RansomTrack: A Hybrid Behavioral Analysis Framework for Ransomware Detection
2026-04-09 • Cryptography and Security
Cryptography and SecurityMachine Learning
AI summaryⓘ
The authors developed RansomTrack, a system that detects ransomware quickly by combining two types of analysis: static (looking at the code without running it) and dynamic (watching what the program does when running). They used tools to gather features from both methods and created a large dataset of ransomware and safe programs for testing. Their method can identify ransomware with high accuracy in about 9 seconds and explains which behaviors are most important for detection. This approach helps catch ransomware early before it can do damage.
ransomwarestatic analysisdynamic analysismachine learningXGBoostbehavioral analysisruntime instrumentationSHAP interpretabilitydatasetcybersecurity
Authors
Busra Caliskan, Ibrahim Gulatas, H. Hakan Kilinc, A. Halim Zaim
Abstract
Ransomware poses a serious and fast-acting threat to critical systems, often encrypting files within seconds of execution. Research indicates that ransomware is the most reported cybercrime in terms of financial damage, highlighting the urgent need for early-stage detection before encryption is complete. In this paper, we present RansomTrack, a hybrid behavioral analysis framework to eliminate the limitations of using static and dynamic detection methods separately. Static features are extracted using the Radare2 sandbox, while dynamic behaviors such as memory protection changes, mutex creation, registry access and network activity are obtained using the Frida toolkit. Our dataset of 165 different ransomware and benign software families is publicly released, offering the highest family-to-sample ratio known in the literature. Experimental evaluation using machine learning models shows that ensemble classifiers such as XGBoost and Soft Voting achieve up to 96% accuracy and a ROC-AUC score of 0.99. Each sample analyzed in 9.1 seconds includes modular behavioral logging, runtime instrumentation, and SHAP-based interpretability to highlight the most influential features. Additionally, RansomTrack framework is able to detect ransomware under 9.2 seconds. Overall, RansomTrack offers a scalable, low-latency, and explainable solution for real-time ransomware detection.