Distributed Ransomware Detection using Causality Graph Reconstruction for Cybersecurity

Modern ransomware attacks exploit distributed environments through lateral movement and multi-stage execution chains that evade traditional host-centric detection systems. This paper presents a novel distributed detection framework that reconstructs system-level causality graphs across heterogeneous nodes to identify ransomware behaviors in early stages. Our approach correlates process, file, network, and memory events into an evolving provenance graph, enabling isolation of malicious encryption cascades and command-and-control patterns with significantly reduced false positives. Through evaluation on realistic attack scenarios and benign workloads, our system achieves 94.7% detection accuracy with sub-3 second median detection latency while maintaining less than 2% CPU overhead per monitored host.