Explainable AI (XAI) for Ransomware Detection at Pre-Encryption Stage (PES)

Ransomware represents a new menace to cyber infrastructure, with the potential to encrypt data before traditional defenses can respond. Signature-based detection mechanisms are becoming increasingly ineffective due to advanced evasion strategies, including obfuscation, polymorphism, and zero-day exploits. To counter this challenge, we propose a model of explainable machine learning to detect ransomware in the pre-encryption stage (PES), enabling pre-emptive action. The System utilizes dynamic behavioral characteristics from System and API calls, combined with model-agnostic explainability techniques, such as Shapley Additive Explanations (SHAP) and Local Interpretable Model-Agnostic Explanations (LIME), to achieve both high predictive power and interpretability. Experimental tests demonstrate 97.5% detection accuracy using the Random Forest classifier, high F1-scores using other classifiers, and very low false positives. The integration of SHAP and LIME provides both global and local explanations of classification decisions, enabling real-time responses, forensic verification, and operational trust. The model offers an interpretable and efficient method of early-stage ransomware detection in modern cybersecurity environments.