Next-Generation Ransomware Defense: High-Performance Computing Strategies for Monitoring Disk I/O and CPU Performance

Ransomware frequently bypasses antivirus tools, encrypting files and making data inaccessible. Traditional detection methods, which involve monitoring processes, system calls, and file activities, have high overhead and can be disrupted by sophisticated ransomware. This Researchintroduces a method for detecting ransomware on a virtual machine by collecting specific processor and disk I/O event data from the host machine and using a machine learning classifier. The random forest model excelled among seven classifiers, achieving 0.98 accuracy within 400 milliseconds across various user loads and 22 ransomware types. INDEX TERMS Deep learning, disk statistics, hardware performance counters, machine learning, ransomware, virtual machines.