Real-Time Endpoint Ransomware Detection and Prevention via Strategic Deception Directories and Block-Level Entropy Analysis

Ransomware remains a major endpoint-security threat because destructive file operations can progress rapidly and modern attacks may use fileless execution and Living-off-the-Land (LotL) techniques. This paper presents a lightweight host-based ransomware detection and prevention prototype for Windows endpoints that combines three mechanisms: strategically placed deception directories (1000_Trap), localized Shannon-entropy analysis, and automated process termination using psutil. The prototype was evaluated in a controlled Windows 10 virtual-machine testbed using the PSRansom simulator across 50 executions. Under this specific PSRansom configuration, all 50 runs were detected, 5-15 decoy files were encrypted before termination, and no protected user files in Desktop, Documents, Downloads, or Pictures were modified. Mean end-to-end containment latency was approximately 5 s, with observed active-phase values ranging from 4820 to 5150 ms, reflecting user-space event-queue and process-handling overhead. Idle CPU utilization remained below 5%. The benign workload cases evaluated in this study, ZIP compression, document editing, spreadsheet processing, media playback, and PDF generation, produced no mitigation events. These results demonstrate feasibility within the tested PSRansom scenario rather than general robustness against all ransomware families or traversal strategies. Random or selective traversal, multi-process encryption, intermittent encryption, privilege escalation, and user-space evasion were not experimentally validated and are treated as limitations and priorities for future evaluation.

Ransomware Detection; Host-Based Intrusion Prevention; Shannon Entropy; Honeypot Deception; Endpoint Security.

1. Razaulla, S., Fachkha, C., Markarian, C., Gawanmeh, A., Mansoor, W., Fung, B. C. M., & Assi, C. (2023). The Age of Ransomware: A Survey on the Evolution, Taxonomy, and Research Directions. IEEE Access, 11, 40698-40723. https://doi.org/10.1109/ACCESS.2023.3268535 [Google Scholar] [Crossref]

2. Kara, I., & Aydos, M. (2022). The rise of ransomware: Forensic analysis for Windows based ransomware attacks. Expert Systems with Applications, 190, 116198. https://doi.org/10.1016/j.eswa.2021.116198 [Google Scholar] [Crossref]

3. Barr-Smith, F., Ugarte-Pedrero, X., Graziano, M., Spolaor, R., & Martinovic, I. (2021). Survivalism: Systematic Analysis of Windows Malware Living-Off-The-Land. 2021 IEEE Symposium on Security and Privacy (SP), 1557-1574. https://doi.org/10.1109/SP40001.2021.00047 [Google Scholar] [Crossref]

4. Sudhakar, & Kumar, S. (2020). An emerging threat Fileless malware: a survey and research challenges. Cybersecurity, 3, Article 1. https://doi.org/10.1186/s42400-019-0043-x [Google Scholar] [Crossref]

5. Kharaz, A., Arshad, S., Mulliner, C., Robertson, W., & Kirda, E. (2016). UNVEIL: A Large-Scale, Automated Approach to Detecting Ransomware. 25th USENIX Security Symposium, 757-772. [Google Scholar] [Crossref]

6. Kharraz, A., & Kirda, E. (2017). Redemption: Real-Time Protection Against Ransomware at End-Hosts. Research in Attacks, Intrusions, and Defenses (RAID 2017), 98-119. https://doi.org/10.1007/978-3-319-66332-6_5 [Google Scholar] [Crossref]

7. Scaife, N., Carter, H., Traynor, P., & Butler, K. R. B. (2016). CryptoLock (and Drop It): Stopping Ransomware Attacks on User Data. 2016 IEEE 36th International Conference on Distributed Computing Systems (ICDCS). https://doi.org/10.1109/ICDCS.2016.46 [Google Scholar] [Crossref]

8. Mehnaz, S., Mudgerikar, A., & Bertino, E. (2018). RWGuard: A Real-Time Detection System Against Cryptographic Ransomware. Research in Attacks, Intrusions, and Defenses (RAID 2018), 114-136. https://doi.org/10.1007/978-3-030-00470-5_6 [Google Scholar] [Crossref]

