RansomGuard: a framework for proactive detection and mitigation of cryptographic windows ransomware

Ransomware, a widespread form of malware, has caused significant damage to enterprises and individuals. By encrypting the victims’ system resources and demanding a ransom to decrypt these, it aims to get financial gain. High-profile ransomware attacks possess the potential to devastate businesses, disrupt critical infrastructure, compromise sensitive data, and pose significant threats to human lives. In this research an innovative framework RansomGuard is proposed, which utilizes a static detector as well as a dynamic machine learning component to analyze events captured and gathered directly from the Windows kernel. RansomGuard utilizes Event Tracing for Windows (ETW) logs from Windows kernel providers to establish correlations in file access patterns and system processes, allowing it to pinpoint potentially malicious activities. It incorporates entropy analysis to detect potential file encryption for swift attack identification, thereby enhancing the overall security posture of Windows systems. To assess its effectiveness, the proposed framework was rigorously evaluated against 22 distinct ransomware families and the trained model was able to successfully detect even unknown ransomware strains that were not part of its initial training dataset. Experimental results demonstrate the robustness and adaptability of the proposed RansomGuard framework that achieved up to 99.87% accuracy while maintaining an exceptionally low false positive rate and is effective in combating various ransomware threats.