Detection Of Ransomware Attack Using Processor and Disk Usage Data

Abstract

The escalating frequency and sophistication of ransomware attacks pose a critical threat to organizational data integrity and global cybersecurity. Traditional signature-based detection mechanisms often struggle to identify zero-day ransomware strains that employ novel encryption techniques. This research proposes a behavioral detection framework that utilizes low-level system metrics, specifically focusing on processor (CPU) and disk I/O usage patterns. By monitoring the high-intensity read-write cycles characteristic of unauthorized file encryption, machine learning models can identify malicious activity in real-time. The methodology involves the collection of performance counter data from both benign environments and simulated ransomware infections. Features such as CPU cycle spikes, disk write frequency, and entropy changes in data buffers are extracted to train supervised learning algorithms. Models including Random Forest, Support Vector Machines (SVM), and Gradient Boosted Trees are evaluated for their ability to distinguish between resource-intensive legitimate processes and encryption-heavy malware. Results indicate that analyzing the correlation between CPU utilization and disk throughput provides a high detection rate with a low false-positive overhead. Furthermore, the study explores the integration of these models into a lightweight host-based intrusion detection system (HIDS) that operates at the kernel level. This approach ensures that detection occurs early in the attack lifecycle, potentially halting the encryption process before significant data loss occurs. The findings demonstrate that hardware-centric behavioral analysis offers a robust defense layer that is agnostic to the malware's code structure. Ultimately, this research contributes to the development of more resilient, autonomous security systems capable of defending against evolving cryptographic threats. The proposed framework provides a scalable solution for real-time threat mitigation in high-stakes computing environments.