays. Dynamic analysis can produce more accurate results than static analysis, although dynamic analysis requires an attack to be performed first. The goal of this research is to improve real-time ransomware detection and prevention before all data is encrypted. The researchers extracted features using a host-based strategy that included windowing as well as TF-IDF and n-gram methods. Three machine learning methods were used to build the model: Support Vector Machine, Random Forest, and Naive Bayes. The models were assessed based on false positive rate (FPR), false negative rate (FNR), recall, accuracy, precision, and F1 score. In comparison to both models, the study found that Naive Bayes had 100% accuracy, precision, recall, and F1-score, but 0% FPR and FNR. Naive Bayes is the best model for real-time detection, with a threshold of 7 and a window size of 1000 (maximum 10 windows). The real-time detection framework can detect ransomware attacks in less than 40,000 API calls, well before reaching hundreds of thousands of API calls. The proposed architecture effectively detects ransomware, making it a suitable choice for deployment as security software. The used technique exhibits resilience to attacks and facilitates swifter detection relative to traditional methods.