Highlights RansomTrack: A Hybrid Behavioral Analysis Framework for Ransomware Detection BUSRA CALISKAN, IBRAHIM GULATAS, H. HAKAN KILINC, A. HALIM ZAIM • A hybrid ransomware detection framework called RansomTrack using static and dynamic behavioral features. • RansomTrack enables low latency ransomware detection below 9.2 seconds by using Frida and Radare2. • RansomTrack offers SHAP-based interpretability to highlight indicators of critical behavior.
arXiv:2604.08739v1 [cs.CR] 9 Apr 2026
• The public dataset includes 165 ransomware families and 2410 samples.
RansomTrack: A Hybrid Behavioral Analysis Framework for Ransomware Detection⋆,⋆⋆ BUSRA CALISKANa,c,∗ , IBRAHIM GULATASb,∗∗ , H. HAKAN KILINCc and A. HALIM ZAIMa a Department of Computer Engineering, Istanbul Technical University, Istanbul, Türkiye b Department of Research and Development, Turkish Naval Forces, Istanbul, Türkiye c Department of Research and Development, Orion Innovation, Istanbul, Türkiye
ARTICLE INFO
ABSTRACT
Keywords: Ransomware Detection Static Analysis Dynamic Analysis Behavior Analysis Hybrid Model Pearson Correlation
Ransomware poses a serious and fast-acting threat to critical systems, often encrypting files within seconds of execution. Research indicates that ransomware is the most reported cybercrime in terms of financial damage, highlighting the urgent need for early-stage detection before encryption is complete. In this paper, we present RansomTrack, a hybrid behavioral analysis framework to eliminate the limitations of using static and dynamic detection methods separately. Static features are extracted using the Radare2 sandbox, while dynamic behaviors such as memory protection changes, mutex creation, registry access and network activity are obtained using the Frida toolkit. Our dataset of 165 different ransomware and benign software families is publicly released, offering the highest familyto-sample ratio known in the literature. Experimental evaluation using machine learning models shows that ensemble classifiers such as XGBoost and Soft Voting achieve up to 96% accuracy and a ROC-AUC score of 0.99. Each sample analyzed in 9.1 seconds includes modular behavioral logging, runtime instrumentation, and SHAP-based interpretability to highlight the most influential features. Additionally, RansomTrack framework is able to detect ransomware under 9.2 seconds. Overall, RansomTrack offers a scalable, low-latency, and explainable solution for real-time ransomware detection.
1. Introduction Ransomware has emerged as one of the most critical cybersecurity threats due to its ability to rapidly encrypt data, disrupt essential services, and demand payment in exchange for decryption. Since the appearance of the first known ransomware, AIDS Trojan, in 1989, the frequency and impact of ransomware attacks have escalated significantly, especially after 2020. Recent high-profile ransomware incidents have demonstrated the disruptive and costly nature of such attacks across various critical sectors. For instance, the 2021 Colonial Pipeline attack caused a six-day disruption in fuel delivery across the U.S. East Coast [5], while the Kaseya supplychain attack affected approximately 1,500 organizations and involved a 70 million dollar ransom demand—the highest publicly disclosed to date [11]. In the healthcare sector, Ireland’s Health Service Executive canceled over 200,000 medical appointments and incurred more than 100 million ⋆
This study was supported in part by the Scientific Research Projects Department of Istanbul Technical University (Project ID Number: 45437 and Project Code: MAB-2024-45437) and EUREKA cluster ITEA project VESTA which is also supported by TUBITAK (The Scientific and Technological Research Council of Türkiye). ⋆⋆ All of the codes developed for this project and the collected RansomTrack dataset are published in our Github Repository. https://github.com /bcandroid/A-Hybrid-Behavioral-Analysis-Dataset-for-Ransomware-and-B enignware-Detection ∗ Principal Corresponding author
∗∗ Corresponding author
[email protected] (B. CALISKAN); [email protected] (I. GULATAS); [email protected] (H.H. KILINC); [email protected] (A.H. ZAIM) ORCID (s): 0009-0006-2595-4873 (B. CALISKAN); 0000-0002-0804-3588 (I. GULATAS); 0000-0001-6610-6324 (H.H. KILINC); 0000-0002-0233-064X (A.H. ZAIM)
Caliskan B. et al.: Preprint submitted to Elsevier
euros in damages due to a Conti infection [44]. In 2022, Costa Rica declared a national emergency after 27 government agencies were disabled by ransomware, prompting 25 million dollars in aid from the United States [20]. According to the FBI’s Internet Crime Complaint Center (IC3) 2024 report, there were 3,156 ransomware complaints in that year—a 9% increase over 2023—with total reported losses reaching 12.47 million dollars [17]. These developments emphasize the urgency of designing low-latency, resilient detection mechanisms against increasingly evasive ransomware. Another notable aspect is that the Windows operating systems are prime targets for ransomware campaigns due to their widespread use, rich API surface, and architectural complexity. Threat intelligence reports indicate that more than 90% of ransomware incidents occur on Windows platforms [48, 22]. Despite significant advancements in analysis methods, ransomware continues to challenge both static and dynamic detection techniques. • Static analysis is hindered by obfuscation, packing, and control flow manipulation In static analysis, where binaries are inspected without execution, key limitations arise due to common techniques such as obfuscation, packing, and control-flow manipulation. Many ransomware families generate large and irregular basic blocks that impair disassembly and controlflow reconstruction [30]. Obfuscation techniques such as control-flow flattening, opaque predicates, junk code insertion, and instruction substitution further degrade the accuracy of static analysis [41]. Moreover, Page 1 of 19
RansomTrack for Ransomware Detection
ransomware is frequently packed or encrypted using tools like UPX or Themida, concealing the true payload until runtime, thereby bypassing signature-based detection unless unpacking is explicitly performed [7]. • Dynamic analysis can be evaded through sandboxaware behaviors, delayed execution, or interactiontriggered payloads. Dynamic analysis, though capable of revealing runtime behavior, is equally susceptible to evasion strategies. Environment-aware ransomware variants routinely detect virtualized or sandboxed environments by probing for known registry keys, drivers, and timing discrepancies [42]. Furthermore, delayed execution techniques, including long sleep calls or busy loops, aim to exceed the analysis time window of automated sandboxes [29]. Some samples rely on user interaction triggers such as mouse movement or keyboard input, remaining dormant until such events are observed, effectively bypassing fully automated dynamic analysis systems [34].
1.1. Motivation These evasive strategies render many single-modality solutions ineffective. Ransomware actively employs antianalysis mechanisms to evade detection in both static and dynamic techniques. These limitations emphasize the clear need for hybrid, explainable, and real-time detection systems In this work, we present RansomTrack, a hybrid ransomware detection framework and dataset. The proposed framework uses the Radare2 [45] framework for reverse engineering and analyzing binaries to extract static features and Frida [18], a lightweight runtime instrumentation toolkit, to extract dynamic features. This combination allows for robust and repeatable profiling across various ransomware families. The key contributions of this study include: • A publicly available hybrid ransomware dataset combining opcode-level static and dynamic features, including API calls and page memory protection flags, of 165 ransomware families. • A low-latency detection pipeline (9.1 sec/sample) with real-time behavioral tracing. • Modular instrumentation using Radare2 and Frida for reproducibility and resilience. • SHAP-based interpretability to highlight the most impactful behavioral features. The remainder of this paper is organized as follows. Section 2 reviews related literature, focusing on existing analysis frameworks, tools, and datasets. Section ?? presents the proposed hybrid feature extraction pipeline and dataset construction methodology. Section 4 details the experimental setup, model configurations, and performance evaluation. Section 5 interprets the findings and compares classifier behavior. Finally, Section 6 concludes the paper and discusses future directions. Caliskan B. et al.: Preprint submitted to Elsevier
2. Related Work Ransomware detection has received considerable attention in recent years due to the increasing complexity and frequency of attacks. To address this challenge, researchers have proposed a range of analysis techniques that leverage static, dynamic and hybrid analysis paradigms, each offering complementary insights into executable behavior. Static analysis focuses on structural features such as sequences of opcode, control flow graphs and API imports without executing the binary. In contrast, dynamic analysis captures real-time runtime interactions, including API calls, memory protection changes and registry manipulations. To overcome the individual limitations of these methods, such as obfuscation resistance in static analysis or evasion tactics in dynamic environments, researchers have increasingly focused on hybrid frameworks. Hybrid frameworks have shown promising results in improving detection accuracy and resilience to evasion. In this section, prominent tools and datasets supporting these methodologies are reviewed, with an emphasis on static feature extraction (via Radare2), dynamic behavior analysis (via Frida), and hybrid frameworks and dataset building efforts in recent literature.
2.1. Static Analysis with Radare2 Among existing static analysis tools, Radare2 stands out due to its scriptability, performance, and open source accessibility. Unlike commercial tools such as IDA Pro [24], Radare2 supports large-scale batch processing and seamless automation through its Python interface r2pipe. Previous work has successfully used Radare2 for opcode extraction and control flow graph generation [35, 31, 21]. For example, [31] used Radare2 to extract blocks of opcode surrounding API calls and transform them into opcode “sentences” for BERT-based classification. Their approach achieved 99.93% accuracy without false positives, outperforming traditional n-gram and full binary models. Similarly, [21] applied Radare2 to MIPS-based IoT malware to classify opcodes into functional categories (e.g., memory, branching, logic) and achieved high accuracy with reduced feature dimensionality while preserving behavioral significance. The resulting features provided high accuracy classification (up to 99%) and reduced detection latency by a factor of 7.2×, highlighting the utility of Radare2 in resource-constrained scenarios. In the field of ransomware detection, opcode-level patterns offer important static signals such as encryption routines, control flow obfuscation, or anti-debugging techniques. The proposed framework extracts structured opcode sequences from 32-bit Windows PE files using the Radare2 tool. This method provides a feature representation that is both lightweight and informative, resistant to common evasion tactics such as API import obfuscation or PE header tampering.
