Network-Centric Ransomware Intrusion Detection Framework

Abstract For decades,ransomware remains one of disruptive cyber threats. Existing detection tools predominantly Host-Based to prevent the delivery and execution of malicious payload can be bypassed by most evasive attacks such as zero-day payloads, compromised credentials and insiders executing payloads stealthily. When it happens, network‑layer telemetry becomes the final line of visibility for identifying ongoing intrusions. Yet, despite its strategic importance, Machine Learning detection using network traffic behavior has received noticeably less attention in recent research \cite{alshamrani2024ransomwareML} and have been criticized for behavioral overlap [1], limited observability [2] and environment bias [3]. This work proposes a framework that identifies ransomware victim nodes through network traffic analysis. The framework is based on a new network analysis technique referred to as Traffic of Interest (ToI) and its derivative indicators of compromise patterns. The experimentation shows that the framework performs well with the most common Machine Learning model, achieving 99.64\% precision, 0\% false negative rate (FNR), and a minimal false positive rate (FPR) for \textbf{normal detection} and 99.44\% accuracy for \textbf{early detection}. In addition, we discovered network packet features that correctly identify each ransomware family that we studied, so we collected them into a data set/repository that can then be referenced by other network monitoring solutions/appliances for a fast track to well-known strains that could have evaded endpoint detection tools.