Behavioral analysis of ransomware threats to ESXi Hypervisors: a machine learning-based predictive model

In today’s virtualized world, ransomware threats to ESXi hypervisor are a significant and growing concern. Factors include lack of dedicated security tools, an expanding attack surface targeting virtualization infrastructure, the use of data encryption by attackers, and exploitation of known vulnerabilities. Evaluating the ESXi hypervisor is critical for security, performance, and cost efficiency. This paper leverages application of artificial intelligence, specifically machine learning, to assess ransomware threats. The experimental methodology applied in this paper leverages ESXi logs to construct a sample dataset containing 5,000 labeled instances of observed attack outcomes across seven features, including vm_shutdowns, snapshot_deletions, high_entropy_files, shell_command_count, failed_login_attempts, suspicious_port_access, and data_exfil_volume. These features are used to train a model to enhance operational efficiency and maintain a robust virtualized environment.