Albert Limer

and 4 more

The increasing complexity of modern cyber threats requires the development of more advanced and dynamic detection systems, capable of adapting to new and evolving attack vectors. Dynamic Behavior Trace Profiling (DBTP) introduces a novel method for ransomware detection, utilizing real-time behavior analysis to identify malicious activities without relying on static signatures. Through continuous monitoring of systemlevel events, such as file I/O operations, network anomalies, and process manipulation, DBTP constructs detailed behavioral profiles that distinguish between benign and malicious activities. The system's modular architecture enables it to efficiently handle large volumes of data while maintaining low detection latency, making it suitable for real-time deployment in diverse operational environments. Experimental results highlight DBTP's high detection accuracy, particularly in identifying file-based ransomware activities, while also demonstrating its adaptability to previously unseen ransomware variants. False positive and false negative rates remain low across different test scenarios, indicating the system's reliability. Moreover, DBTP's capacity to function under high system load conditions with minimal resource overhead positions it as an effective solution for modern cybersecurity infrastructures. Overall, DBTP provides a scalable, automated, and adaptive tool for detecting and mitigating ransomware threats, significantly enhancing the resilience of systems against emerging and sophisticated ransomware attacks.