2.2. Dynamic Analysis with Frida For observing malware behavior at runtime and gaining insight into system interactions that cannot be statically Page 2 of 19
RansomTrack for Ransomware Detection
inferred, the Frida toolkit stands out. Frida is a lightweight and codeable instrumentation toolkit that has been widely adopted in dynamic malware analysis due to its low overhead, cross-platform support, and real-time hook capabilities. Unlike full sandbox solutions, Frida operates at the API level, allowing precise monitoring of function calls, arguments, return values, and memory events. Recent research has demonstrated Frida’s effectiveness in catching evasive behavior. [47] investigated how advanced malware can evade Frida by detecting injected memory artifacts or restoring original function initializations, highlighting both Frida’s power and limitations in stealth analysis. [54] used Frida in their APInspector framework to monitor Windows API calls at runtime. They defined onEnter and onLeave callbacks to capture instrumentation scripts, input parameters (i.e., file paths, registry keys, IPs), and return values. These features formed the input for a hybrid model combining a Hierarchical Attention Network (HAN) for API sequences and an MLP for parameter values, achieving 97.5% accuracy. Drabent et al.[15] implemented Frida on Android ransomware to reveal obfuscated C&C traffic and injected payload logic. In another Android malware analysis, Bae et al. [4] applied Frida as part of the AMS sandbox system to dynamically manipulate application behavior and avoid emulation-based detection. Frida is used to modify runtime values such as IMEI and IMSI to emulate real devices. In our framework, Frida is used to monitor dynamic behavioral indicators related to ransomware execution, including memory protection changes, mutex creation, registry changes, file operations, and network activity. By injecting custom JavaScript hooks into 32-bit Windows PE processes, our solution captures detailed behavioral logs in real-time while maintaining low execution latency. This enables earlystage ransomware detection before encryption routines are fully executed.
2.3. Framework and Dataset Landscape In this section, we will review the prominent works in ransomware detection and especially the datasets they use and present a comparison with our work. The development of robust ransomware detection systems is highly dependent on the availability of high-quality datasets that capture a variety of malware behaviors. The existing public datasets differ in terms of feature types (static, dynamic or hybrid), data collection strategies and ransomware family coverage. One prominent hybrid framework is the RansomFormer framework [3], which integrates raw static byte streams and API import tables with dynamic API call sequences extracted from ransomware and benignware PE files using the Cuckoo Sandbox. Their dual-stream Transformer-based architecture achieves high classification performance—99.25% with static features alone and 99.50% when hybrid inputs are fused via a cross-attention mechanism. The dataset used to test the framework covers 161 ransomware families and is widely used in multimodal malware detection studies. Caliskan B. et al.: Preprint submitted to Elsevier
However, several limitations exist: the raw binaries are not shared, static features are susceptible to packing and obfuscation, dynamic traces can be evaded by sandbox-aware or time-delayed malware, the hybrid subset is relatively small due to execution constraints, and the dataset lacks evaluation against adversarial threats such as API padding or poisoning attacks. Another noteworthy dataset is RanSMAP [26], which is designed to capture low-level behavioral signals by tracing both memory and storage access patterns at the hypervisor level. Unlike traditional OS-level datasets that rely on API calls or system logs, RanSMAP leverages BitVisor to record fine-grained memory page events and disk sector I/O, thereby enabling robust ransomware detection even under API obfuscation or sandbox-evasion techniques. The dataset includes over 11,000 trace files derived from multiple hardware configurations and execution contexts, covering six ransomware families and several benign utilities. Its key contribution lies in bypassing semantic obfuscation by operating below the OS layer, while offering a reproducible benchmark for deep learning-based analysis. However, its use of low-level features introduces a semantic gap, lacks process-level context, and imposes deployment challenges due to the need for bare-metal hypervisor instrumentation. Dib et al. [14] created a dataset from scratch and built machine learning models using eight different algorithms for ransomware/benignware system calls. The dataset contains dynamic behavioral traces collected from 270 ransomware and 270 benign samples executed in a controlled Windows 10 environment. The dataset covers 12 ransomware families, including CryptoLocker, Petya, and TeslaCrypt. API/system calls were monitored via API Monitor during manual execution, with INetSim used to simulate internet activity.To overcome the bias of conventional feature selection pipelines that often favor benignware activity, the authors propose a hybrid strategy combining Spearman and Kendall correlation filtering, Permutation Feature Importance (PFI), and a TF-IDF-inspired method called FICFR (Feature Importance based on Call Frequency and References). This approach effectively highlights ransomwarespecific system calls.The best-performing model, a MultiLayer Perceptron (MLP), achieved high scores using only 16 selected features—demonstrating high performance with low-dimensional input.Limitations include challenges in capturing live ransomware behaviors due to inactive C2 servers and the computational overhead of correlation-based feature evaluation on large dimensions. In the study by Herrera-Silva and Hernández-Álvarez [23], a dataset was produced and analyzed through 4 different models using this dataset. This dataset called the Dynamic Feature Dataset comprises 2,000 instances extracted from Cuckoo sandbox reports, executed across five Windows versions. From over 326 raw behavioral features, the authors selected the top 50 most relevant indicators (e.g., encryption behavior, API misuse, service creation) using correlation analysis. The dataset supports reproducibility and variant-resilient ML detection. However, it excludes Page 3 of 19
RansomTrack for Ransomware Detection Table 1 Summary of the Ransomware and Benignware Datasets Aspect
RansomTrack (2025)
RansomFormer (2024) [3]
RanSMAP (2024) [26]
Ransomware / Benignware System Calls (2023) [14] Dynamic only: System calls
Dynamic Feature Dataset (2022) [23]
RanSAP (2021) [25]
CICAndMal2017 (2017) [32]
Feature Types
Hybrid (Static + Dynamic)
Hybrid (Static + Dynamic)
Static Features
Opcodes
Static Feature Tools Dynamic Features
Radare2
Raw PE byte sequences, Imported API functions pefile Python module
Dynamic only: Memory and Storage Not included
Dynamic only: Behavioral features
Hybrid (APK + Network behavior)
Not included
Not included
Dynamic only: Storage I/O patterns Not included
Not applicable
Not applicable
Not applicable
Not applicable
Memory access patterns, Storage sector ops BitVisor Hypervisor, UDP logging
System call traces
File ops, API usage, Registry, Services
API Monitor (manual execution)
Cuckoo (JSON), Feature pipeline
Disk sector traces, Time-series I/O Custom hypervisor tracer, Disk I/O monitor Windows 10, .exe files
API Calls and Page Protection Flags
API call sequences
Dynamic Collection Tools
Frida
Cuckoo Sandbox 3
Operating System and File Types Execution Environment
Win 10 Pro 32-Bit, .exe files
Win 7/8/10/11,.exe files Cuckoo-based sandbox VMs
Windows 10,.exe files
Windows 10 32-bit, .exe files
Win XP/7/10, .exe files
Bare-metal w/ BitVisor
Manual VM exec w/ INetSim
Cuckoo sandbox (5 platforms)
Sample Sources
Ransomware: MalwareBazaar [1], [38]; Benignware: [38], [28], [8] 1205 ransomware and benignware
VirusTotal, MalwareBazaar, VirusShare
ANY.RUN, VirusTotal, real apps
AnyRun, VirusShare, HybridAnalysis, MajorGeeks
VirusTotal, HybridAnalysis, TheZoo
2,000 ransomware and benignware
6 ransomware, 6 benign, 7 variants
270 ransomware, 270 benign
Ransomware Families
165 families
161 families
7 families
ML/DL Model Used
Soft voting, RF, DT, KNN, MLP, LR
Dual-stream Transformer
Performance Metrics
Acc: 0.96, Rec: 0.96, Prec: 0.97
Acc: 99.50%, Prec: 99.67%, Rec: 99.33%
Sample Counts
Oracle VirtualBox
Tcpdump, CICFlowMeter, Appmon, ADB tools Android 5.x–6.x, APKs
Virtualized w/ hypervisor monitor Public ransomware, browsers
Real Android phones, WiFi hotspot CIC, APKMirror, VirusTotal
1,000 ransomware, 1,000 benign
7 ransomware, 5 benign, 21 variants
12 families (e.g., Petya, Xorist)
20 families (encryptors/lockers)
1D CNN + LSTM
RF, MLP, SVM, LightGBM, XGBoost
RF, GBT, Naive Bayes, NN
F1-score ≈ 94.3%
Acc: 99.81%, Prec: 99.64%, Rec: 100%, F1: 99.82%
Acc > 0.99, F1 ≈ 0.99 (10-fold CV)
7 families (e.g., Locky, CryptoLocker) Logistic Regression, SVM, LightGBM F1 ≈ 92.0%, Prec 91.7%
10,854 total APKs, 429 malware, 5,065 benign executed 10 families (e.g., Koler, Svpeng, Charger) RF, KNN, J48 Decision Tree
static features, lacks raw execution logs, and requires manual JSON-to-feature conversion, which limits scalability. Despite these constraints, it contributes a practical benchmark for behavior-based ransomware detection and early-stage ML pipeline evaluation. Another dataset that Hirano et al. presented 3 years before the RanSMAP dataset [26] is the RanSAP dataset [25]. It provides a novel dynamic analysis dataset that captures low-level storage I/O patterns using a thin hypervisor. By tracing disk sector reads/writes, it enables early ransomware detection (within 30 seconds) through entropy and access frequency patterns. RanSAP is the first open dataset to monitor disk activity at the hypervisor level, offering resilience against API-level evasion. However, it lacks static features and semantic OS-level context, and its detection accuracy decreases under full-disk encryption. The dataset remains limited in size and requires manual preprocessing of CSV traces into feature vectors.
Caliskan B. et al.: Preprint submitted to Elsevier
APKs provided (permissions, manifest analyzable) ApkTool, VirusTotal (implied) Network traffic, Flow stats, Battery/API logs
Acc: 85–88%, Category F1: ∼50%, Family F1: ∼27%
Finally, CICAndMal2017 dataset, proposed by Lashkari et al. [32], introduces a real-device-based Android malware benchmark that emphasizes capturing realistic runtime and network behaviors. It includes both benign and malicious Android apps, executed under controlled user-interaction scenarios on real smartphones, with network traffic recorded and labeled across five malware categories. Over 80 network flow features were extracted using CICFlowMeter, enabling robust malware binary classification through machine learning models such as Random Forest, KNN, and Decision Tree. The dataset achieves high accuracy for binary detection.However, it exhibits limitations in fine-grained classification: family-level and category-level detection yielded lower performance due to insufficient per-family samples and overlapping traffic patterns. Additionally, the dataset does not provide pre-extracted static features, and malware labeling relies on the majority Anti-Viruses (AV) vendor consensus, which can introduce inconsistency.
