Sequence Learning over Behavioral Attack Patterns for Early Detection of Human-Operated Ransomware

Human-Operated Ransomware (HoR) is one of the most persistent and evolving threats in cybersecurity, as attackers use changing Tactics, Techniques, and Procedures (TTPs) to evade traditional detection. The lack of structured and publicly available TTP-level datasets has limited the development of models capable of identifying HoR behavior early. In this study, we construct a dataset of TTP sequences from 15 prominent ransomware families observed in 2023 and 2024, structured according to the MITRE ATT&CK framework. We evaluate a range of sequence modeling approaches, including Markov chains, n-gram analysis, LSTM, GRU, and RNN, to classify ransomware behavior based on the progression of observed TTPs. The RNN model achieved the highest accuracy of 82% and an AUC of 0.9694 (95% CI: 0.0087–0.0168), with an average false positive rate between 0.0087 and 0.0168 using 10-fold cross-validation. SMOTE was used to address class imbalance, improving model accuracy by 6% (from 76% to 82%). These results show that learning from ordered TTP patterns can support timely detection of ransomware activity, enabling earlier intervention in threat response workflows.