A Sysmon Event-based Machine Learning Approach to Ransomware Detection

Abstract

The rapidly increasing cyber threat landscape has caused a huge impact on a large number of sectors worldwide, and among them ransomware is one of the most critical threats that should be controlled effectively. This paper presents a solution for detecting ransomware by leveraging features extracted from Windows Sysmon event logs, combined with machine learning based classification. A minimal set of key Sysmon events are collected and a comprehensive set of features are generated from it by a lightweight endpoint agent. These feature vectors are then transmitted to a cloud-based inference model for real time analysis, which ensures low overhead on the endpoints while allowing for a high scalability. Four machine learning models were evaluated on a publicly available dataset and XGBoost was selected as the suitable model for this solution due to its high accuracy while maintaining the fastest inference speed. Overall, this solution is capable of detecting ransomware with high precision and a low false negative rate, while maintaining fast inference times and a minimal processing overhead on the endpoints. The architecture enables scalable, real-time ransomware detection suitable for both enterprise and individual environments.