Int J Performability Eng ›› 2025, Vol. 21 ›› Issue (11): 639-650.doi: 10.23940/ijpe.25.11.p4.639650

Previous Articles     Next Articles

Real-Time Behavioral Analysis for Ransomware Response: A Framework Leveraging Machine Learning and Threat Intelligence Feeds

Puneet Chauhan* and Shashiraj Teotia   

  1. Department of Computer Application, Swami Vivekanand Subharti University, Meerut, India
  • Submitted on ; Revised on ; Accepted on
  • Contact: * E-mail address: puneet.chauhan@withsecure.com

Abstract: Ransomware represents a critical and evolving threat to global cyber security, employing advanced dropout techniques that make traditional signature-based defenses ineffective. This article proposes a new structure for real-time behavioral analysis to respond to ransomware (R2BAR), which integrates machine learning with threat intelligence feeds to allow proactive detection and automated mitigation. The structure employs a set approach, combining a light gradient increase model (XGBoost) for an efficient initial screening and a short-term memory network (LSTM) for deep sequential analysis of API call patterns. It increases detection accuracy by dynamically correlating behavior with real-time threat intelligence. A critical innovation is the incorporation of an AI (XAI) component using Shape values, which generates transparent justifications for detection decisions, promoting confidence and allowing effective human supervision. Experimental evaluation shows that the structure reaches a 98.1% score and an area under the ROC curve of 0.998, maintaining a low of 2.35 seconds of response time (TTR), effectively interrupting encryption before significant data loss occurs. The results validate that the proposed solution addresses the main limitations of existing methods, balancing high accuracy, operational speed and interpretability, and providing a robust plan for next-generation autonomous ransomware defense systems.

Key words: ransomware detection, behavioral analysis, machine learning, threat intelligence, real-time response