Dynamic Ransomware Detection Using Time-Based API

Abstract Ransomware attacks are increasingly sophisticated, evading traditional signature-based detection. This study proposes a machine learning approach using API call data to analyze dynamic program behavior. A Random Forest classifier processes features from temporal intervals, API call frequencies, and sequential patterns to distinguish ransomware from benign software. The model achieves over 95% accuracy by capturing behavioral dynamics rather than static signatures, making it resilient against obfuscation techniques. Integrated into a Flask-based web application, it enables real-time, interactive detection. Key strengths include scalability, handling high-dimensional data, and ensemble learning robustness. By focusing on behavioral analysis, this approach effectively identifies evolving ransomware variants, offering cybersecurity professionals a practical, automated tool for early threat detection and mitigation.