Abstract Ransomware threats are growing in frequency and severity, posing significant challenges to cybersecurity defences. Machine learning (ML) has gained attention as a promising tool for detecting ransomware, but the lack of realistic ransomware datasets for training and evaluating ML models has limited progress. This paper introduces RADAR, a comprehensive dataset designed to address this challenge and advance ransomware detection. With over 400,000 system events from seven prominent ransomware families and benign activities, RADAR overcomes the limitations of existing datasets that rely on outdated samples and fail to capture the evolving nature of ransomware. RADAR is structured as a continuous stream of system events and incorporates realistic scenarios, including data drift and class imbalance. The dataset features 48 attributes extracted from Sysmon logs and 19 additional engineered features to improve the analysis of behavioural patterns. By simulating data drift and reflecting the minority-class nature of ransomware, RADAR provides a realistic environment for evaluating ML models in conditions that replicate real-world operations. The utility of RADAR is demonstrated through an experimental framework using an adaptive random forest algorithm in an online incremental learning setting. The results underscore the importance of continually adapting detection methods to effectively address evolving ransomware threats. This research lays a solid foundation for improving ML algorithms and fostering innovative methods for real-time ransomware detection.
Ispahany et al. (Thu,) studied this question.