AI-Driven Forensics Framework for Reliable Detection of Ransomware
Article content
Abstract
Ransomware is a significant cybersecurity risk that keeps increasing and threats like the WannaCry keep showing the need to be more intelligent and adaptive in detection methods. This paper presents DeepRansom, a powerful deep learning model that has been designed to detect WannaCry ransomware in complex malware environments with high precision and in a transparent manner. The architecture combines the feature selection of TabNet and the learning context of the FT-Transformer to create a dual-model architecture that can provide performance and interpretability. DeepRansom was trained and tested on a broad dataset of 21,752 samples of 26 malware families with 11 key ransomware variants. The proposed model reformulates WannaCry recognition as a binary classification task and delivers better results than the classical algorithms including Random Forest, SVM, and XGBoost among other deep learning baselines. The experiments have proven accuracy of 99.82%, precision of 97.89%, recall of 93.94% and AUC of 0.99% with strong generalization and low false positives. In addition, the SHAP-based analysis of interpretability shows that the predictions obtained by DeepRansom are based on the appropriate behavioral and structural predictors, which supports the idea of its implementation in the practice of network forensics and threat intelligence missions.
Keywords
Cybersecurity, Deep Learning, FT-Transformer, Network Forensics, WannaCry Ransomware, forensic sciences
Downloads
References
Karim N. Comprehensive Analysis of Ransomware Evolution and Countermeasures in the Era of Digital Transformation. Int J Adv Cybersecurity Syst Technol Appl. 2024;8(12):20-30.
Irwin AS, Dawson C. Following the cyber money trail: Global challenges when investigating ransomware attacks and how regulation can help. J Money Laund Control. 2019;22(1):110-131.
Lang M, Connolly L, Taylor P, Corner PJ. The evolving menace of ransomware: A comparative analysis of pre-pandemic and mid-pandemic attacks. Digit Threats Res Pract. 2023;4(4):1-22.
Akbanov M, Vassilakis VG, Logothetis MD. WannaCry ransomware: Analysis of infection, persistence, recovery prevention and propagation mechanisms. J Telecommun Inf Technol. 2019;(1):113-124.
Mohurle S, Patil M. A brief study of WannaCry threat: Ransomware attack 2017. Int J Adv Res Comput Sci. 2017;8(5):1938-1940.
Kalinaki K. Ransomware Threat Mitigation Strategies for Protecting Critical Infrastructure Assets. In: Ransomware Evolution. CRC Press; 2025. p.120-143.
Gómez Hernández JA, García Teodoro P, Magán Carrión R, Rodríguez Gómez R. Crypto-ransomware: A revision of the state of the art, advances and challenges. Electronics. 2023;12(21):4494.
Mazhar L, Rohatgi S. Malware Analysis and Detection: New Approaches and Techniques. In: Emerging Threats and Countermeasures in Cybersecurity. 2025. p.83-109.
Kang Q, Gu Y. A survey on ransomware threats: Contrasting static and dynamic analysis methods. 2023.
Okafor MO. Deep learning in cybersecurity: Enhancing threat detection and response. 2024.
Lu G, Liu Y, Chen Y, Zhang C, Gao Y, Zhong G. A comprehensive detection approach of WannaCry: principles, rules and experiments. Proc IEEE CyberC. 2020:41-49.
Akbanov M, Vassilakis VG, Logothetis MD. Ransomware detection and mitigation using software-defined networking: The case of WannaCry. Comput Electr Eng. 2019;76:111-121.
Shaukat K, Luo S, Varadharajan V. A novel deep learning-based approach for malware detection. Eng Appl Artif Intell. 2023;122:106030.
Aboaoja FA, Zainal A, Ghaleb FA, Al-Rimy BAS, Eisa TAE, Elnour AAH. Malware detection issues, challenges, and future directions: A survey. Appl Sci. 2022;12(17):8482.
Tayyab UEH, Khan FB, Durad MH, Khan A, Lee YS. A survey of the recent trends in deep learning based malware detection. J Cybersecurity Priv. 2022;2(4):800-829.
Rathore H, Agarwal S, Sahay SK, Sewak M. Malware detection using machine learning and deep learning. Int Conf Big Data Anal. 2018:402-411.
LaRocque A, Gross G, Lindholm F, Greco P, Dupont B, Kruger J. Effective ransomware detection using autonomous patternbased signature extraction. 2024.
Redhu A, Choudhary P, Srinivasan K, Das TK. Deep learning-powered malware detection in cyberspace: a contemporary review. Front Phys. 2024;12:1349463.
Stastne S, Johansson S, Laurent S, Kruger T, Fitzgerald G. Dynamic signal-based ransomware detection with temporal-pattern profiling technique. 2024.
Gyamfi NK, Goranin N, Ceponis D, Čenys HA. Automated system-level malware detection using machine learning: A comprehensive review. Appl Sci. 2023;13(21):11908.
Gorment NZ, Selamat A, Cheng LK, Krejcar O. Machine learning algorithm for malware detection: Taxonomy, current challenges, and future directions. IEEE Access. 2023;11:141045-141089.
Jeon S, Moon J. Malware-detection method with a convolutional recurrent neural network using opcode sequences. Inf Sci. 2020;535:1-15.
Halim MA, Abdullah A, Ariffin KAZ. Recurrent neural network for malware detection. Int J Adv Soft Compu Appl. 2019;11(1):43-63.
Khammas BM. Ransomware detection using random forest technique. ICT Express. 2020;6(4):325-331.
Gajdošík A, Kotuliak I. Machine Learning and Transformers for Malware Analysis: Overview. NTSP. 2024:1-7.
Seneviratne S, Shariffdeen R, Rasnayaka S, Kasthuriarachchi N. Self-supervised vision transformers for malware detection. IEEE Access. 2022;10:103121-103135.
Manthena H, Shajarian S, Kimmell J, Abdelsalam M, Khorsandroo S, Gupta M. Explainable Malware Analysis: Concepts, Approaches and Challenges. arXiv. 2024;arXiv:2409.13723.
Faridun R, Im EG. Enhancing Malware Detection with TabNetClassifier: A SMOTE-based Approach. KIPS Conf. 2024:294-297.
Praveen SP, Bikku T, Muthukumar P, Sandeep K, Sekhar JC, Pratap VK. Enhanced Intrusion Detection Using Stacked FT-Transformer Architecture. J Cybersecurity Inf Manag. 2024;13(2).
Somvanshi S, Das S, Javed SA, Antariksa G, Hossain A. A survey on deep tabular learning. arXiv. 2024;arXiv:2410.12034.
Huang X, Khetan A, Cvitkovic M, Karnin Z. TabTransformer: Tabular data modeling using contextual embeddings. arXiv. 2020;arXiv:2012.06678.
Ambekar NG, Devi NN, Thokchom S, Yogita. TabLSTMNet: enhancing android malware classification through integrated attention and explainable AI. Microsyst Technol. 2025;31(3):695-713.
Article details
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.
You must read and accept the copyright terms and conditions(click here for copyright terms).