Ransomware File Behavioural Analysis Using Machine Learning

Abstract—Ransomware has become one of the most harmful types of malware because it can quickly encrypt important data and stop businesses from run- ning. Traditional methods of detecting ransomware by looking for its signature often don’t work on new or hidden versions of the malware. This is why behavior-based analysis is needed. This study looks at the behavior of ransomware files by looking at the actions they take while they are running instead of the static code features. Some of the key behaviors looked at are strange file system access, quick file encryption patterns, unauthorized privilege escalation, changes to the registry, and suspicious process and network activity. By keeping an eye on these behaviors while the program is running, it is possible to find ransomware early on, even if it uses polymorphism or zero-day techniques. The suggested method for behavioral analysis is better at finding things and less likely to be fooled than traditional methods. The significance of behavioral indicators in contemporary cybersecurity defense systems is highlighted by experimental results, which show that they offer a solid basis for real-time ransomware detection and mitigation. Index Terms—Ransomware, Behavioral Analysis, Machine Learning, File Entropy, Random Forest, Malware Detection