Ransomshield: A Proactive, Behavior-Based Ransomware Detection and Automated Recovery System Using Real-Time File Entropy Analysis
Keywords:
Auto-recovery, Behavior analysis, Cyber security, FastAPI, Linux, PostgreSQL, React.js, Ransomware detection, Shannon entropy, Zero-day threatsAbstract
Ransomware is one of the most rapidly growing cyber threats globally, encrypting critical data and demanding ransom payments from victims. Traditional antivirus solutions depend on signature-based detection, which fails against new, polymorphic, and AI-generated ransomware variants. By the time conventional tools identify an attack, significant data encryption has already occurred, leading to irreversible data loss. This paper presents the design and development of a Behavior-Based Ransomware Detection and Auto-Recovery System deployed on the Linux (Ubuntu) platform. Instead of relying on known malware signatures, the system monitors and analyzes runtime behavior, making it effective against both known and zero-day ransomware variants. Testing with simulated ransomware scenarios demonstrates that the system detects attacks within 2–3 seconds, isolates malicious processes before significant damage, and restores affected files with zero permanent data loss in the tested scenarios, making it a sustainable, future-proof cybersecurity solution for critical infrastructure. All data is stored in PostgreSQL. The system continuously monitors file system activity in real time using the Linux inotify kernel subsystem, analyzes file content using the Shannon entropy algorithm to detect early-stage encryption patterns, and identifies suspicious mass file modifications that indicate ransomware propagation. Upon detection, it automatically isolates the compromised process, terminates its execution, blocks its network access, and instantly restores affected files from secure shadow backups with MD5 hash integrity verification ensuring complete data protection.
References
A. Kharaz, S. Arshad, C. Mulliner, W. Robertson, and E. Kirda, “UNVEIL: A large-scale, automated approach to detecting ransomware,” in Proceedings of the 25th USENIX Security Symposium, 2016, pp. 757–772.
N. Scaife, H. Carter, P. Traynor, and K. R. B. Butler, “CryptoLock (and drop it): Stopping ransomware attacks on user data,” in Proceedings of the 2016 IEEE 36th International Conference on Distributed Computing Systems (ICDCS), 2016, pp. 303–312.
A. Continella et al., “ShieldFS: A self-healing, ransomware-aware filesystem,” in Proceedings of the 32nd Annual Conference on Computer Security Applications, 2016, pp. 336–347.
K. Lee, S.-Y. Lee, and K. Yim, “Machine learning based file entropy analysis for ransomware detection in backup systems,” IEEE Access, vol. 7, pp. 110205–110215, 2019.
F. M. Alotaibi and V. G. Vassilakis, “SDN-based detection of self-propagating ransomware: The case of BadRabbit,” IEEE Access, vol. 9, pp. 28039–28058, 2021.
A. Breus, H. Lasker, P. Antonov, L. Gattuso, and V. Andersen, “Real-time ransomware detection using behavioral entropy analysis for secure file systems,” TechRxiv, Nov. 2024.
L. Harishni, “Real-time ransomware detection and response system using behavioural file and process monitoring,” SSRN Electronic Journal, Jul. 2025.
K. Pekepok, P. Kirkwood, E. Christopolous, F. Braithwaite, and O. Nightingale, “Hierarchical pattern decryption methodology for ransomware detection using probabilistic cryptographic footprints,” arXiv, 2025.
E. O. Aryeetey and L. Garg, “Leveraging AI and machine learning for ransomware and malware detection in cloud environments: A state-of-the-art review,” in Internet of Things, Smart Spaces, and Next Generation Networks and Systems, 2026, pp. 129–147.
Cloud Security Alliance AI Safety Initiative, “The attacker’s coding partner: AI-assisted ransomware development,” Cloud Security Alliance Research Note, Jun. 3, 2026.
C.-M. Hsu, C.-C. Yang, H.-H. Cheng, P. E. Setiasabda, and J.-S. Leu, “Enhancing file entropy analysis to improve machine learning detection rate of ransomware,” IEEE Access, vol. 9, pp. 138345–138351, 2021.
E. Kolodenker, W. Koch, G. Stringhini, and M. Eggle, “PayBreak: Defense against cryptographic ransomware,” in Proceedings of the ACM on Asia Conference on Computer and Communications Security, 2017, pp. 599–611.
B. A. S. Al-rimy, M. A. Maarof, and S. Z. M. Shaid, “Ransomware threat success factors, taxonomy, and countermeasures: A survey and research directions,” Computers & Security, vol. 74, pp. 144–166, May. 2018.
J. A. Gómez-Hernández, L. Álvarez-González, and P. García-Teodoro, “R-Locker: Thwarting ransomware action through a honeyfile-based approach,” Computers & Security, vol. 73, pp. 389–398, Mar. 2018.
G. O. Ganfure, C.-F. Wu, Y.-H. Chang, and W.-K. Shih, “DeepGuard: Deep generative user-behavior analytics for ransomware detection,” 2020 IEEE International Conference on Intelligence and Security Informatics (ISI), Arlington, VA, USA, 2020, pp. 1–6.
