Structural Signal Divergence for Ransomware Detection: A Novel Computational Approach Using Graph-Based Entropic Perturbation Analysis

A computational framework is introduced to detect ransomware through entropy-based perturbation analysis of execution graphs, leveraging deviations in structural entropy to distinguish between benign and malicious behaviors. The proposed approach of ransomware detection models system execution as a dynamic graph, where nodes and edges encapsulate program interactions, enabling the identification of ransomware-induced anomalies. Entropy variations of ransomware, captured over successive execution intervals, quantify behavioral deviations, facilitating an entropy-based divergence scoring mechanism. The experimental evaluation demonstrated that the method achieves high accuracy in identifying ransomware variants, including LockBit, Conti, and REvil, while maintaining a controlled false positive rate. The robustness of the approach was further examined through ablation studies, highlighting the contributions of entropy estimation, graph feature extraction, and divergence scoring in ransomware detection. Comparative assessments against traditional methodologies, including signature-based and heuristic approaches, underscored the advantages of structural entropy analysis in detecting previously unseen ransomware strains. Computational efficiency of ransomware detection was also assessed, demonstrating that the framework remains viable for real-time deployment without imposing significant overhead on system resources. The findings reinforce the need for entropy-based analysis as an effective tool in combating ransomware threats, particularly against techniques designed to evade conventional detection mechanisms. The broader implications of entropy-driven anomaly detection suggest potential applications beyond ransomware identification, extending to a variety of cybersecurity challenges where structural deviations signal malicious intent.