Intelligent Ransomware Detection Using Behavioral Analytics and Hybrid Machine Learning Classification Techniques

Abstract

Ransomware is a rapidly evolving cyber threat that exploits legitimate file-system operations, process execution, and network communication to encrypt or exfiltrate organizational information. This paper proposes a behavior-centric hybrid machine learning framework that combines gradient-boosted decision trees with temporal sequence modeling to identify ransomware activity from short windows of endpoint telemetry. The architecture integrates event collection, process-level correlation, feature engineering, temporal classification, probability calibration, and risk-aware alerting. Particular attention is given to preventing label leakage, evaluating unseen ransomware families, and controlling false alarms under realistic workload shifts. An explicitly illustrative numerical case study is provided to demonstrate the reporting protocol, including confusion matrices, detection metrics, latency, and ablation analysis; the values are not claimed to be obtained from an executed experiment. The proposed design offers a reproducible research blueprint for subsequent empirical validation with safely collected benign and ransomware traces.