A Hybrid Feature-based Approach for Early Ransomware Detection: Leveraging Behavioral, Network, and Static Characteristics

Abstract

—The growing difficulty of ransomware attacks highlights the urgent need for intelligent, real-time detection strategies that can mitigate threats before data encryption occurs. Traditional single-source detection methods often fail to identify rapidly evolving ransomware variants during their early encryption stages. This paper presents a hybrid ransomware detection framework that integrates behavioral system Application Programming Interface (API) call sequences, network traffic features from Canadian Institute for Cybersecurity Intrusion Detection System dataset (CICIDS), and static Portable Executable (PE) attributes from the Elastic Malware Benchmark for Empowering Researchers dataset (EMBER). A time-windowed data modeling technique is used to capture early-stage ransomware behavior within the first few seconds of execution. The proposed framework employs a hybrid Recurrent Neural Network (RNN) and Bidirectional Long Short-Term Memory (BiLSTM) deep learning model to learn both sequential and contextual patterns across the fused feature space. Experimental results demonstrate high accuracy (0.96) and early detection capability within 3 s, significantly outperforming traditional machine learning baselines. The system effectively detects known and unknown ransomware families by leveraging a multi-perspective view of ransomware activity. This study demonstrates the potential of hybrid feature integration and time-sensitive learning in enhancing early ransomware detection, contributing to the development of robust