Implementation of Ransomware Threat Detection Using Behavior-Based Detection Algorithm

Abstract

Ransomware threats continue to evade traditional signature-based security strategies, particularly when exploiting zero-day attacks, polymorphic methods, and code obfuscation. Rather than relying on static file analysis, the system continuously manages runtime process behavior by analyzing key indicators of ransomware operation, including file encryption rates, mass file renaming, entropy fluctuations, registry modifications, and network connections. This dynamic behavioral analysis enables the timely identification of malicious activities, consequently enhancing the system's capability to recognize ransomware threats in real time. The identification engine was implemented using React and TypeScript and uses a configurable, weighted rule-based scoring strategy to classify running processes as either malicious. During simulated assessments involving well-known ransomware families, including WannaCry, LockBit3, and Ryuk, the application efficiently differentiated malicious processes from legitimate ones, delivering a identification accuracy of 88.9% while maintaining a low false-positive rate. In addition, the proposed solution indicated real-time responsiveness, with an average event update latency of approximately 360 milliseconds. The experimental results show that the behavior-based identification methods generates more effective coverage against novel, polymorphic, and fileless ransomware threats than conventional signature-based identification approaches. Based on these results, it is suggested that the behavioral identification engine be combined into Endpoint Identification and Response (EDR) platforms to promote intelligent threat containment, increase incident response, and reduce the danger of data loss.