Ransomware Detection Reaches 99.96% Accuracy With New AI Model

Scientists have developed an AI system that detects ransomware with 99.96% accuracy, converting malicious behavior into images to enhance cybersecurity defenses.

This new AI tool, detailed in Scientific Reports, uses a “behavior-to-image” technique that converts software actions into images the AI is able to analyze.

The researchers explain how ransomware attacks are becoming more frequent and costly, with the average ransom payment skyrocketing to $2.73 million.

The new system works by first running software through an isolated sandbox environment, allowing it to safely monitor its behavior. The system detects the specific behavior of file encryption, which is a characteristic ransomware operation. These behaviors are then converted into a two-dimensional grayscale or color image.

This image-based format allows researchers to use a technique known as ‘transfer learning’ with pre-trained AI models. The researchers explain that this step is crucial as it overcomes the major hurdle in cybersecurity tied to the lack of large, up-to-date datasets of ransomware samples for training.

“Limited data increases the overfitting risk, reduces diverse behavior identification, and undermines reliability in detecting new threats,” the authors explain.

Transfer learning allows the AI to apply knowledge gained from analyzing millions of general images to the specific task of spotting ransomware, all without needing an enormous dataset of malware samples.

The research team found that a model called ‘ResNet50’ was exceptionally good at analyzing these behavior-images.

Notably, the model reached an accuracy of 99.96% which made it highly effective at ransomware detection despite working with a small dataset.

To ensure the AI’s decisions were trustworthy and not based on random noise, the team used advanced visualization tools. They generated saliency maps, which confirmed that “the model focuses on structured behavior-encoded areas and confirms the class-specific pattern learning.”

This combination of near-perfect accuracy, the ability to work with small datasets, and a transparent decision-making process highlights the model’s potential for practical deployment