Storage-Level Relational and Temporal Feature Learning for Ransomware Prevention

Ransomware attacks are a major and transforming danger to the contemporary computing settings that brings a lot of financial and operational losses related to encrypting important files and interfering with services. Conventional signature-based detection mechanisms are ineffective in detecting new or zero-day ransomware as they use static signs. To overcome this obstacle, this study suggests a new behavior-aware hybrid artificial intelligence framework to detect ransomware in its early stages that uses the access patterns in the runtime storage to identify abnormal I/O activities before the entire encryption process is completed. The RanSAP dataset captures fine-grained storage activity data, including read/write operations, logical block addressing, access sizes, and timestamps, and entropy indicators, to perform a comprehensive preprocessing pipeline, with robust scaling, sliding-window segmentation, and anomaly-based noise filtering. The main idea of advanced feature engineering is the joint utilization of both temporal and graph-based process-file interaction embeddings with ensuing two-step dimensionality reduction with autoencoders and UMAP. The hybrid system consists of relational learning based on Graph Neural Network, sequential modeling based on Temporal Transformer Encoder, prioritization of abnormal behavior based on attention mechanism, and meta-learning based on MAML to quickly adapt to zero-day ransomware. The framework is optimized using Ranger, Focal Cosine Loss, stochastic depth and LARS, the results are 98.72% accuracy, 99.10% recall and 0.996 AUC. Explainable models (GNN Explainer and SHAP) give understandable results on behavioral patterns of importance. Findings indicate strong early-detection, generalization, and ability to deploy in real-time, which provide a scalable solution to proactive ransomware protection.