Anomaly-Aware Ransomware Detection Through Integrated Ensemble Learning and Dimensionality Reduction

Ransomware has become a growing cyber threat that exploits vulnerabilities in current security protocols, challenging the effectiveness of traditional detection methods. This research provides a comprehensive analysis of the issue, exploring recent advances in machine learning—particularly models like Random Forest, XGBoost, and LightGBM—to enhance the detection of ransomware attacks. These models are employed to improve the system's ability to accurately identify ransomware during its early stages. Key techniques include feature analysis, data balancing using SMOTE (Synthetic Minority Over-sampling Technique), and dimensionality reduction using PCA (Principal Component Analysis), all of which contribute to enhancing the overall efficiency and performance of the detection process. Additionally, this study integrates behavioral analysis and anomaly detection to identify suspicious activities and unusual system behavior that may indicate a ransomware attack. These findings emphasize the critical role of machine learning in increasing detection accuracy, expanding coverage, and minimizing false positives. The research establishes a solid foundation for building robust, real-time defense systems against ransomware, suitable for deployment in increasingly complex and dynamic environments. Random Forest performed best with 97.5% accuracy and an F1 Score of 97.56. XGBoost and LightGBM also gave strong results, with F1 Scores of 96.62 and 96.12. Logistic Regression scored lowest (F1 Score: 79.4%), showing weaker performance. Ensemble models are effective for real-time ransomware detection systems.