Ransomware Detection with a 2-Tier Machine Learning Approach Using a Novel Clustering Algorithm

Abstract Ransomware poses a significant threat to cybersecurity, causing extensive financial and operational damage by encrypting critical data and demanding ransom for its release. The proposed novel two-tier machine learning approach significantly enhances ransomware detection through the integration of network and file system activities, providing a comprehensive view of system behaviors and improving detection accuracy. Initial clustering of network activities followed through by a refined analysis of file system data enables the identification of complex ransomware patterns. Extensive experimentation has demonstrated that this approach outperforms existing methods, achieving higher precision, recall, and overall accuracy while maintaining scalability and robustness. The research highlights the importance of leveraging diverse data sources and advanced machine learning techniques to create more resilient and effective cybersecurity defenses. The findings demonstrate the potential for practical applications in real-world scenarios, offering a significant advancement in the fight against ransomware and contributing to the protection of critical organizational assets.