Page 4 of 19
RansomTrack for Ransomware Detection Table 2 Categorization of Tools Used in Ransomware Analysis Tool Radare2 [45], Ghidra [40], Capstone [33], PEStudio [16], IDA Pro [24] Frida [18], ProcMon [37], RegShot [46], ProcDot [19] Cuckoo Sandbox [13], CAPEv2 [43], Volatility [50], Noriben [6], DumpIt [12] YARA [2], Wireshark [52], INetSim [27]
Category Static Analysis
Function Disassembly, opcode extraction
Dynamic Analysis Memory/ Sandbox
API monitoring, registry tracing Process analysis, memory forensics
Support Tools
Rule-based detection, traffic emulation
As shown in Table 1, the dataset of our proposed framework, RansomTrack, provides a large-scale, hybrid collection of 2,410 labeled Windows PE files across 165 ransomware families and their benign correspondences. Static features are extracted as opcode arrays using Radare2, while dynamic features are obtained from Frida-based instrumentation to capture fine-grained behavioral traces. Compared to other studies, RansomTrack’s differences are as follows. • It has the highest known family-to-sample ratio to maximize behavioral diversity. • It is a modular feature extraction framework with producible tools. • It uses SHAP-based interpretability to increase transparency in classification. • It has real-time applicability with low per-sample latency (9.1 sec). To develop effective detection strategies against modern ransomware, it is essential to understand both the static structure and dynamic behavior of malicious executable files.
2.4. Tool-Based Ransomware Analysis Effective ransomware analysis often requires the orchestration of multiple tools across static, dynamic, network traffic monitoring and memory forensics. These tools not only support feature extraction, but also facilitate reproducibility, automation, and resilience to evasion techniques. Table 2 summarizes the tools commonly used in ransomware investigations, categorized according to their analytical role. Static analysis tools such as Radare2 [45], Capstone [33] and Ghidra [40] enable disassembly, control flow graphing and opcode extraction from Windows PE binaries. These tools are essential for revealing structural patterns such as encryption loops or obfuscation structures and for performing PE anomaly detection, debugging and reverse engineering. Dynamic analysis tools such as Frida [18], ProcMon [37] and RegShot [46] provide runtime visibility into API calls, registry access, mutual exclusion generation, behavior correlation and network communications. Frameworks such as Cuckoo Sandbox [13], CAPEv2, Volatility [50] and Noriben [6] for memory and sandboxbased analysis, especially for packaged or memory-resident Caliskan B. et al.: Preprint submitted to Elsevier
ransomware variants, offer deeper insight into transaction behavior, memory analysis, genetic malware attribution and forensic artifacts. Finally, support tools such as YARA [2], INetSim [27] and Wireshark [52] enable rule-based detection, simulated fake network services and traffic inspection and monitoring, facilitating the study of command and control patterns and anti-analysis strategies. These tools can be combined to form hybrid analysis pipelines capable of capturing both structural and behavioral indicators of ransomware activity. In our work, Radare2 and Frida are integrated tightly to provide opcode-level disassembly and runtime instrumentation respectively, which forms the core of the RansomTrack feature extraction system.
3. Proposed Framework To overcome the limitations of single-modality detection systems, we propose a hybrid feature extraction pipeline that combines both static and dynamic behavior indicators. Our framework leverages the strengths of Radare2 for structural opcode-level sharding and Frida for real-time API and Page Memory Protection Flag monitoring during binary execution. This dual-modal approach enables a more comprehensive representation of ransomware behavior while maintaining low computational overhead. The proposed RansomTrack framework is developed in four main phases. First of all, ransomware and benignware samples are collected in order to create the dataset. Then, static malware analysis techniques are applied for feature extraction. Following this, dynamic analysis techniques are applied to the same collection in order to generate a hybrid dataset. Finally, various data preprocessing techniques and classification algorithms are applied to the dataset to train the optimum ML model. The general overview of The RansomTrack framework is shown in Figure 1 which illustrates the overall pipeline including sample preprocessing, instrumentation, feature extraction, and classifier input generation.
3.1. Dataset Collection Developing an effective ransomware detection system critically depends on a comprehensive understanding of ransomware behavior. However, publicly available ransomware datasets in the literature remain limited in both quantity and quality. Many existing datasets are outdated and primarily focus on specific ransomware families, often lacking diversity in attack techniques and system environments. More critically, most of these datasets do not include benign software samples, which are essential for training reliable binary classification models. Additionally, collecting representative benignware is a non-trivial task, as it requires careful curation of legitimate software across various system configurations and environments. The absence of standardized benchmarks across studies also complicates fair comparison of detection approaches developed on the same dataset.
Page 5 of 19
RansomTrack for Ransomware Detection
Figure 1: End-to-End Ransomware Detection Pipeline Using Static and Dynamic Features
The "Portable Executable (PE)" file format is the standard binary format used by the Windows operating system for executables, dynamic link libraries (DLLs), and other system-level components. It encapsulates the structural metadata required by the OS loader to map the binary into memory and initiate execution [36, 51]. In this study, we specifically focus on 32-bit Windows executable files (.exe), which represent a subset of PE binaries. The MalwareBazaar repository is the primary source for the ransomware collection phase [1]. Besides, our dataset incorporates some ransomware samples from the dataset provided by Moreira et al. [38]. On the other hand, for the Benignware collection, samples were obtained again from by Moreira et al, the Benign-NET dataset, and the DikeDataset [38], [8], [28]. To ensure architectural uniformity and compatibility with the analysis tools, only 32-bit PE (PE32) files were included in the dataset. Each sample was validated using the pefile Python library, which verified the file architecture and extracted relevant metadata for further classification tasks. Samples that did not conform to the expected format were excluded from the analysis pipeline. Upon completion of sample collection, all collected samples underwent format and architecture validation to ensure that only 32-bit Windows PE files were retained. Additionally, all of the samples are scanned on the VirusTotal platform to ensure they are free from malware [49]. To ensure comprehensive behavioral coverage, the dataset includes samples from 165 distinct ransomware families, spanning both prevalent strains—such as LockBit (134 samples), Conti (54 samples), Dharma (51 samples), Chaos (51 samples), and Phobos (43 samples)—and rare variants, including GpCode (1 sample), Erica (1 sample), and Crypute (1 sample). The full distribution of these ransomware families is illustrated in Table 9 in the Appendix. This table presents each family name alongside its corresponding sample count, offering a clear overview of the dataset’s diversity and highlighting the class imbalance challenges considered during model development. As a result of these efforts, a total of 2,410 Windows 32-bit PE files are added to our collection, comprising 1,205 benignware samples and 1,205 ransomware samples.
Caliskan B. et al.: Preprint submitted to Elsevier
3.2. Static Feature Extraction and Analysis Static analysis involves the application of reverse engineering techniques to uncover the behavioral patterns of malware without executing the malicious code. This process is typically conducted within an isolated and secure environment to mitigate the risk of unintentional infections. Among the widely adopted tools in this domain, Radare2 serves as a prominent reverse engineering framework and is frequently utilized by malware researchers. In this study, we leveraged the Radare2 platform to statically analyze the collected ransomware and benignware executables. Additionally, its Python interface, r2pipe, enabled the seamless integration of reverse engineering capabilities into our automated analysis pipeline, allowing batch processing of multiple samples. Each binary sample was loaded into the analysis environment using architecture-specific settings. The processor architecture was configured as 32-bit x86, and the system was set to operate in little-endian mode. To improve the accuracy of disassembly and maintain analytical consistency, several internal parameters were fine-tuned. These configurations ensured proper handling of relocations, efficient caching of binary data, and precise control over the analysis engine’s behavior. In particular, heuristic features—such as the skipping of no-operation (NOP) instructions or the inference of control flow beyond explicit instructions—were deliberately disabled to preserve deterministic and reproducible analysis outcomes. From the resulting disassembly output, opcode-level information was isolated by filtering instruction mnemonics against a predefined list of known opcodes. Only instructions matching relevant patterns were retained, and these were compiled into linear opcode sequences that served as static representations of each sample’s execution logic. As part of our static analysis procedure, we applied text mining techniques to extract relevant features. Initially, the OPCODEs from each sample are extracted and saved as individual text files. Subsequently, the frequency distribution of these OPCODEs was computed and stored in a structured format (.csv). Across the dataset, a total of 1002 unique OPCODEs were identified. The outcome of these steps was a structured dataset comprising 2410 records and 1002 features, which we refer to as OPCODE_Dataset (OD).
Page 6 of 19
RansomTrack for Ransomware Detection Table 3 Monitored Behavioral Categories and Dynamic Features Behavior Category Mutex Relation
Instrumented Functions (Subset) CreateMutex, CreateMutexEx (A/W)
DLL Name
Runtime Memory Permission Changes Registry Manipulation
Page_ReadOnly, Page_ReadWrite, Page_Execute, Page_Execute_Read RegCreateKey, RegSetValueEx, RegDeleteValue, RegOpenKey (A/W) WSASend, ShellExecuteExW, GetAddrInfoExW InternetOpenUrl, GetAddrInfo, GetAddrInfoEx
kernel32.dll
Network and Shell Activity Internet Connectivity File System Operations
CreateFile, DeleteFile
WriteFile,
MoveFile,
kernel32.dll
CopyFile,
3.3. Dynamic Feature Extraction and Analysis In order to extract runtime behavioral artifacts from Windows executables, we developed a modular dynamic analysis framework based on the Frida instrumentation toolkit. The system executes 32-bit Windows binaries within a controlled environment, injecting JavaScript-based probes to monitor runtime activity. Each sample is initially launched in a suspended state to allow for pre-execution instrumentation. Frida scripts are then injected to trace specific Windows API functions associated with registry access, mutex creation, file and network operations, and memory protection changes as seen in Figure 2. Intercepted API calls are transmitted to the host system and logged for subsequent analysis. The entire framework is implemented in Python, which orchestrates sample execution, instrumentation, and termination under time-constrained conditions. Samples that have been previously analyzed are automatically skipped to ensure both efficiency and reproducibility. The modular design of the scripts supports both targeted and comprehensive monitoring, enabling scalable profiling of ransomware behaviors.
3.3.1. Mutex-Based Behavior Detection The framework includes instrumentation for the CreateMutex and CreateMutexEx functions (supporting both ANSI and Unicode variants), facilitating the detection of mutexbased techniques commonly employed by ransomware. These behaviors include enforcing single-instance execution, coordinating multi-threaded encryption routines, and identifying virtualized or sandboxed environments. Mutex names are extracted from memory and recorded in the behavioral logs. 3.3.2. Runtime Memory Permission Changes Runtime hooks on the VirtualProtect function—exported from "kernel32.dll"—enable the detection of memory protection modifications. Such changes are typically used by ransomware to perform unpacking, execute shellcode, or evade static analysis. The memory protection flags are decoded into semantic labels (e.g., Page_Execute_ReadWrite) and recorded, allowing for the identification of just-intime (JIT) code execution and memory-resident payload deployment.
