A Dual-Stage Ransomware Defense Framework Combining an Artificial Immune System and Honeyfile Traps

The escalating sophistication of ransomware requires defensive strategies that are both proactive against zero-day attacks and operationally efficient. Existing solutions often force a trade-off—sacrificing low false-positive rates for broad detection, or vice versa. This work introduces an integrated framework designed to transcend this limitation. Our dual-stage approach synergizes pre-encryption behavioral analysis with definitive post-encryption confirmation. The first stage employs a specialized artificial immune system (AIS) that monitors a curated set of 47 features, including API-call n-grams and file entropy dynamics, to identify malicious activity before file encryption begins. This pre-emptive analysis is complemented by an enhanced, cross-platform R-Locker mechanism, which uses Windows named pipes and symbolic links to deploy honeyfiles that trap ransomware during I/O operations, providing a high-fidelity trigger for automated containment. We subjected this framework to a rigorous evaluation against 3500 real-world ransomware samples and 12,000 benign applications. The results demonstrate a 98.2% detection rate with a 0.8% false-positive rate, achieving a mean response time of 1.3 s. A key finding is the framework’s efficiency on both Windows and Linux (the only platforms tested), with the AIS and R-Locker modules consuming a combined 101 MB of memory. While the system excels in real-time detection, we note that its current memory forensics capability for key recovery is incompatible with certain ransomware families due to architectural obfuscations. Our findings suggest that the integrated approach performs well under laboratory conditions; further real-world validation is required to confirm robustness in diverse environments.