Abstract: Ransomware remains a critical and evolving cybersecurity threat, increasingly rendering traditional signature-based detection techniques ineffective. While modern machine learning models achieve high detection accuracy, they often operate as opaque “black boxes”, introducing a significant explainability gap that undermines analyst trust. In addition, behavior-based anomaly detection systems frequently suffer from high false-positive rates, limiting their operational viability. To address these challenges, this study adopts a Design Science Research Methodology to develop a novel, interpretable, multi-stage ransomware detection framework. The proposed architecture integrates three complementary components: a bio-inspired Negative Selection Algorithm from Artificial Immune Systems to filter benign behavioral patterns, a first-order Markov chain model to capture probabilistic deviations in execution sequences, and a Random Forest ensemble classifier to synthesize these signals for final decision-making. The framework is evaluated using a dual-pipeline experimental design on real-world ransomware and benign software samples, enabling controlled comparison between probabilistic and pattern-based behavioral modeling. Experimental results demonstrate that the proposed approach achieves high detection performance while maintaining a low false-positive rate and providing interpretable behavioral evidence. Overall, the framework offers a principled balance between detection effectiveness and interpretability, addressing key limitations of existing ransomware detection systems.

Mohammed A. F. Salah, Mohd Fadzli Marhusin and Rossilawati Sulaiman. “A Bio-Inspired Behavior-Based Hybrid Framework for Ransomware Detection”. International Journal of Advanced Computer Science and Applications (IJACSA) 16.12 (2025). http://dx.doi.org/10.14569/IJACSA.2025.0161241

@article{Salah2025,
title = {A Bio-Inspired Behavior-Based Hybrid Framework for Ransomware Detection},
journal = {International Journal of Advanced Computer Science and Applications},
doi = {10.14569/IJACSA.2025.0161241},
url = {http://dx.doi.org/10.14569/IJACSA.2025.0161241},
year = {2025},
publisher = {The Science and Information Organization},
volume = {16},
number = {12},
author = {Mohammed A. F. Salah and Mohd Fadzli Marhusin and Rossilawati Sulaiman}
}