Caliskan B. et al.: Preprint submitted to Elsevier
advapi32.dll ws2_32.dll, shell32.dll wininet.dll, ws2_32.dll kernel32.dll
Purpose / Notes Detects mutex creation for single-instance enforcement, thread synchronization, or sandbox evasion. Monitors memory access right changes typically seen in unpacking or shellcode injection routines. Tracks suspicious registry operations related to persistence, configuration changes, or evasion. Observes network transmissions, DNS resolution, and shell command execution. Detects connection attempts to remote servers and possible C2 communications. Logs critical file actions including creation, overwrite, encryption, and deletion.
3.3.3. Registry Manipulation Monitoring Critical registry-related APIs such as "RegCreateKey", "RegOpenKey", "RegSetValueEx", and "RegDeleteValue" are hooked to monitor behaviors associated with persistence mechanisms, environment fingerprinting, and the deletion of forensic artifacts. These functions, exported from "Advapi32.dll", are instrumented in both their ANSI and Unicode variants. Registry handles (HKEYs) and associated key/value names are dynamically resolved to enable comprehensive behavioral logging. 3.3.4. Network and Shell Activity Control The framework facilitates the interception and, if necessary, suppression of networking and shell execution API calls. Functions such as "WSASend", "GetAddrInfoExW", and "ShellExecuteExW" are instrumented to extract transmitted payloads, block domain name resolution, and control the execution of external commands. Runtime behavior is configurable through Frida’s messaging interface, allowing dynamic control over analysis policies. 3.3.5. Internet Connectivity Monitoring To identify outbound communication attempts, hooks are applied to functions such as "InternetOpenUrl," "GetAddrInfo," and "GetAddrInfoEx." These functions reveal connections to command-and-control (C2) servers, suspicious domains, and staging infrastructures commonly leveraged in ransomware campaigns. 3.3.6. File System Operations Low-level Win32 System API calls such as "CreateFile," "WriteFile," "MoveFile," "CopyFile," and "DeleteFile" are monitored to track file system activities, including creation, modification, relocation, and deletion behaviors that are strongly indicative of ransomware encryption routines. During runtime, metadata such as file access permissions and creation modes is also extracted to support detailed behavioral profiling. These APIs are core components of the Windows API and are not associated with "wininet.dll" or "ws2_32.dll"; prior references to these libraries in this context have been corrected accordingly. This unified instrumentation system enables fine-grained tracing of ransomware behavior during execution, thereby
Page 7 of 19
RansomTrack for Ransomware Detection
supporting both real-time detection and post-infection forensic attribution. As a result of these efforts, a structured dataset comprising 2411 records and 5024 features, which we refer to as API_Call_Dataset (ACD). Table 3 shows the mapping between observed DLLs and API functions included in our dynamic feature set. This mapping facilitates modular extensibility and compatibility with other behavioral datasets. It is also important to focus on behavioral signals that can be observed in the first seconds of execution to enable early detection during dynamic analysis.
3.4. Feature Integration and Model Training In this study, a hybrid dataset —RansomTrack— was constructed by combining the outputs of both static and dynamic analysis techniques. This integration aims to leverage the complementary strengths of these two approaches to develop an effective detection mechanism against ransomware. To identify features with higher discriminative power within each class, the dataset was partitioned into static and dynamic components. Each feature set was further subdivided based on binary class labels (label = 1 for ransomware, label = 0 for benignware), and Pearson correlation analysis was independently applied within each class. Based on the resulting intra-class correlation patterns, features were categorized into three primary groups: • Class-Neutral Highly Correlated Features (correlation ≥ 0.9 in both classes): These features form strongly correlated clusters consistently observed across both ransomware and benignware samples. Their consistent presence suggests that they capture structural or behavioral properties common to all executable files. • Benignware-Specific Correlated Features (correlation ≥ 0.7 for label = 0.0 and ≤ 0.0 for label = 1.0): These features exhibit moderate to strong correlations within benignware samples but show weak or negative correlation in ransomware. This contrast indicates features that are more representative of benign behavior. • Ransomware-Specific Correlated Features (correlation ≥ 0.7 for label = 1.0 and ≤ 0.0 for label = 0.0): Conversely, these features are strongly correlated within ransomware samples but show weak or inverse relationships in benignware. Such features may reflect malicious or evasive behaviors that are characteristic of ransomware. This correlation-based categorization provides deeper insight into class-specific feature dependencies and enhances the interpretability of both static and dynamic attributes in the dataset, as illustrated in Figure 3. The threshold values used for feature grouping follow conventional interpretations of Pearson correlation strength: coefficients between 0.7 and 0.9 are considered moderately correlated, values above 0.9 indicate strong correlation, and values equal to or below 0.0 are regarded as uncorrelated or negatively correlated [10]. Caliskan B. et al.: Preprint submitted to Elsevier
To evaluate the effectiveness of the extracted features, a comprehensive set of classification algorithms was employed. The dataset was partitioned into training and testing subsets using an 80/20 stratified split to maintain class balance. A fixed random seed was applied to ensure the reproducibility of experimental results. The classification models used in this study are organized into five main categories: • Tree-based classifiers:Decision Tree, Random Forest, and Extremely Randomized Trees, which are wellsuited for modeling nonlinear feature interactions. • Boosting algorithms:XGBoost, Gradient Boosting, AdaBoost, and CatBoost, known for their ability to iteratively improve weak learners and enhance predictive accuracy. • Neural network model:A Multi-Layer Perceptron (MLP) with multiple hidden layers, capable of capturing complex, high-dimensional feature representations. • Linear model:Logistic Regression, employed to assess baseline separability within the feature space. • Distance and kernel based methods:K-Nearest Neighbors and Support Vector Machine, which rely on similarity metrics and kernel-defined decision boundaries. To enhance classification robustness and reduce individual model bias, a soft voting ensemble strategy was adopted, aggregating predictions from multiple base classifiers. Hyperparameter tuning was performed for selected models—such as Random Forest—using grid search combined with five-fold cross-validation to optimize performance. All models were implemented using widely adopted machine learning libraries, ensuring consistency, scalability, and reproducibility across all experimental settings.
4. Experimental Results To evaluate the effectiveness of the proposed hybrid framework, we conducted experiments on the RansomTrack dataset, which contains 165 ransomware families and 2,410 labeled instances in their corresponding benign binaries. All phases of the proposed framework—including static and dynamic analysis, feature extraction, data preprocessing, machine learning model training, and testing—were conducted on a virtual machine configured using Oracle VirtualBox. The virtual environment runs a Windows 10 Pro 64-bit operating system with 8 GB of RAM and 2 virtual CPUs. The evaluation of the proposed framework is carried out from multiple perspectives, including malware analysis and feature extraction, data preprocessing and dimensionality reduction, ransomware detection, model interpretability using SHAP (SHapley Additive exPlanations), model-specific false negative analysis, and runtime performance analysis. Page 8 of 19
RansomTrack for Ransomware Detection
4.1. Malware Analysis and Feature Extraction First of all, OPCODE distributions are compared between ransomware and benignware samples. In ransomware samples, the "MOV" instruction constitutes approximately 14.5% of all opcodes, highlighting its central role in memoryrelated operations such as key loading, buffer manipulation, and data transfer during encryption processes. Other frequently observed instructions include "ADD, XOR, CALL, and INT3." The distribution of OPCODE usage among ransomware samples is depicted in Figure 4. Of particular note, the INT3 instruction is often utilized for anti-debugging purposes, enabling malware to detect the presence of debugging or sandboxing environments. The XOR instruction, by contrast, is commonly employed for obfuscation and lightweight encryption, especially in self-decrypting or packed code segments. Overall, ransomware binaries exhibit a strong dependency on control-flow and memorymanipulation instructions, which aligns with typical behaviors such as payload unpacking, evasion, and runtime code modification. In contrast, for the benignware samples as shown in Figure 4, instructions such as "MOV" and "ADD" remain prevalent, the overall distribution is more uniform, and it lacks a dominant presence of opcodes associated with antianalysis or encryption-related activities. Instructions like "PUSH", "POP", and various arithmetic operations appear at moderate frequencies, indicative of standard application logic and typical control-flow behavior rather than malicious functionality. Our second findings are obtained from dynamic analysis. The most frequently invoked API calls by ransomware samples include "CreateFile," "MoveFile," and "WriteFile," all of which are central to ransomware’s core functionality—namely, file encryption, renaming, and unauthorized data manipulation. Additionally, registry access routines such as "RegQueryValueEx" and memory protection changes like "Page_Execute_ReadWrite" and "Page_ReadWrite" are observed with high frequency, suggesting the presence of behaviors such as shellcode injection, unpacking, and inmemory payload execution. Figure 5 presents the distribution of dynamic features extracted from ransomware and beningware samples. Less frequent API calls, such as "DeleteFile," "EncodePointer," and "FlsAlloc," may be associated with antiforensic actions, obfuscation, or resource allocation mechanisms that support stealth and persistence. In contrast, for benignware samples, registry-related operations such as "RegOpenKey" and "RegQueryValueEx" are dominant, along with standard file access via "CreateFile," indicative of routine system configuration and application initialization. Notably, benign samples exhibit minimal manipulation of memory permissions and lack aggressive file-handling behavior, which distinguishes them from ransomware. Furthermore, the presence of API calls like "EvtFormatMessage," "OpenProcessToken," and "GetTokenInformation" suggests legitimate security context queries and Caliskan B. et al.: Preprint submitted to Elsevier
event logging functionality, commonly found in administrative or utility software. These visualized distributions across Figures 4 and 5 reinforce the behavioral divergence between ransomware and benignware, both in static opcode patterns and dynamic API usage. This contrast supports the design of interpretable and discriminative hybrid feature models for ransomware detection.
