Lightweight and Explainable Early Ransomware Detection Using Dynamic <scp>API</scp> ‐Call Features and Ensemble Machine Learning

ABSTRACT Ransomware is one of the most disruptive cyber‐attacks as it can quickly encrypt files and cause economic and operational harm. Early detection refers to API call behavior collected during the first execution window before the ransomware initiates the encryption loop. Conventional detection methods that use either fixed signatures or computationally challenging deep learning models find it difficult to keep up with advanced ransomware. Furthermore, such techniques struggle with crucial operational demands like attaining low false‐positive rates (FPR), runtime efficiency and interpretability, which are vital for real‐world deployment. This work presents a lightweight and explainable early detection framework of ransomware based on dynamic API‐call features. We follow a systematic preprocessing pipeline to eliminate feature space dominance in the form of zero‐dominant features, low‐variance features, and highly‐correlated features without loss of detectability. Three machine learning models, including Logistic Regression (LR), Random Forest (RF), and LightGBM, are trained to demonstrate that high detection accuracy may be obtained with a small set of 20–50 features. The analysis contains the true positive rate (TPR) in low FPR (1% or less) and a bootstrap confidence interval to guarantee robustness, runtime profiling to understand inference performance and model size analysis. It is worth noting that LightGBM is better than the other models, with AUC of 0.9937, average precision (AP) equal to 0.9963, and TPR equal to 0.974 when the FPR is 0.01, and it is highly efficient and interpretable. Transparency on model decisions is achieved using SHAP analysis and features that lead to true and false classifications are identified. We conclude that LightGBM provides a robust, realistic and reproducible baseline for early ransomware detection, opening the way to further development with more advanced methods.