A Robust System for Ransomware Detection Using Temporal Behavior Modeling
Grant Welderman, Ruben Castellanos, Ambrose Whitacre, Frederico Montague, Joaquin Starck · 2024
The proliferation of ransomware as a prominent cyber threat has necessitated advancements in detection methodologies capable of recognizing complex, time-based behavioral patterns indicative of ransomware activities. Temporal Behavior Modeling (TBM) has emerged as a promising framework designed to capture ransomware's unique temporal characteristics, distinguishing it from other forms of malicious software through the analysis of sequential actions that unfold over time. Unlike traditional static or signature-based models, TBM leverages temporal analysis to detect behavioral progressions typical of ransomware, such as encryption timing and access irregularities, allowing for precise threat identification despite code obfuscation or structural alterations. The study introduces an innovative TBM framework, details its architecture, and demonstrates its capability to achieve higher accuracy, reduced false positives, and lower detection latency compared to behavior-based and signature-based models. Extensive experimental results illustrate TBM's robustness under various obfuscation techniques and its scalability across diverse ransomware families, providing insights into its adaptability in real-time cybersecurity environments. The findings emphasize the significance of temporal analysis in ransomware detection, establishing TBM as a foundational approach that strengthens defenses against sophisticated ransomware tactics and offers a scalable solution for ongoing security challenges.