Intrusion Detection System for Ransomware in Network Traffic Using Supervised Machine Learning

Ransomware is one of the most dangerous cyber threats today, as it can disrupt systems and cause serious financial losses. Traditional detection methods often fail to catch newer attacks because they can hide within normal network traffic. In this study, we used machine learning to detect ransomware based on network data. We tested four models Logistic Regression, Decision Tree, Random Forest, and Gradient Boosting using the UGRansome dataset, both before and after balancing it with SMOTE. The Decision Tree model gave the best results, achieving 99.40% accuracy, 98.0% precision, 99.90% recall, and an AUC-ROC of 99.95%. We also found that protocol flags and network flow features played a key role in detecting attacks. Overall, using tree-based models with balanced data proved to be a simple and effective way to build a real-time ransomware detection system.

@article{Almulla2026,
  title     = {Intrusion Detection System for Ransomware in Network Traffic Using Supervised Machine Learning},
  journal   = {International Journal of Advanced Computer Science and Applications},
  volume    = {17},
  number    = {5},
  year      = {2026},
  publisher = {The Science and Information Organization},
  author    = {Ziad Almulla and Moath Alamri and Mounir Frikha},
  doi       = {10.14569/IJACSA.2026.0170581},
  url       = {https://doi.org/10.14569/IJACSA.2026.0170581}
}