EvoNorm-GAN for Adaptive and Interpretable Detection of Ransomware in Windows PE Files

Abstract

Ransomware remains a key cybersecurity issue because of its growing amount of obfuscation, polymorphism, and constantly changing patterns of attack that repeatedly circumvent conventional defenses. Traditional systems and standard deep learning may fail, lowering accuracy andincreasing false positives. To address these shortcomings, the proposed work proposes EvoNorm-GAN, a dynamic adversarial-based detection architecture that will incorporate Feature-Wise Dynamic Normalization (FDN) and Generative Adversarial Network to analyze ransomware inWindows Portable Executable (PE) files in a very flexible manner. Generator creates ransomware variants; discriminator classifies files using Wasserstein loss. EvoNorm-GAN is a TensorFlow application, using the Keras back-end, and tested on a large-scale Windows PE File Analysis Dataset of 62, 200 samples, with 31, 100 benign and 31, 100 malicious examples. The experimental findings indicate that EvoNorm-GAN has the state-of-the-art results of 98.2% accuracy, 98.4% precision, 98.1% recall, 97.4% F1-score, and 0.99 AUC, which are about 1 to 3 percent higher than the traditional CNN, RNN, and ensemble-based models. To enhance transparency and trust, SHAP-based explainable AI is integrated into EvoNorm-GAN, highlighting key PE file features such as Section Entropy and SizeOfCode that drive classification decisions. By combining adaptive learning, adversarial sample generation, and analyst-friendly interpretability into a unified framework, EvoNorm-GAN delivers an efficient, robust, and transparent ransomware detection system. Its scalable and resilient design makes it well-suited for real-world deployment in endpoint protection and cybersecurity environments, providing reliable detection of evolving ransomware threats.