4.2. Data Preprocessing and Dimensionality Reduction We applied correlation-based feature classification to the static opcode features extracted from disassembled PE32 samples. By analyzing co-occurrence patterns and semantic relationships among opcodes, we identified meaningful clusters associated with common programming constructs, control-flow mechanisms, and obfuscation techniques. The resulting opcode groups exhibit class-specific tendencies—some are predominantly observed in ransomware samples (e.g., obfuscation-related opcodes such as xor, nop, and int3), while others are more frequent in benignware (e.g., control-transfer instructions like ret, call, or data movement instructions used in initialization routines). Shared opcode clusters typically represent foundational system-level instructions present in both malware and legitimate software. This grouping approach not only improves interpretability during model training but also contributes to dimensionality reduction without compromising discriminative power. Representative static opcode clusters and their associated behavioral interpretations are summarized in Table 4. Similarly, dynamic behavioral features extracted from API call traces and memory activity logs were grouped using intra-class Pearson correlation analysis. Unlike conventional high-level API call profiling, our method captures low-level runtime artifacts for instance "Memory protection changes," "Heap allocations," "Registry key manipulations," "File system operations," and "Network and shell invocation" routines. This analysis revealed distinct behavior profiles for ransomware and benignware. For example, ransomwarespecific clusters include patterns of memory-resident payload execution, mutex-based evasion, and aggressive file renaming or deletion. In contrast, benignware groups were characterized by registry initialization routines, event log accesses, and standard file read/write behavior. All identified feature groups are categorized as benignwarespecific, ransomware-specific, or shared in Table 4, providing a clear behavioral taxonomy. To explore the interplay between static and dynamic analysis, a hybrid correlation analysis is conducted by combining both feature domains. Static features included opcode distributions, while dynamic features encompassed behavioral indicators such as memory modifications and API sequences. Interestingly, the resulting clusters showed that no hybrid group contained a mix of static and dynamic features, highlighting a strong orthogonality between the structural and Page 9 of 19
RansomTrack for Ransomware Detection Table 4 Static and Dynamic Feature Groups via Correlation-Based Feature Clustering Group Type
Static Feature Examples
Static Feature Description
Benignware Specific Groups
bndmov, vmsave, vmxoff, skinit
Virtualization and system state management; commonly found in clean system exits or virtualization-aware software. Vector arithmetic operations used in multimedia, graphics, and scientific computations.
vpmacsdql, blendd
vpsllvq,
vp-
bsr, movdqu, pxor, pshufb
cvttpd2dq, vcomisd
Ransomware Specific Groups
vcvttsd2si,
vpminsd, vpor, vpaddd, sha1msg1, sha256msg2 movntdq, vmovntdq, pshufb, movhlps xend, mwaitx, xsetbv
int3, call, sfence
Shared Feature Groups
cmpneqps,
fadd, fmul, fcom, fsqrt, fucompp int, hlt, iret, cli, sti, pushf
mov, push, pop, lods, stos, xchg
vaddps, vcvtsd2si, vminps, vpaddb, vpsubd, vpsrldq
Legacy I/O and memory operations for structured buffer handling in userlevel applications. Data conversion and comparison instructions frequently observed in benign numerical processing. Cryptographic and vectorized hashing operations typical in ransomware encryption routines. Streaming memory writes used for fast data overwrite and stealth payload delivery. Low-level control instructions related to system context switching and VM escape techniques. Control flow manipulation and timing-based obfuscation techniques for anti-debugging or evasive execution. Floating-point arithmetic common to both benign applications and malicious cryptographic routines. System-level and interrupt management instructions found in most executable flows. Basic data movement and stack operations essential for any control-flow logic. Vector arithmetic patterns observed both in ransomware and benign multimedia software.
behavioral domains. This finding suggests that ransomware exhibits distinct operational layers: static indicators related to packing and obfuscation, and dynamic traits related to malicious execution logic. The absence of cross-domain co-correlation emphasizes the value of hybrid analysis—each domain captures unique and complementary signals for robust ransomware detection. The representative feature clusters resulting from the hybrid correlation analysis are presented in Table 5, corresponding to benignware-specific, ransomware-specific, and class-shared behavioral patterns. While beingware typically emphasizes user interface manipulation, registry querying, memory mapping, and internationalization, ransomware uses more aggressive and sophisticated features such as encryption algorithms, obfuscation methods, system control, and user interface emulation. There are some common sets of APIs shared by both types, such as basic Windows interface calls, string manipulation functions, and helper functions related to file paths, which are used in both benign and malicious software. This suggests that malware detection should focus not only on individual API calls, but also on their combinations and behavioral patterns.
Caliskan B. et al.: Preprint submitted to Elsevier
Dynamic Feature Examples adjustwindowrect, drawtexta, fillrect, getcursor, setfocus
Dynamic Feature Description
getdateformatw, gettimeformatw, getlocaleinfoa, gettimezoneinformation regsetvalueexw, regdeletevaluew, setenvironmentvariablew createfile, mapviewoffile, heapcompact, heapfree
Localization, formatting, and time/date retrieval routines used in user-facing programs.
copyfilew, createfilemappinga, movetoex, ntcreatefile regdeletekeya, regsetvalueexa, regenumkeyexa, regqueryinfokeya createprocessw, getcurrentthread, getcurrentthreadid, terminatethread setdlldirectoryw, shellexecuteexa, loadlibrarya
strcpy, strcat, _itoa, _stricmp, wcsncmp getmodulehandlew, getstartupinfow, loadimagew regopenkeyexa, regqueryvalueexa, openscmanagerw, queryservicestatus cryptacquirecontexta, cryptgenrandom, convertstringsecuritydescriptortosecuritydescriptorw
Graphical UI rendering and user interaction management; typical of GUIbased legitimate applications.
Non-destructive registry access or benign configuration settings by installers and applications. Safe file and memory operations—typical of setup tools, editors, or document-handling utilities. File locking, replication, and direct mapping—often used in encryption and destructive overwrite. Registry manipulation patterns used for persistence, disabling recovery, or altering boot behavior. Process/thread hijacking or spawning subprocesses; used to evade or disable protection mechanisms. DLL injection, side-loading, or stealth execution routines supporting payload deployment. Standard string and buffer routines shared across most applications, benign or malicious. Process initialization and dynamic linking support used during startup in various software. Registry/service interaction routines used by installers, utilities, or malware loaders alike. Cryptographic context setup—can appear in secure apps and ransomware key handling.
4.3. Ransomware Detection Our previous research reveals that Random Forest (RF) outperforms classical machine learning algorithms such as Decision Tree (DT) and XGBoost in ransomware detection, particularly when leveraging dynamic behavioral features like API call sequences [9]. Similarly, Yüksel [53] reports that RF achieves superior accuracy on API-based datasets due to its ability to capture nonlinear patterns and handle high-dimensional feature spaces effectively. Building on these insights, we prioritized RF for its demonstrated strength in modeling behavioral data. For comparison and baseline interpretability, we also included logistic regression (LR), which is known for its effectiveness in linearly separable feature spaces. Prior work by Mowri et al. [39] supports LR’s performance in such settings, particularly when applied to subsets of static features. To systematically evaluate the contrast between linear and nonlinear classifiers, we independently trained RF and LR on three distinct feature representations: First, static features derived from opcode distributions, then dynamic features extracted from API call traces, and lastly, a hybrid set combining both. This structured approach allowed us to assess how model performance shifts as the feature space Page 10 of 19
RansomTrack for Ransomware Detection Table 5 Hybrid Feature Clustering Group Type Benignware Specific Groups
Feature Group GUI Rendering and Input Handling
Representative Features gdipcreatebitmapfromhbitmap, loadbitmapw, dispatchmessagew, getmessagew cryptacquirecontextw, getfileversioninfoa, regqueryinfokeya, loadlibraryexw createfilemappinga, mapviewoffile, duplicatehandle, getthreaddesktop cvtdq2pd, vcvtpd2dq, vpmuludq, movhpd comparestringa, getlocaleinfoa, gettimezoneinformation vpminsd, vfmsub213sd, sha1msg1, sha256msg2, kandnb createprocessw, loadlibrarya, setsecuritydescriptorowner, vmovapd, vmovups getlocaleinfow, getstdhandle, getwindowtextlengtha, timegettime smsw, vsqrtss, mwaitx, vmrun, lldt
Registry and DLL Handling
Memory Mapping and Process Utilities Numeric and Vector Operations (Static) String and Localization Utilities Ransomware Specific Groups
Cryptographic and Vector Payloads (Static) Persistence and Obfuscation APIs
System and Thread Control Destructive or Privileged Instructions (Static) Resource and Dialog Manipulation Shared Feature Groups
createpen, drawthemetextex, screentoclient createwindowexa, getmessagea, loadcursora, postmessagea cvtsi2sd, movss, xorps, wcsstr, lcmapstringw getcurrentprocess, tlsalloc, sleepconditionvariablecs, pmuludq findfirstfilea, pathcombinew, getvolumeinformationw cryptacquirecontexta, setfilesecurityw, regenumkeya, deleteobject
Common Windows APIs String and Locale Utilities (Static + Dynamic) Process and Memory Control File and Path Utilities Security and Registry APIs
Description Common in interactive GUI applications; reflects standard rendering pipelines. Used for querying system version info and handling optional libraries in benign programs. Typical of system configuration tools, benign services, or sandbox utilities. Indicates benign computational routines involving multimedia or scientific tasks. Reflects internationalization and regional format handling in user applications. Corresponds to cryptographic operations, likely encryption core logic. Used to hide ransomware payloads or maintain access after reboot. Includes timing and system enumeration calls used in sandbox detection or evasion. Low-level processor instructions linked to control privilege levels or system state. May be used to mimic or obstruct legitimate user interface elements. Fundamental API calls required for basic GUI event handling. Used in string formatting and parsing routines across both benign and malicious software. General resource handling features present in various PE workflows. Involved in accessing system directories and file enumeration. Shared between installer utilities and malware routines.
