https://matjournals.net/engineering/index.php/JoHTDCPCV <p><strong>JoHTDCPCV</strong> is a peer reviewed journal of Computer Science domain published by MAT Journals Pvt. Ltd. It is a print and e-journal focused towards the rapid publication of fundamental research papers on all areas of Hacking Techniques, Digital Crime Prevention and Computer Virology. The hacking Techniques include Phishing, Fake WAP's (Wireless Access Point), Waterhole Attacks, Brute Forcing, Bait &amp; Switch, and Click Jacking. JoHTDCPCV also covers Computer Virology and its theoretical underpinnings, mathematical aspects, algorithmics, Computer Immunology, and Biological Models for Computers but the scope of this journal is not limited to this. Other topics include Reverse Engineering (Hardware and Software), Viral and Antiviral Technologies, Tools and Techniques for Cryptology and Steganography, applications in Computer Virology, Virology and IDS, Hardware Hacking, Free and Open Hardware, Operating System, Network, and Embedded Systems Security, and Social Engineering.</p> en-US Journal of Hacking Techniques, Digital Crime Prevention and Computer Virology https://matjournals.net/engineering/index.php/JoHTDCPCV/article/view/4232 <p><em>Ransomware is one of the most rapidly growing cyber threats globally, encrypting critical data and demanding ransom payments from victims. Traditional antivirus solutions depend on signature-based detection, which fails against new, polymorphic, and AI-generated ransomware variants. By the time conventional tools identify an attack, significant data encryption has already occurred, leading to irreversible data loss. This paper presents the design and development of a Behavior-Based Ransomware Detection and Auto-Recovery System deployed on the Linux (Ubuntu) platform. Instead of relying on known malware signatures, the system monitors and analyzes runtime behavior, making it effective against both known and zero-day ransomware variants. Testing with simulated ransomware scenarios demonstrates that the system detects attacks within 2–3 seconds, isolates malicious processes before significant damage, and restores affected files with zero permanent data loss in the tested scenarios, making it a sustainable, future-proof cybersecurity solution for critical infrastructure. </em><em>All data is stored in PostgreSQL. The system continuously monitors file system activity in real time using the Linux inotify kernel subsystem, analyzes file content using the Shannon entropy algorithm to detect early-stage encryption patterns, and identifies suspicious mass file modifications that indicate ransomware propagation. Upon detection, it automatically isolates the compromised process, terminates its execution, blocks its network access, and instantly restores affected files from secure shadow backups with MD5 hash integrity verification ensuring complete data protection.</em></p> Rajukumar Gupta Vijya D Dharnish C. B Karthikeyan S Copyright (c) 2026 Journal of Hacking Techniques, Digital Crime Prevention and Computer Virology 2026-10-06 2026-10-06 1 11