Abstract-Modern crypto-ransomware can fully encrypt a user corpus in under two seconds, faster than any reactive defense can respond, and sophisticated variants are now capable of recognizing and skipping static decoy files entirely. This paper presents Hybrid R-Sentry, a host-based ransomware detection and auto-containment system for Linux endpoints that defeats both speed and evasion by combining five independent behavioral detection surfaces with kernel-level enforcement and an AI-powered threat analyst. Building on the R-Sentry deception model, the system adds four complementary layers beyond canary detection: rename and extension analysis, rolling Shannon entropy-velocity profiling, non-sequential write-offset detection for silent in-place encryption, and process lineage scoring with cryptographic binary verification against the dpkg integrity database. Canary placement itself is not static; a Markov chain repositioner continuously predicts the next directories ransomware is likely to traverse and moves decoys there before the attacker arrives. Where possible, detection is enforced directly inside the kernel: an eBPF sensor instruments five syscalls (openat, vfswrite, unlink, rename, execve), maintains a per-process behavioral score in a BPF hash map, and blocks confirmed threats inline via BPF-LSM before a single byte of user data is overwritten. When a CRITICAL threshold is reached, a tree-aware containment pipeline freezes the entire malicious process tree with SIGSTOP, captures forensic evidence, isolates outbound network traffic at the cgroup level, and terminates with SIGKILL, all within a median of 89. 2 milliseconds of detection. Each alert is then enriched by a multi-provider AI analyst (Cerebras, NVIDIA, Groq) that classifies the threat, identifies the likely MITRE ATT&CK technique, and publishes a structured narrative to a real-time SIEM dashboard. The system was evaluated across three independent axes using 840 trials against three contemporary ransomware families (Akira, Qilin, and LockBit 5. 0) and a benign corpus deliberately constructed to be adversarial. Efficacy testing across 270 trials produced perfect recall and precision of 1. 000 (95% Wilson CI 0. 969, 1. 000) with zero false positives, including against a benign workload performing genuine symmetric encryption with gpg, the strongest possible evidence that the system reads behavior rather than reacts to entropy alone. Efficiency testing revealed a two-tier detection profile: rename-based families are caught at a median of 150 milliseconds after only two files, while silent in-place encryption is caught at 1. 19 seconds and eight files, a distinction that a pooled average of 419 milliseconds would completely hide. Monitoring overhead is 1. 70 microseconds per file operation, with kernel enforcement adding only 0. 12 microseconds, a cost that manifests in the monitored workload's wall-clock time rather than the agent's CPU, a subtlety that naive measurement would miss entirely. A 450-trial ablation study with McNemar's exact test (Holm-corrected p=0. 001 across 24 contrasts) demonstrates that each of the five detection layers is the sole detector for a distinct attack behavior, providing the first statistically rigorous necessity proof for a multi-surface ransomware detector. All 840 trial records, environment specifications, simulation scripts, and audit logs are version-controlled, so every figure in this paper can be independently recomputed from source. Index Terms-ransomware detection, deception, canary files, Shannon entropy, write-offset analysis, process lineage scoring, Markov chain repositioning, eBPF, BPF-LSM, ablation study, host-based security, automated containment, AI threat analyst.
alshrouqi et al. (Sat,) studied this question.