Table 6 Per-Sample Training and Testing Times for Random Forest and Logistic Regression Model RF RF RF LR LR LR
Feature Static Dynamic Hybrid Static Dynamic Hybrid
Acc. 0.91 0.94 0.95 0.82 0.94 0.93
Prec. 0.96 0.91 0.95 0.95 0.93 0.93
Rec. 0.85 0.97 0.95 0.68 0.95 0.93
Spec. 0.97 0.91 0.95 0.97 0.93 0.93
G-Mean 0.90 0.94 0.95 0.81 0.94 0.93
F1 0.90 0.94 0.95 0.79 0.94 0.93
transitions from structural to behavioral representations and their integration. Following this RF–LR comparison, we extended our evaluation to include additional classifiers—namely DT, KNearest Neighbors (KNN), Multi-Layer Perceptron (MLP), and XGBoost. To further improve classification robustness and stability, we implemented a Soft Voting Ensemble
ROC-AUC 0.98 0.98 0.99 0.90 0.98 0.98
Bal. Acc. 0.91 0.94 0.95 0.82 0.94 0.93
Log Loss 0.21 0.19 0.14 0.56 0.17 0.22
Train Time Per Sample (s) 0.0008 0.0012 0.0016 0.0061 0.0062 0.0132
Test Time Per Sample (s) 0.0001 0.0002 0.0002 0.000001 0.00001 0.00001
model that aggregates the predictions from these diverse models using a weighted consensus mechanism. In Tables 6 and 7, The performance results of all classifiers are reported. Table 6 presents a detailed comparison of RF and LR across all three feature representations using multiple metrics, including accuracy, precision, recall, specificity, G-Mean, F1-score, ROC-AUC, balanced accuracy, log loss, and runtime. The results highlight clear performance
Table 7 Evaluation Metrics of Classifiers on Hybrid Feature Set with Per-Sample Timing Model RF LR KNN DT MLP XGBoost Soft Voting
Acc. 0.95 0.93 0.95 0.94 0.94 0.96 0.96
Pre. 0.95 0.93 0.97 0.95 0.92 0.97 0.97
Rec. 0.95 0.93 0.93 0.93 0.96 0.95 0.96
Spec. 0.95 0.93 0.98 0.95 0.92 0.98 0.97
G-Mean 0.95 0.93 0.95 0.94 0.94 0.96 0.96
Caliskan B. et al.: Preprint submitted to Elsevier
F1 0.95 0.93 0.95 0.94 0.94 0.96 0.96
ROC-AUC 0.99 0.98 0.97 0.96 0.98 0.99 0.99
Bal. Acc. 0.95 0.93 0.95 0.94 0.94 0.96 0.96
Log Loss 0.14 0.22 0.81 1.34 0.16 0.12 0.16
Train Time Per Sample (s) 0.0016 0.0132 0.0217 0.0008 0.1251 0.0025 0.1273
Test Time Per Sample (s) 0.0002 0.000001 0.0013 0.00001 0.0001 0.0001 0.0091
Page 11 of 19
RansomTrack for Ransomware Detection
gaps between Random Forest and Logistic Regression across different feature sets. Random Forest (RF) demonstrates consistent superiority, particularly on the hybrid feature configuration, achieving 0.95 accuracy, 0.95 F1-score, and a near-perfect 0.99 ROC-AUC, while maintaining a low log loss of 0.14. In contrast, Logistic Regression (LR) underperforms on static features (recall: 0.68, F1: 0.79), reflecting its limitations in modeling nonlinear decision boundaries. Table 7 focuses exclusively on the hybrid representation and compares all classifiers to assess their generalization capability over this enriched feature space. In this comparison, a broader set of classifiers was evaluated on the hybrid feature set. Among them, ensemble-based models—specifically XGBoost and Soft Voting—achieved the highest overall performance, with both reaching 0.96 accuracy, 0.97 precision, 0.96 F1-score, and 0.99 ROC-AUC. However, closer inspection of their confusion matrices reveals meaningful distinctions in misclassification behavior and runtime characteristics. To complement the tabular evaluations and provide visual insights into classification behavior, we generated confusion matrices for three key models—Soft Voting, XGBoost, and RF—on the held-out 20% test set. These matrices reveal how well each model distinguishes between benignware (class 0) and ransomware (class 1). Figure 6 shows the confusion matrices for the Soft Voting, XGBoost, and RF Classifiers. The Soft Voting achieved the best overall performance: 231 true positives with only 10 false negatives, indicating high sensitivity. Additionally, it produced 233 true negatives and just 8 false positives, reflecting a strong specificity. XGBoost’s confusion matrix demonstrates comparable performance, with 230 true positives and 11 false negatives. Notably, it yielded only 6 false positives, suggesting a slightly more conservative decision boundary. RF’s results are consistent with the other top models but with a marginally higher false negative count (13), indicating slightly lower sensitivity to class 1 instances. This makes Soft Voting the most sensitive model to ransomware detection. However, it comes at a substantial computational cost: its training and inference times were measured at 245.35s and 4.37s, respectively, whereas XGBoost completed the same tasks in just 4.82s and 0.05s. Random Forest required moderate time (8.76s training, 0.24s inference). Overall, the confusion matrices reinforce the quantitative findings and highlight the benefits of ensemble-based methods, particularly in minimizing false negatives, which is a critical objective in ransomware detection systems.
4.4. Interpreting Model Predictions with SHAP To enhance model interpretability, we used SHAP (SHapley Additive exPlanations) values to analyze the feature contributions of the trained XGBoost classifier. SHAP assigns an importance score to each feature based on its marginal contribution to individual predictions. We computed average SHAP values separately for class 0 and class 1 samples to identify the most influential features Caliskan B. et al.: Preprint submitted to Elsevier
for each class. Features were ranked based on the absolute mean SHAP values and visualized in class-wise bar plots, offering a detailed view of decision rationale for both benign and ransomware classifications. The SHAP-based analysis in Figure 7 reveals distinct behavioral and structural patterns characteristic of ransomware and highlights features commonly associated with benign application behavior. In ransomware behavior, memory-related operations such as page_readwrite, getcurrentprocess, and decodepointer indicate active runtime memory manipulation—a common trait in unpacking, code injection, and self-modifying malware. A substantial portion of highly influential features consists of low-level assembly instructions including nop, shr, movlpd, add, sub, and ror, which are f and regopenkeyexw reflect direct interaction with file systems and the Windows Registry, reinforcing patterns like mass file access, sandbox detection, and persistence mechanisms. Collectively, these results indicate that the model effectively learns operational signatures specific to ransomware across memory, instruction-level, and API-based behavioral domains. In benignware behavior, although certain operations such as page_readwrite and regopenkeyexw are shared with ransomware, their usage in benign samples reflects legitimate system interactions—such as configuration loading, structured file access, or version metadata retrieval—rather than malicious intent. Low-level instructions like shr, movlpd, ret, sub, add, and ror also appear in benignware, but typically in contexts generated by standard compilers, rather than obfuscated loops or control-flow tampering. Furthermore, modern API calls such as rogetparameterizedtypeinstanceiid, getcurrentpackageid and loadstringw are frequently observed in benign samples, indicating structured user interface initialization, resource localization, and systemlevel querying, particularly within UWP or WinRT-based applications. In contrast, a detailed SHAP-based comparison identifies discriminative instructions and API calls that are uniquely associated with ransomware behavior. Instructions such as nop, leave, and movups are observed exclusively in ransomware samples and are widely recognized as indicative of evasive behavior. These instructions are commonly employed in obfuscation routines, return-oriented programming (ROP) chains, or shellcode deployment, suggesting deliberate attempts to hinder static and dynamic analysis by security tools. Distinctive assembly-level features also exist on the benign side. Instructions such as shrd and xlatb appear only in benign samples and are often the result of performanceoptimized code generation or low-level compilation artifacts. These patterns do not reflect any suspicious behavior and align with expected software execution flows. At the behavioral level, several API calls show classspecific usage patterns. Exclusively in ransomware samples, APIs such as getcurrentprocess, decodepointer, and getsyscolor reflect anti-analysis strategies, memory handle manipulation, and runtime environment discovery. These Page 12 of 19
RansomTrack for Ransomware Detection Table 8 False Negative Rates (FNR) for Ransomware Samples Model Soft Voting XGBoost Random Forest
FN / (TP + FN) 10∕241 11∕241 13∕241
FNR (%) 4.15% 4.56% 5.39%
calls enable the malware to gather context information about its execution environment and adapt accordingly to evade detection. Conversely, benign-exclusive API usage, including get currentpackageid, loadstringw, and fsalloc, points to legitimate application functionality such as localized GUI rendering, application metadata querying, and file I/O initialization. Together, these observations confirm the model’s ability to differentiate not only based on feature presence, but also through an understanding of their contextual and semantic roles within executable workflows. Such nuanced insights significantly enhance the robustness and interpretability of ransomware detection models.
4.5. Model-Specific False Negative Analysis To quantify how frequently each model misclassifies ransomware samples (class 1), we computed the false negative rate (FNR), defined in Equation 1: FNR (%) =
FN × 100 TP + FN
(1)
where FN denotes the number of false negatives and TP denotes the number of true positives. A higher FNR indicates a model’s failure to detect ransomware, which is especially critical in cybersecurity applications. The computed FNR values for the top-performing classifiers are summarized in Table 8. Frequently observed in custom encryption routines and obfuscation logic. Furthermore, API calls such as createfile, createmutex,These results emphasize that while all three models—Soft Voting, XGBoost, and Random Forest—are highly effective on hybrid features, their optimal usage depends on deployment context. Soft Voting achieves the highest detection coverage with minimal ransomware misclassification, making it ideal for high-assurance scenarios such as critical infrastructure or forensic analysis, where recall is paramount and runtime constraints are secondary. Its ensemble architecture enhances robustness by capturing diverse decision boundaries, improving performance against ambiguous or borderline samples. In contrast, XGBoost delivers near-instant inference (0.05s) with slightly higher misclassification rates, making it well-suited for low-latency environments such as endpoint protection or online threat detection systems. Random Forest strikes a balance between recall and runtime, offering reliable performance while remaining computationally efficient.
Caliskan B. et al.: Preprint submitted to Elsevier
These findings underscore the importance of aligning model selection with both performance objectives and operational constraints—especially in high-risk domains where minimizing undetected threats is critical. Our real-time prediction framework, for instance, completes the full decision cycle in approximately 9.1 seconds, including both static and dynamic feature extraction. The classification latency itself remains negligible (as low as 0.0001 seconds) when using a pre-trained XGBoost model. Even in scenarios involving runtime training, the performance overhead is marginal (9.10026 seconds total), and the model retains robust accuracy with a 4.56% error margin.
4.6. Runtime Performance Analysis On average, the extraction of static features—primarily opcode-based representations—required approximately 6.1 seconds per sample, including disassembly and opcode parsing via the Radare2 framework and its Python interface. During the dynamic analysis phase, all samples were executed for varying durations to determine the minimum time required to collect sufficient features for machine learning model training. Based on these trials, three seconds per sample was identified as the minimum duration necessary to reliably monitor API calls and memory page protection flags. Each binary was executed using Frida within a sandboxed Windows environment, and dynamic traces were collected through lightweight instrumentation. In addition, all extracted features were subjected to data preprocessing and dimensionality reduction, followed by machine learning model training and testing. The preprocessing and dimensionality reduction phase required approximately seven milliseconds per sample, broken down as follows: correlation calculation (6 ms), opcode counter processing (0.6 ms), and data scaling (0.1 ms). Training and classification times for various machine learning models were presented in the previous section. Among them, the Soft Voting model required 127 milliseconds per sample for training and 9 milliseconds per sample for classification. As a result, the proposed framework is capable of detecting ransomware in approximately 9.2 seconds, comprising 9.1 seconds for feature extraction and analysis, and 0.1 seconds for data preprocessing and classification. These results demonstrate that the proposed hybrid analysis pipeline is computationally efficient and scalable. Despite the common perception that dynamic analysis incurs higher computational overhead, the relatively low persample runtime observed in both analysis phases supports the framework’s applicability to large-scale batch processing and offline malware analysis workflows.
