Early Ransomware Detection System Based on Network Behavior

Computer malware has been growing at a rapid way in recent years, with ransomware emerging as a particularly potent menace. Numerous victims, including companies, hospitals, and individuals, have suffered large financial losses as a result of the fast spread of ransomware. Due to the fact that they frequently rely on discovering infections, conventional techniques of ransomware detection have mostly proven ineffectual. Utilizing network behavior analysis for preemptive identification of ransomware incidents offers a more effective solution to this problem. This study examines network behavisor with an emphasis on ransomware, using Cerber ransomware as a case study to record and extract important information from infected host devices, a specialized testbed was built. Our model, which used the K-Nearest Neighbors (KNN) technique, attained a remarkable accuracy rate of 99.5%. This study represents a significant step towards preemptively identifying ransomware incidents based on network behavior analysis, offering valuable insights and potential solutions to combat this pervasive cyber threat.