Jeffery Baker

and 4 more

As ransomware attacks grow in complexity, traditional detection methods face significant challenges in identifying the advanced tactics, techniques, and procedures that define contemporary ransomware behaviors. Developing detection methodologies that capture the intricate and dynamic interactions of ransomware across encrypted networks presents an opportunity for innovation in cybersecurity. Hypergraph-Driven Anomalous Behavior Profiling (HDABP) offers a novel and scalable solution through representing complex network relationships in hypergraph structures, allowing for more precise detection of multi-faceted ransomware behaviors that evade conventional graph-based and signature-driven techniques. HDABP extends beyond simple pairwise relations, modeling high-order dependencies and unique interaction patterns within ransomwareinfected networks, thus revealing subtle anomalies associated with ransomware propagation and lateral movement. A comprehensive evaluation demonstrates HDABP's effectiveness through its high detection accuracy, resource efficiency, and adaptability in encrypted environments, where traditional detection methods are limited. Tested across multiple ransomware families and network conditions, HDABP achieves consistent low-latency performance and low false-positive rates, providing reliable detection capabilities crucial for real-time cybersecurity applications. HDABP's design also enables deployment within sectors that prioritize data privacy, such as finance and healthcare, while maintaining efficacy in recognizing evolving ransomware tactics without direct payload inspection. Through bridging theoretical hypergraph analysis with practical cybersecurity applications, HDABP represents a substantial advancement in ransomware detection, enhancing resilience against increasingly sophisticated ransomware threats.