5. Discussion The results presented in Section 4 confirm the effectiveness of our hybrid ransomware detection framework in many respects. However, beyond these experimental findings, we would like to discuss in this section the effectiveness, novelty, and open challenges of our proposed framework. Page 13 of 19
RansomTrack for Ransomware Detection
RansomTrack offers a modular and lightweight hybrid behavioral analysis pipeline that leverages static features at the opcode level and dynamic features, including detailed API call traces and memory page protection flags. RansomTrack provides instruction-level disassembly (via Radare2) and dynamic API hooking (via Frida) in six behavioral areas: memory operations, mutex interactions, registry manipulation, file activity, shell execution, and networking, along with memory page protection flags. Unlike heavy-duty sandbox or kernel-level monitoring solutions, our framework relies solely on user-space tooling (Radare2 and Frida), providing features such as easy portability across various deployment environments, realtime applicability with sub-10-second decision latency, and interpretability through SHAP-based explanations. The RansomTrack dataset, containing 165 ransomware families, has improved generalization across obfuscation, packaging, and polymorphic variations, making the proposed framework more robust than signature-based or narrowly scoped detection methods. While existing systems such as RansomFormer and RanSMAP, which we review in detail in Section 2, offer strong performance in isolad methods, they also have limitations such as lack of behavioral coverage such as lack of mutual exclusion/network monitoring, high computational cost or instrumentation complexity, and limited support for early stage detection. RansomTrack addresses these gaps in the literature by integrating structural and runtime indicators, providing minimal operational overhead thanks to scriptable tools, and near-time decision-making capabilities with negligible classification latency. Despite the promising results obtained, there are still challenges to be solved, such as the lack of a multi-window or event-triggered execution strategy for dynamic tracking, memory entropy features, and code similarity fingerprinting for load detection, and richer semantic modeling of behavioral traces. Despite these challenges, RansomTrack’s modularity and low latency provide the opportunity to be used in a variety of real-world scenarios. In particular, endpoint protection agents can use pre-trained models for local inference, security operations centers (SOCs) can integrate the system for forensic triage or alert verification, critical infrastructure environments can use ensemble-based classifiers like Soft Voting, and consumer-side endpoint protection solutions can opt for faster models like XGBoost. Furthermore, for analysts, SHAP-based feature interpretability supports explainable decision making.
6. Conclusion In this paper, we introduce RansomTrack, a hybrid ransomware detection framework that integrates static opcodelevel features with dynamic API-level and memory page protection behavioral signals. The static component extracts instruction-level semantics via Radare2, while the dynamic Caliskan B. et al.: Preprint submitted to Elsevier
module uses Frida to monitor runtime behaviors in six key areas, including memory, registry, and file operations. By leveraging these tools, we have shown that high-accuracy, low-latency detection can be achieved without resorting to heavy sandboxing or kernel-level interventions. Unlike traditional approaches that rely on sandbox logs or byte ngrams, RansomTrack provides fine-grained, real-time instrumentation by capturing detailed API arguments and memory protection changes. This enables precise detection of behaviors such as unpacking, code injection, and evasion techniques. Our evaluation on a dataset of 2,410 labeled PE files from 165 ransomware families showed that hybrid modeling significantly improves classification performance compared to static-only or dynamic-only approaches. Among the tested classifiers, the Soft Voting ensemble provided the highest recall, while XGBoost offered the lowest inference latency, enabling deployment in both high assurance and real-time security contexts. The SHAP-based analysis further highlighted key distinguishing features. Beyond the empirical gains, RansomTrack also addresses critical gaps in the literature, such as limited family diversity, lack of interpretability and runtime inefficiencies. It offers a fast, extensible and interpretable pipeline with an average runtime of 9.1 seconds per sample. Its modular design supports selective probe activation and customized feature recording, making it suitable for real-time applications. However, challenges such as evasion-sensitive ransomware, progressive execution and encrypted payloads still remain open research issues. Future work will investigate multi-stage dynamic execution, adaptive retraining mechanisms, and deep behavior modeling using graph-based or temporal learning techniques. We also plan to publish the RansomTrack dataset and tools as an open benchmark to facilitate reproducible research and cross-method comparisons in the field of ransomware detection.
A. Appendix: RansomTrack Dataset Information Card A.1. Structure of the Dataset file The dataset is presented in csv file format and contains behavioral and structural features extracted from a total of 2,410 executable samples, including both ransomware and benignware. The first 1,205 rows represent ransomware samples, while the remaining 1,205 rows correspond to benign software. The dataset is organized as follows: • Column 0: Contains the SHA-256 hash values of the files, serving as unique identifiers. • Columns 1–1002: Represent static opcode frequency features extracted from the binary code of each sample.
Page 14 of 19
RansomTrack for Ransomware Detection Table 9 List of ransomware families and number of samples in the dataset. Ransomware Family Adhubilka AvosLocker BlackCat BuerLoader Cipher CryptFile2 CyberVolk Darkside Exorcist Genasom Hermes HydraCrypt Levislocker LokiLocker MassLogger Mole Neshta Phobos PureLogStealer RansomeXX Ryuk ShadowRoot StormKitty Thanos Vohuk Yanluowang
Count 2 1 53 3 1 1 5 5 13 2 1 1 1 2 1 1 2 43 1 3 37 1 1 34 1 1
Ransomware Family AESCRYPT AXLocker Blackmatter Bulkwar CoinMiner CryptNet Cyborg DarkWatchman Eyedocx GlobeImposter HiddenTear Inlock LimeRAT Lynx Matrix MoneyMessage Netwalker PLAY Pysa Redeemer Ryzerlo Slam Surtr TrickBot VoidCrypt Zeppelin
Count 1 5 11 1 1 1 1 1 1 3 2 1 2 2 1 3 32 5 38 2 2 1 3 2 1 10
Ransomware Family AESRT Babadeda BlackOut Buran Conti CryptoJoker Cylan Erica Fabiansomware GpCode Hitobito Kadavaro LockBit MafiaWare666 Maze Mountlocker Nitro PlutoCrypt Qakbot RedLineStealer Sage Smert TankRansom Trigona WannaCry Zerber
Count 1 1 3 1 54 1 2 1 1 2 2 1 134 1 8 3 3 1 1 1 2 1 2 4 5 6
Ransomware Family AgentTesla Babuk BlackShades Cerber CryLock CryptoLocker Cylance Eternity Formbook HakunaMatata Hive KillMBR Locker Makop MedusaLocker Mydoom Njrat Pony QuasarRAT ReturnBack Saturn Spacecolon TankixCrypt Troldesh Wastedlocker Zusy
Count 2 47 1 37 2 1 2 1 1 2 1 1 1 20 2 2 1 1 3 1 1 1 2 1 10 1
Ransomware Family Alien Bazek BlackSnake Chaos CrypHydra CryptoWall Dacic EternityStealer Gandcrab Hardbit HolyGhost Kryptik LockerGoga Mallox Mimic Nabucur PenterWare Prestige RagnaLocker Royal Scar StayHigh Targeted Venus Xorist
Count 1 2 1 51 1 1 1 1 36 2 1 1 1 6 1 3 2 1 1 1 1 1 4 3 1
Ransomware Family Avaddon BlackBasta BlackSuit Chimera Crypt360 Crypute Dalexis Exmas GarrantDecrypt Heracles Huntr levislocker Locky Mammon Mimikatz Nefilim Phalcon PureCrypter Ragnarok RustyStealer Seven Stop TeslaCrypt Virlock Xworm
Count 51 23 3 2 1 1 1 1 1 1 1 1 7 5 2 18 1 1 35 1 3 51 43 1 2
• Columns 1003–2737 and 2742–6027: Contain dynamic API call frequency features collected during runtime execution using dynamic analysis tools. • Columns 2738–2741: Encode memory protection behaviors associated with runtime execution, such as PAGE_READWRITE, PAGE_EXECUTE_WRITE, and other memoryrelated flags. • Column 6028: Labeled as label, this column indicates the ground-truth class of the file, where 0 denotes benignware and 1 denotes ransomware. This feature layout provides a comprehensive representation of both static and dynamic behaviors, enabling hybrid analysis and classification tasks.
A.2. Ransomware Families and Sample Counts The ransomware families and their sample numbers within the dataset are presented in Table 9.
Figure 2: Overview of the hybrid feature extraction workflow combining static and dynamic analysis stages.
Caliskan B. et al.: Preprint submitted to Elsevier
Page 15 of 19
RansomTrack for Ransomware Detection
Figure 3: Feature Integration Overview
Caliskan B. et al.: Preprint submitted to Elsevier
Page 16 of 19
RansomTrack for Ransomware Detection
Figure 4: Opcode distributions in ransomware and benignware samples
Figure 5: Dynamic feature distribution in ransomware and benignware samples
Figure 6: Confusion matrices
Figure 7: Top 20 features contributing to class 1 (top) and class 0 (bottom) based on absolute mean SHAP values.
