A Cyber-Security Framework for Behavior-Driven Ransomware Detection Using Graph Neural Networks on System Call Dependency Traces

Ransomware has remained among the worst types of cyber security threats, and the contemporary types have been changing polymorphism, dynamism in delivery of payloads, and evasion mechanisms rendering the conventional signature based defenses futile. Most of the currently used detection systems rely on the static feature or linear sequence model, which is not a complete reflection of the sophisticated behavioral patterns of system call interactions. To address such constraints, this paper presents a new framework of cyber security-related behavioral ransomware detection based on Graph Neural Networks on system call dependency traces. The suggested approach builds elaborated dependency graphs that reflect on time-dependence, causal transitions and co-occurrence between system calls. These graphs do not lose the structure and behavioral features between ransomware activity and the normal functioning of systems. It has an adaptive Graph Neural Network architecture to learn higher level graph features, with a reduced impact on sparse traces, noisy traces, or on purpose obfuscated traces. The framework uses behavior scoring, augmentation of graphs, multi stage dependency fusion to enhance the resilience of the detection model to adversarial manipulation and zero day ransomware variants. Recent ransomware datasets demonstrate consistent improvements on the accuracy, early detection, and generalization compared to the traditional machine learning models and deep sequence based models in experimental evaluation. The findings validate that the representation of next generation ransomware defense is an effective and scalable platform that can be modeled with system call dependencies in the form of graph structures and GNN based learning.