Ransomware Detection Using Machine Learning-Based Analysis of High-Performance Computing I/O Behaviour

Abstract

Ransomware has emerged as one of the most destructive forms of malicious software,
capable of encrypting critical user and system data and demanding ransom for recovery.
Traditional signature-based detection techniques are often insufficient against evolving
ransomware variants. This study proposes a machine learning-based ransomware detection
system that analyzes High-Performance Computing (HPC) input/output (I/O) behavior and
system resource usage patterns to distinguish between benign and malicious processes. The
proposed approach utilizes features such as read/write operations, byte-level I/O activity,
CPU and memory utilization, file modification frequency, and entropy measures to
characterize system behavior.
A Random Forest classifier is employed due to its robustness, high accuracy, and ability to
handle nonlinear relationships among features. The dataset is preprocessed using Min-Max
scaling to normalize feature ranges and improve model performance. The trained model is
integrated into a user-friendly Tkinter-based graphical interface, enabling real-time
prediction of ransomware activity based on user-provided system metrics.
Experimental results indicate that the system effectively differentiates ransomware from
normal processes with high reliability, demonstrating the potential of behavior-based
machine learning models in cybersecurity applications. This approach provides an efficient
and scalable solution for early ransomware detection in HPC environments, contributing to
enhanced system security and threat mitigation.