Caliskan B. et al.: Preprint submitted to Elsevier
Page 17 of 19
RansomTrack for Ransomware Detection
References [1] Abuse.ch, 2025. Malwarebazaar – a repository of malware samples. https://bazaar.abuse.ch/. [Online]. [2] Alvarez, V., 2013. Yara – malware pattern matching tool. https: //virustotal.github.io/yara/. [Online]. [3] Alzahrani, S., Xiao, Y., Asiri, S., Alasmari, N., Li, T., 2025. Ransomformer: A cross-modal transformer architecture for ransomware detection via the fusion of byte and api features. Electronics 14, 1245. doi:10.3390/electronics14071245. [4] Bae, S., Yang, C., Kim, Y., 2022. Inviseal: A stealthy dynamic analysis framework for android systems, in: Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security (CCS ’22), Los Angeles, CA, USA. pp. 3903–3916. doi:10.1145/ 3567599. [5] Bellamkonda, S., 2021. Ransomware attacks on critical infrastructure: A study of the colonial pipeline incident. International Journal of Research in Computer Applications and Information Technology . [6] Bilbrey, B.L., 2020. Noriben – automated sandbox reporting. https: //github.com/Rurik/Noriben. [Online]. [7] Bilge, L., Dumitras, T., Davaslioglu, B., 2019. Dissecting ransomware: Dynamic analysis and evading detection, in: Proceedings of the USENIX Security Symposium. [8] Bormaa, 2022. Benign-net: Benign windows executables dataset. https://github.com/bormaa/Benign-NET. GitHub, [Online]. [9] Caliskan, B., Gulatas, I., Kilinc, H.H., Zaim, A.H., 2024. The recent trends in ransomware detection and behaviour analysis, in: Proc. 17th Int. Conf. Security of Information and Networks (SIN), Sydney, Australia. doi:10.1109/SIN63213.2024.10871663. [10] Calkins, M., . Interpreting correlation coefficients. https://www.an drews.edu/~calkins/math/edrm611/edrm05.htm. [Accessed: May 8, 2025]. [11] CISA and FBI, 2021. Kaseya Ransomware Attack – Technical Summary. Technical Report. Cybersecurity Advisory Bulletin. [12] Comae Technologies, 2020. Dumpit and memory acquisition toolkit. https://www.comae.com. [Online]. [13] Cuckoo Team, 2016. Cuckoo sandbox – automated malware analysis. https://cuckoosandbox.org. [Online]. [14] Dib, A., Ghazi, S., Mehdi, M.M.S., 2023. Ransomware attack detection based on pertinent system calls using machine learning techniques. International Journal of Computer Networks and Communications (IJCNC) 15, 129–140. doi:10.5121/ijcnc.2023.15408. [15] Drabent, K., Janowski, R., Batalla, J.M., 2024. How to circumvent and beat the ransomware in android operating system—a case study of locker.cb!tr. Electronics 13, 2212. doi:10.3390/electronics13112212. [16] Ege, M., 2023. Pestudio – malware detection tool. https://www.wini tor.com. [Online]. [17] Federal Bureau of Investigation, 2025. 2024 Internet Crime Report. Technical Report. Internet Crime Complaint Center (IC3). [Online]. Available: https://www.ic3.gov/AnnualReport/Reports/2024_IC3Repor t.pdf. [18] Frida Developers, 2022. Frida: Dynamic instrumentation toolkit. https://frida.re. [Online]. [19] Fuchs, C., 2021. Procdot – visualizing process activities. https: //www.procdot.com/. [Online]. [20] González, F., Smith, R., 2022. Cyber crisis and national emergency: The 2022 costa rica ransomware campaign. Cybersecurity Policy and Strategy . [21] Gulatas, I., Kilinc, H.H., Aydin, M.A., Zaim, A.H., 2023. Iot malware detection based on opcode purification. Electrica 23, 634–642. doi:10 .5152/electrica.2023.23043. [22] Halcyon Threat Intel Team, 2023. 2023 ransomware and executable threat landscape. https://www.halcyon.ai/resources/ransomware-exe c-report. Halcyon.ai, [Online]. [23] Herrera-Silva, J.A., Hernández-Álvarez, M., 2023. Dynamic feature dataset for ransomware detection using machine learning algorithms. Sensors 23, 1053. doi:10.3390/s23031053. [24] Hex-Rays, . Ida pro disassembler. https://www.hex-rays.com/produc ts/ida/. [Accessed: June 29, 2025].
Caliskan B. et al.: Preprint submitted to Elsevier
[25] Hirano, M., Hodota, R., Kobayashi, R., 2022. Ransap: An open dataset of ransomware storage access patterns for training machine learning models. Forensic Science International: Digital Investigation 40, 301314. doi:10.1016/j.fsidi.2021.301314. [26] Hirano, M., Kobayashi, R., 2025. Ransmap: Open dataset of ransomware storage and memory access patterns for creating deep learning based ransomware detectors. Computers & Security 150, 104202. doi:10.1016/j.cose.2024.104202. [27] INetSim Team, 2019. Inetsim – internet services simulation suite. https://www.inetsim.org. [Online]. [28] Iosifache, A., 2023. Dikedataset – benign sample files. https: //github.com/iosifache/DikeDataset/tree/main/files/benign. GitHub, [Online]. [29] Jiang, J., Sun, K., 2021. Exploring sleep-based evasion in malware and defense techniques. Journal of Information Security and Applications 61, 102900. [30] Kang, M., Kim, Y., Lee, J., 2023. A survey of ransomware detection techniques: Static and dynamic perspectives. Computers & Security 125, 103020. [31] Koppanati, S., Reddy, S.S., Reddy, M.S., Reddy, M.S., 2025. Bertpowered malware detection with potential regional and contextual features, in: Proceedings of the 4th International Conference on Machine Learning and Data Engineering (iCMLDE 2024), Springer. pp. 313–327. doi:10.1007/978-3-031-87775-9_22. [32] Lashkari, A.H., Kadir, A.F.A., Taheri, L., Ghorbani, A.A., 2018. Toward developing a systematic approach to generate benchmark android malware datasets and classification, in: Proc. 2018 Int. Carnahan Conf. Security Technology (ICCST), Montreal, QC, Canada. pp. 1–8. doi:10.1109/CCST.2018.8585560. [33] Le, N.A.Q., 2014. Capstone: Disassembly framework, in: BlackHat Europe. [34] Mathew, G., Komandur, R., 2020. Delayed execution in malware: Behavior-based detection strategies. International Journal of Cybersecurity Intelligence and Cybercrime 3, 45–60. [35] Mester, A., 2023. Malware analysis and static call graph generation with radare2. Studia Universitatis Babes, –Bolyai, Informatica 68, 5– 20. doi:10.24193/subbi.2023.1.01. [36] Microsoft Docs, 2023. Pe format. https://learn.microsoft.com/en-u s/windows/win32/debug/pe-format. Microsoft Learn, [Online]. [37] Microsoft Sysinternals, 2020. Process monitor. https://docs.micro soft.com/sysinternals/downloads/procmon. [Online]. [38] Moreira, C.C., Moreira, D.C., de Sales Jr., C.S., 2023. Improving ransomware detection based on portable executable header using xception convolutional neural network. Computers & Security 130, 103265. doi:10.1016/j.cose.2023.103265. [39] Mowri, R.A., Siddula, M., Roy, K., 2022. Application of explainable machine learning in detecting and classifying ransomware families based on api call analysis. https://arxiv.org/abs/2210.11235. ArXiv preprint arXiv:2210.11235, [Online]. [40] National Security Agency, 2019. Ghidra software reverse engineering framework. https://ghidra-sre.org. [Online]. [41] Okhravi, H., et al., 2020. Software diversity: Security, resilience and detectability. ACM Computing Surveys 53, 1–33. [42] Olaimat, M., Al-Rahayfeh, A., Alkasassbeh, M., 2021. A taxonomy of anti-analysis techniques in ransomware. IEEE Access 9, 45612– 45630. [43] O’Reilly, K., Brukhovetskyy, A., 2020. Cape: Malware configuration and payload extraction. https://github.com/kevoreilly/CAPEv2. [Online]. [44] O’Connor, Y., Rowan, W., 2021. Impact of the 2021 ransomware attack on the irish health system. Canadian Journal of Nursing Informatics . [45] Radare2 Team, 2020. Radare2: Reverse engineering framework. https://rada.re/n/. [Online]. [46] RegShot Project, 2019. Regshot: Registry snapshot tool. https: //sourceforge.net/projects/regshot/. [Online].
Page 18 of 19
RansomTrack for Ransomware Detection [47] Soriano-Salvador, E., Guardiola-Múzquiz, G., 2023. Detecting and bypassing frida dynamic function call tracing: Exploitation and mitigation. Journal of Computer Virology and Hacking Techniques 19, 503–513. doi:10.1007/s11416-022-00458-7. [48] Statista, 2022. Desktop windows os market share worldwide 2013– 2022. https://www.statista.com/statistics/218089/global-market-s hare-of-windows-7/. [Online]. [49] VirusTotal, . Virustotal - free online virus, malware and url scanner. https://www.virustotal.com. [Accessed: Jul. 1, 2025]. [50] Walters, A., 2014. The volatility framework: Memory forensics. https://www.volatilityfoundation.org. [Online]. [51] Wikipedia, 2024. Portable executable. https://en.wikipedia.org/wik i/Portable_executable. [Online]. [52] Wireshark Foundation, 2023. Wireshark – network protocol analyzer. https://www.wireshark.org/. [Online]. [53] Yüksel, A.K., 2025. Malware detection using machine learning methods on the apimds dataset-6: Random forest algorithm. https:
A. Halim Zaim received his B.S. degree in computer engineering from Yildiz Technical University, Istanbul, Turkey, in 1993. He received his MS degree in Computer Engineering from Bogazici University, Istanbul, Turkey in 1996 and his Ph.D. in Electrical and Computer Engineering from North Carolina State University (NCSU), NC, USA, in 2001. His research interests include the IoT, big data, network design, cyber security, network security, and communication network protocols. He was the Vice-Rector of Istanbul Commerce University. He is currently Dean with the Department of Computer Engineering, Faculty of Engineering, Istanbul Technical University, Istanbul, Turkey.
//medium.com/ai-genai-llm/malware-detection-using-machine-learn ing-methods-on-the-apimds-dataset-6-random-forest-algorithm-584 8399ce12c. Medium, [Online].
[54] Zhou, B., Huang, H., Xia, J., Tian, D., 2024. A novel malware detection method based on api embedding and api parameters. The Journal of Supercomputing 80, 2748–2766. doi:10.1007/s11227-023 -05556-x. Busra Caliskan received the B.S. degree in biomedical engineering from Yeditepe University, Istanbul, Turkiye, in 2020, and the M.S. degree in computer engineering from Istanbul Technical University (ITU), Istanbul, in 2025. She is currently pursuing the Ph.D. degree in computer engineering at ITU.
Ibrahim Gulatas received the B.S. degree in computer engineering from the Turkish Naval Academy, Istanbul, Turkey, in 2010. He received his M.S. degree in computer engineering from Bahcesehir University, Istanbul, Turkey, in 2018, and his Ph.D. in Computer Engineering from Istanbul Commerce University, Istanbul Turkey, in 2023. His current research interests include information security, malware analysis, and machine learning applications. He has been a navy officer in the Turkish Naval Forces since 2010. His current position in the Navy is at the National Defense University in Istanbul.
H. Hakan Kilinc received his B.S. degree in Mathematics and Computer Science from Ege University, Izmir, Turkey, in 1997. He received his M.S. degree in 2001 in the Department of Computer Engineering at the Izmir Institute of Technology, Izmir, Turkey. He holds a Ph.D. about the security of SIP (Session Initiation Protocol) from the Department of Electronics Engineering at the Gebze Technical University in 2014. He was a visiting scholar at the University of Texas at Dallas from 2009 to 2011, a cybersecurity product line manager for Netas from 2014 to 2019, and, since December 2019, an Innovation Project Manager for Orion Innovation Turkey in Istanbul, Turkey.
Caliskan B. et al.: Preprint submitted to Elsevier
Page 19 of 19