Detection of Ransomware Attacks Using Processor and Disk Usage Data

Abstract

Ransomware attacks have caused massive financial losses globally by evading traditional antivirus mechanisms and encrypting system data, demanding ransom for decryption. Existing monitoring techniques often degrade system performance and yield suboptimal detection accuracy. This study proposes a novel approach using VMware to extract Hardware Performance Counters (HPC) and IO Events without affecting system performance. These features are then analyzed using machine learning algorithms—SVM, KNN, Decision Tree, Random Forest, and XGBoost—and deep learning models—DNN and LSTM—to classify program behavior as benign or ransomware. The integrated dataset, sourced from common programs, enabled training and evaluation, with Random Forest and XGBoost achieving up to 98% accuracy. The results demonstrate the effectiveness of HPC and IO data for accurate, low-impact ransomware detection.