Development of Enhanced Ransomware Detection Model Using Hybrid Static-Dynamic Feature Integration

Ransomware remains a devastating cyber threat, encrypting critical data, disrupting operations, and extorting ransoms, with global losses exceeding $20 billion in 2024 and projected to reach $265 billion annually by 2031. Conventional detection methods, limited to static or dynamic analysis, falter against advanced, obfuscated, and zero-day variants. This study introduces a hybrid AI model for ransomware detection, employing a late-fusion framework to integrate static and dynamic features. It combines an Enhanced Multi-Layer Perceptron (MLP) trained on 500 static features from the EMBER dataset with a Conditional Variational Autoencoder 1-Dimensional Convolutional Neural Network (CVAE–1D CNN) trained on 1,000 dynamic behavioural features from the MLRan dataset. Model predictions are fused via optimized weighted averaging to enhance performance, especially on unseen families. Evaluations reveal superior results: 95.14% accuracy, 89.77% macro F1-score, 94.2% recall, and 95.33% zero-day F1-score, outperforming single-model baselines. Integrating static pre-execution and dynamic runtime features boosts detection accuracy and generalization. The static component's compact 3.8 Megabyte size suits resource-constrained deployments. This hybrid solution provides a robust, scalable defence for multi-family ransomware, strengthening enterprise cybersecurity.

Ransomware detection; hybrid model

1. Abdullah, A., & Rahman, M. (2024). Comparative study of machine learning models for ransomware detection. International Journal of Information Security, 23(4), 2456–2472. [Google Scholar] [Crossref]

2. Ahmed, Y. A., Koçer, B., & Al-Rimy, B. A. S. (2020). Automated analysis approach for the detection of high survivable ransomware. KSII Transactions on Internet and Information Systems, 14, 2236–2257. [Google Scholar] [Crossref]

3. Al-Qahtani, A. B., & Pandurangan, V. (2025). Deep learning-based ransomware detection model with a hybrid framework. International Journal of Cybersecurity Intelligence and Crime, 3(1), 1–13. [Google Scholar] [Crossref]

4. Aldauiji, A., Alghamdi, M., Alshehri, F., & Alharbi, S. (2022). Cross-platform ransomware detection using transfer learning across Windows and Linux environments. IEEE Access, 10, 12345–12358. [Google Scholar] [Crossref]

5. Almomani, A., Alauthman, M., & Aslam, N. (2023). Deep learning-based ransomware detection framework for modern cyber-attacks. Journal of Information Security and Applications, 72, 103336. [Google Scholar] [Crossref]

6. Bold, V., Klein, M., Rossi, L., & Schmidt, A. (2022). Ransomware detection using CNN-LSTM hybrid deep learning on API call sequences. Computers & Security, 121, 102859. [Google Scholar] [Crossref]

7. Bovet, G., Martinez Perez, G., & Stiller, B. (2023). Behavioural fingerprinting to detect ransomware in resource-constrained devices. Computers & Security, 135, 103510. [Google Scholar] [Crossref]

8. Cable, J., Gray, I., & McCoy, D. (2024). Showing the receipts: Understanding the modern ransomware ecosystem. Proceedings of the 2024 APWG Symposium on Electronic Crime Research (eCrime), 149–161. [Google Scholar] [Crossref]

9. Cen, M., Deng, X., Jiang, F., & Doss, R. (2024). Zero-Ran Sniff: A zero-day ransomware early detection method based on zero-shot learning. Computers & Security, 142, 103849. [Google Scholar] [Crossref]

10. Cen, M., Jiang, F., & Doss, R. (2025). RansoGuard: A RNN-based framework leveraging pre-attack sensitive APIs for early ransomware detection. Computers & Security, 150, 104293. [Google Scholar] [Crossref]

11. Cho, D., Kim, H., Kang, S., Kim, G., & Kim, J. (2025). Trends in ransomware attacks: Infiltration and encryption mechanisms of LockBit, Hive, and Akira. Research Briefs on Information and Communication Technology Evolution, 11, 159–167. [Google Scholar] [Crossref]

12. Cui, B., Hu, Y., Zhang, X., & Sun, L. (2025). A novel zero-day ransomware detection approach based on CVAE and 1D-CNN. High-Confidence Computing, 3(3), 100192. [Google Scholar] [Crossref]

