Early Ransomware Detection using Behavioral Analytics in Enterprise Networks

Abstract

Ransomware is one of the greatest and fastest-changing risks to enterprise networks across the global scene. Conventional signature-based security software is becoming less effective in terms of combating growing ransomware variants, which use polymorphism, obfuscation, and fileless execution. Behavioral analytics is a stronger solution because it detects the abnormal behaviors of the system calls of user activity, file transactions, and behavior of the processes. This paper develops a multi-layered and behavior-driven ransomware detection model, which applies to an ensemble of machine learning models, including Isolation Forest, Autoencoders, and a Long Short-Term Memory (LSTM) network, to detect ransomware during its early execution phases. The model tracks such significant indicators of behavior like spikes in file entropy, unusual file access logs, intensive I/O operation and privilege escalation. As the experimental results prove, the proposed model is very accurate and is able to discover zero-day variants of ransomware in a matter of seconds, thus reducing the threat to enterprise systems greatly.