Enhancing Cyber Defense Strategies: A Triple-Filter Ransomware Interpretable Model (TriFRIM) for Ransomware Detection

Ransomware has emerged as a highly concerning threat today, allowing threat actors to extract substantial monetary benefits from their victims effectively via the irreversible encryption of digital resources. The sophisticated nature of ransomware threats and the rapid growth of its profitability as an organized crime has made it an extraordinarily challenging threat to counteract. Although some traditional strategies have demonstrated notable effectiveness when counteracting ransomware threats that continue to evolve, some significant gaps and challenges remain to be addressed. Therefore, this paper proposes a model based on the triple layer of ransomware features, including the signature, network traffic, and behavioral features of ransomware, further enhanced by integrating machine learning technology. This paper further presents brief insights into the proposed conceptual model, its expected outcomes, and future research directions.