13. Elgawish, A., Mahmoud, M. A., Alfawareh, H. M., & Alazab, M. (2022). Network-based ransomware detection using graph neural networks on traffic flow patterns. Journal of Network and Computer Applications, 198, 103289. [Google Scholar] [Crossref]

14. Hussain, A., Khan, R., & Ali, S. (2025). BERT-based dynamic ransomware classification on API call sequences. International Journal of Cybersecurity Research, 12(1), 45–58. [Google Scholar] [Crossref]

15. Kritika, E. (2024). A comprehensive literature review on ransomware detection using deep learning. Cyber Security and Applications, 3, 100078. [Google Scholar] [Crossref]

16. Naik, N., Jenkins, P., Cooke, R., & Day, L. (2022). Adversarial machine learning attacks against ransomware detection: A comparative study. Journal of Cybersecurity and Privacy, 2(3), 567–589. [Google Scholar] [Crossref]

17. Ogunleye, O. O., Awele, O. C., & Oluwafemi, T. R. (2025). Analysis of emerging cybersecurity threats in Nigeria's financial sector: Ransomware, phishing, and insider-threat impact. International Journal of Research and Innovation in Social Science, 9(7), 342–357. [Google Scholar] [Crossref]

18. Ojo, A. O. (2025). Ransomware trends and mitigation strategies: A comprehensive review. Global Journal of Engineering and Technology Advances, 22(3), 009–016. [Google Scholar] [Crossref]

19. Razak, K. (2025). Ransomware detection by machine learning: Hybrid DBN + GRU using static and dynamic features. International Journal for Research in Applied Science & Engineering Technology, 13(VIII). [Google Scholar] [Crossref]

20. Rizvi, M. (2023). Enhancing cybersecurity: The power of artificial intelligence in threat detection and prevention. International Journal of Advanced Engineering Research and Science, 10(5), 055–060. [Google Scholar] [Crossref]

21. Robles-Carrillo, M., & Garcia-Teodoro, P. (2022). Ransomware: An interdisciplinary technical and legal approach. Security and Communication Networks, 2022, 2806605. [Google Scholar] [Crossref]

22. Sandoval, J. I. Z., Garces, E., & Fuertes, W. (2025). Ransomware detection with machine learning: Techniques, challenges, and future directions—A systematic review. Journal of Internet Services and Information Security, 15(1), 271–287. [Google Scholar] [Crossref]

23. Surya, F. A., Surya, A., & Surya, A. (2025). Impact of ransomware-as-a-service (RaaS) in Indonesia: A socioeconomic analysis. International Journal of Cybersecurity and Education Studies, 3(1), 1–18. [Google Scholar] [Crossref]

24. Tasnim, N., & Sarker, I. H. (2022). Ransomware family classification with ensemble model based on behaviour analysis. Preprints. [Google Scholar] [Crossref]

25. Urooj, U., Al-Rimy, B. A. S., Zainal, A., Ghaleb, F. A., & Rassam, M. A. (2021). Ransomware detection using dynamic analysis and machine learning: A survey and research directions. Applied Sciences, 12(1), 172. [Google Scholar] [Crossref]

26. Yan, P. (2025). A comprehensive review of ransomware attacks, detection, and defense mechanisms across IoT environments. Journal of Cybersecurity Applications and Technology, 4, 101–123. [Google Scholar] [Crossref]

27. Zhang, K., Wang, Y., Bhatti, U. A., Zhou, Y., & Jin, M. (2025). Enhanced ransomware attacks detection using feature selection, sensitivity analysis, and optimized hybrid model. Journal of Big Data, 12, 245. [Google Scholar] [Crossref]

28. Zhu, J., Jang-Jaccard, J., Singh, A., Welch, I., Al-Sahaf, H., & Camtepe, S. (2022). A few-shot meta-learning based Siamese neural network using entropy features for ransomware classification. Computers & Security, 117, 102691. [Google Scholar] [Crossref]

• “Next-Generation Cybersecurity Through Blockchain and AI Synergy: A Paradigm Shift in Intelligent Threat Mitigation and Decentralised Security”
• Forensic Payroll Analytics for IPPIS: A Hybrid Anomaly-Detection Framework to Expose Payroll Fraud, Improve Data Governance, and Protect Employee Rights
• Factors Influencing Data Protection on Global Trade
• Development Of Artificial Intelligence-Based Model for Forensic Analysis of Cross-Platform Deepfakes
• Cyber Threats and Nigeria’s National Security: Assessing the Role of Regional Cooperation in West Africa