A Practical Framework for Ransomware Detection and Mitigation Strategies

Ransomware attacks have emerged as one of the most significant cyber threats, particularly targeting financial organizations, with incidents rising from 48% in 2020 to 64% in 2023. Despite the increasing frequency of ransomware attacks, existing detection mechanisms struggle to effectively identify and mitigate new and evolving ransomware variants, leaving financial organizations highly vulnerable to cyber extortion. This paper presents a comprehensive detection algorithm aimed at well-known ransomware families such as WannaCry, NotPetya, Locky, and Ryuk, alongside a practical strategy for detection and prevention. Additionally, the proposed ransomware detection system examines suspicious strings, heuristic rules, file structures, executable file extensions, and Command and Control (CnC) server patterns. Evaluated against a dataset of 144 files, including both ransomware samples and benign documents, the system achieves an accuracy of over 81%, a precision of 82.86%, and a recall of 80.56%. Finally, the study outlines a multi-layered mitigation strategy encompassing prevention, detection, incident response, and recovery procedures.