Early Ransomware Detection using Behavioral Analytics in Enterprise Networks

Mahak; Surjeet Dalal

doi:10.55524/ijirem.2025.12.6.12

Abstract

Ransomware is one of the greatest and fastest-changing risks to enterprise networks across the global scene. Conventional signature-based security software is becoming less effective in terms of combating growing ransomware variants, which use polymorphism, obfuscation, and fileless execution. Behavioral analytics is a stronger solution because it detects the abnormal behaviors of the system calls of user activity, file transactions, and behavior of the processes. This paper develops a multi-layered and behavior-driven ransomware detection model, which applies to an ensemble of machine learning models, including Isolation Forest, Autoencoders, and a Long Short-Term Memory (LSTM) network, to detect ransomware during its early execution phases. The model tracks such significant indicators of behavior like spikes in file entropy, unusual file access logs, intensive I/O operation and privilege escalation. As the experimental results prove, the proposed model is very accurate and is able to discover zero-day variants of ransomware in a matter of seconds, thus reducing the threat to enterprise systems greatly.

Keywords

Ransomware Detection, Behavioral Analytics, Machine learning, Anomaly Detection, Zero-Day Threat.

References

L. Harishni and C. N. Sowmyarani, “Real-Time Ransomware Detection and Response System Using Behavioural File and Process Monitoring,” International Journal of Computer Applications, vol. 182, no. 45, pp. 1–9, 2021.
A. Mohamed, A. Al-Saleh, S. K. Sharma, and G. G. Tejani, “Zero-day exploits detection with adaptive WavePCA-Autoencoder (AWPA) adaptive hybrid exploit detection network (AHEDNet),” Scientific Reports, vol. 15, no. 1, pp. 4036–4048, 2025. Available from: https://www.nature.com/articles/s41598-025-87615-2
P. Yan and T. T. Khoei, “Securing the Internet of Things: A Comprehensive Review of Ransomware Attacks, Detection, Countermeasures, and Future Prospects,” Franklin Open, vol. 1, pp. 100256, 2025. Available from: https://doi.org/10.1016/j.fraope.2025.100256
M. Rele, J. Samuel, D. Patil, and U. Krishnan, “Exploring Ransomware Detection Based on Artificial Intelligence and Machine Learning,” Procedia Computer Science, vol. 252, pp. 548–556, 2025. Available from: https://doi.org/10.1016/j.procs.2025.01.014
M. Cen, X. Deng, F. Jiang, and R. Doss, “Zero-Ran Sniff: A zero-day ransomware early detection method based on zero-shot learning,” Computers & Security, vol. 142, pp. 103849, 2024. Available from: https://doi.org/10.1016/j.cose.2024.103849
U. Urooj, B. A. S. Al-Rimy, A. Zainal, F. A. Ghaleb, and M. A. Rassam, “Ransomware Detection Using Dynamic Analysis and Machine Learning: A Survey and Research Directions,” Applied Sciences, vol. 12, no. 1, pp. 1–23, 2022. Available from: https://doi.org/10.3390/app12010172
N. Scaife, H. Carter, P. Traynor, and K. R. B. Butler, “CryptoLock: Behavior-based Ransomware Detection,” in Proc. USENIX Security Symp., 2016, pp. 1–15.
Kharraz, W. Robertson, D. Balzarotti, L. Bilge, and E. Kirda, “UNVEIL: A Stealthy Ransomware Detection System,” in Proc. NDSS, 2016, pp. 1–15.
Almashhadani, A. Anbar, H. Alomari, and M. Al-Hadhrami, “Machine Learning for Ransomware Detection,” IEEE Access, vol. 8, pp. 206–215, 2020.
Sgandurra, L. Muñoz-González, R. Mohsen, and E. C. Lupu, “Automated Behavioral Malware Analysis,” in Proc. ACM AsiaCCS, 2016, pp. 1–12.
University of Granada, “UGR’16 Dataset Documentation,” 2016. Available from: https://doi.org/10.3390/educsci15111526
Canadian Institute for Cybersecurity, “CICIDS2017 Intrusion Detection Evaluation Dataset,” 2017. Available from: https://www.unb.ca/cic/

Cites this article as

Mahak, S. Dalal, "Early Ransomware Detection using Behavioral Analytics in Enterprise Networks", International Journal of Innovative Research in Engineering and Management (IJIREM), Vol-12, Issue-6, Page No-65-72, 2025. Available from: https://doi.org/10.55524/ijirem.2025.12.6.12