RansomTrack: A Hybrid Behavioral Analysis Framework for Ransomware Detection

TL;DR

RansomTrack is a hybrid behavioral analysis framework that combines static and dynamic features to detect ransomware rapidly and accurately, providing explainability and scalability for real-time detection.

Contribution

It introduces a novel hybrid detection framework that integrates static and dynamic analysis, along with a new dataset and interpretability features, improving early ransomware detection.

Findings

Achieves up to 96% accuracy in ransomware detection.

Detects ransomware in under 9.2 seconds.

Provides high interpretability with SHAP-based feature importance.

Abstract

Ransomware poses a serious and fast-acting threat to critical systems, often encrypting files within seconds of execution. Research indicates that ransomware is the most reported cybercrime in terms of financial damage, highlighting the urgent need for early-stage detection before encryption is complete. In this paper, we present RansomTrack, a hybrid behavioral analysis framework to eliminate the limitations of using static and dynamic detection methods separately. Static features are extracted using the Radare2 sandbox, while dynamic behaviors such as memory protection changes, mutex creation, registry access and network activity are obtained using the Frida toolkit. Our dataset of 165 different ransomware and benign software families is publicly released, offering the highest family-to-sample ratio known in the literature. Experimental evaluation using machine learning models shows that ensemble classifiers such as XGBoost and Soft Voting achieve up to 96% accuracy and a ROC-AUC score of 0.99. Each sample analyzed in 9.1 seconds includes modular behavioral logging, runtime instrumentation, and SHAP-based interpretability to highlight the most influential features. Additionally, RansomTrack framework is able to detect ransomware under 9.2 seconds. Overall, RansomTrack offers a scalable, low-latency, and explainable solution for real-time ransomware detection.