9. De Gaspari, F., Hitaj, D., Pagnotta, G., De Carli, L., & Mancini, L. V. (2022). Evading behavioral classifiers: a comprehensive analysis on evading ransomware detection techniques. Neural Computing and Applications, 34, 12077-12096. https://doi.org/10.1007/s00521-022-07096-6 [Google Scholar] [Crossref]

10. Davies, S. R., Macfarlane, R., & Buchanan, W. J. (2022). Comparison of Entropy Calculation Methods for Ransomware Encrypted File Identification. Entropy, 24(10), 1503. https://doi.org/10.3390/e24101503 [Google Scholar] [Crossref]

11. Lee, K., Lee, S.-Y., & Yim, K. (2019). Machine Learning Based File Entropy Analysis for Ransomware Detection in Backup Systems. IEEE Access, 7, 110205-110215. https://doi.org/10.1109/ACCESS.2019.2931136 [Google Scholar] [Crossref]

12. Lee, K., Lee, J., Lee, S.-Y., & Yim, K. (2023). Effective Ransomware Detection Using Entropy Estimation of Files for Cloud Services. Sensors, 23(6), 3023. https://doi.org/10.3390/s23063023 [Google Scholar] [Crossref]

13. Jung, S., & Won, Y. (2018). Ransomware detection method based on context-aware entropy analysis. Soft Computing, 22, 6731-6740. https://doi.org/10.1007/s00500-018-3257-z [Google Scholar] [Crossref]

14. Pont, J., Arief, B., & Hernandez-Castro, J. C. (2020). Why Current Statistical Approaches to Ransomware Detection Fail. Information Security (ISC 2020), 199-216. https://doi.org/10.1007/978-3-030-62974-8_12 [Google Scholar] [Crossref]

15. Casino, F., Hurley-Smith, D., Hernandez-Castro, J., & Patsakis, C. (2025). Not on my watch: ransomware detection through classification of high-entropy file segments. Journal of Cybersecurity, 11(1), tyaf009. https://doi.org/10.1093/cybsec/tyaf009 [Google Scholar] [Crossref]

16. Sheen, S., Asmitha, K. A., & Venkatesan, S. (2022). R-Sentry: Deception based ransomware detection using file access patterns. Computers & Electrical Engineering, 103, 108346. https://doi.org/10.1016/j.compeleceng.2022.108346 [Google Scholar] [Crossref]

17. Kim, T. (2023). Deception-based Method for Ransomware Detection. Journal of Internet Services and Information Security, 13(3), 191-201. https://doi.org/10.58346/JISIS.2023.I3.012 [Google Scholar] [Crossref]

18. Liu, L., Gao, X., Liu, Y., & Zhang, L. (2026). Finding vulnerable drivers with hooking and reading result verification. Cybersecurity, 9, Article 166. https://doi.org/10.1186/s42400-025-00434-w [Google Scholar] [Crossref]

19. JoelGMSec. (2026). PSRansom: PowerShell Ransomware Simulator with C2 Server [Software]. GitHub repository (accessed 2026). [Google Scholar] [Crossref]

20. Shannon, C. E. (1948). A Mathematical Theory of Communication. Bell System Technical Journal, 27, 379-423 and 623-656. [Google Scholar] [Crossref]

• Assessment of the Role of Artificial Intelligence in Repositioning TVET for Economic Development in Nigeria
• Teachers’ Use of Assure Model Instructional Design on Learners’ Problem Solving Efficacy in Secondary Schools in Bungoma County, Kenya
• “E-Booksan Ang Kaalaman”: Development, Validation, and Utilization of Electronic Book in Academic Performance of Grade 9 Students in Social Studies
• Analyzing EFL University Students’ Academic Speaking Skills Through Self-Recorded Video Presentation
• Major Findings of The Study on Total Quality Management in Teachers’ Education Institutions (TEIs) In Assam – An Evaluative Study