RansomGuard AI: An AI-Powered Ransomware Detection and Storage Protection System

Ransomware continues to pose a severe threat to data availability by executing unauthorized encryption, rapid file alterations, and malicious extension changes across local file storage.This paper introduces RansomGuard AI, an integrated defense-in-depth storage surveillance and recovery system designed to monitor filesystem events, analyze behavioral risk indicators, and maintain cryptographically verified snapshot recovery points.Operating on a Python FastAPI backend paired with a reactive web dashboard, the framework continuously evaluates filesystem activity against key telemetry signals: modification rates, burst write frequencies, Shannon entropy shifts, and file extension mutations.To guarantee disaster recovery without relying on compromised storage, recovery copies are secured using immutable SHA-256 manifest checkpoints.The system includes a sandboxed synthetic attack simulator that reproduces ransomwarelike behaviors inside an isolated environment, demonstrating complete monitoring, detection, audit logging, and pointin-time recovery workflows without exposing the host OS to live malware.