AI-Driven Forensics Framework for Reliable Detection of Ransomware

Abstract

Ransomware is a significant cybersecurity risk that keeps increasing and threats like the WannaCry keep showing the need to be more intelligent and adaptive in detection methods. This paper presents DeepRansom, a powerful deep learning model that has been designed to detect WannaCry ransomware in complex malware environments with high precision and in a transparent manner. The architecture combines the feature selection of TabNet and the learning context of the FT-Transformer to create a dual-model architecture that can provide performance and interpretability. DeepRansom was trained and tested on a broad dataset of 21,752 samples of 26 malware families with 11 key ransomware variants. The proposed model reformulates WannaCry recognition as a binary classification task and delivers better results than the classical algorithms including Random Forest, SVM, and XGBoost among other deep learning baselines. The experiments have proven accuracy of 99.82%, precision of 97.89%, recall of 93.94% and AUC of 0.99% with strong generalization and low false positives. In addition, the SHAP-based analysis of interpretability shows that the predictions obtained by DeepRansom are based on the appropriate behavioral and structural predictors, which supports the idea of its implementation in the practice of network forensics and threat intelligence missions.