Explainable AI-Based Ransomware Early Detection Using File-System Behavioral Features and Random Forest

Abstract

Ransomware is considered one of the major cybersecurity threats that has the capability to either encrypt or blocks access to organizational data. The Hacker demands compensation for recovery and identifications or prevent signature-based detection is useful, but it may fail against new variants that target by changing file names, using packed binaries, or exploit trusted system tools. The Research presented in this paper proposes to develop a method shortly referred as RF-RBD, an Artificial Intelligence-based ransomware detection model that make use of a Random Forest classifier. The model has the capability to identify ransomware like behavior by using filesystem features such as write rate, rename rate, and delete rate, entropy change, extension-change ratio, ransom-note count, shadow copy command count, and network-share access. In this study a synthetic defensive dataset is used for safe experimentation to avoid in system down time risk. The model is evaluated using parameters such as accuracy, precision, recall, F1 score, ROC-AUC, confusion matrix, and feature importance. The Experiments performed and the associated results show a strong performance on the simulated dataset, wherein a high recall is observed along with interpretable feature rankings. The paper also explores the limitations of the approach and associated ethical concerns, adversarial risks, and suggests future improvements for real system deployment.