Early ransomware detection using static multi-view analysis

Abstract

Ransomware remains one of the most disruptive forms of cyberattack due to its ability to encrypt critical data, interrupt services, and impose severe operational and financial damage across a wide range of digital environments. Although early ransomware detection has attracted substantial research attention, achieving reliable detection before execution remains difficult, particularly because many high-performing approaches depend on dynamic analysis, runtime monitoring, or hybrid pipelines that increase deployment overhead and may delay intervention until malicious behavior has already begun. This challenge is further intensified by the continued evolution of ransomware families and the need for detection mechanisms that are not only accurate, but also lightweight, safe, and practical for prevention-oriented deployment. To address this problem, this thesis proposes a static multi-view framework for the early detection of ransomware from Windows Portable Executable (PE) files by integrating multiple complementary forms of static evidence, including numeric PE metadata, tokenized textual artifacts, graph-derived import-relationship patterns, and rule-based semantic tags. By preserving these views separately and combining them through probability-level fusion, the framework is designed to capture richer discriminatory signals than single-view static methods while avoiding the cost, risk, and operational complexity associated with executing suspicious samples. Experimental results show that static evidence alone can support very strong early-detection performance, with the selected Text + Rule fusion achieving a validation ROC-AUC of 0.9989 and a PR-AUC of 0.9992, while held-out and family-wise evaluations further indicate strong generalization across recent and diverse ransomware families. These findings show that practical and deployment-efficient ransomware detection can be achieved in a pre-execution setting through carefully designed static multi-view analysis.