Ransomware Detection using LLMs and GraphRAG

Ransomware continues to represent a significant cybersecurity challenge due to its evolving variants and complex evasion techniques, which often succeed in outpacing existing security detection methods, and produce (severe) impact spread across various countries and systems. At the same time, recent developments in the AI (Artificial Intelligence) domain provide new opportunities for developing intelligent solutions that can contribute to tackling such challenges. To this end, this research builds a novel LLM (Large Language Model) based system for ransomware detection enhanced with GraphRAG (Graph Retrieval-Augmented Generation), accounting for both effective graph-based representation and information retrieval in this process. On this basis, the Design Science Research methodology is applied in a Data Science research approach where the ransomware detection system is developed using two ransomware datasets, feature selection mechanisms, and various prompt engineering strategies such as CoT (Chain-of-Thought). Furthermore, a comprehensive evaluation is conducted to assess the effectiveness of the GraphRAG mechanism in relation to a logistic regression baseline model. Accordingly, the results obtained are promising (accuracy of around 90%) and further reveal lessons learned about the importance of using domain-specific data and knowledge in this field in conjunction with advanced AI models.