Ransomware is one of the most devastating cyber threats that can bypass conventional rule-based defenses and inflict serious damage in a few seconds. Despite the fact that Wazuh, an open-source Security Information and Event Management (SIEM) platform, offers efficient monitoring and alerting features, its fixed rules are weak in identifying zero-day and fast-changing ransomware attacks. The paper suggests a behavioral and explainable real-time ransomware detection framework that combines Wazuh with machine learning and anomaly detection. Over 45,000 Wazuh alerts were gathered in realistic attack scenarios and legitimate user activity. Fourteen behavioral features were obtained, such as file creation, renaming activity, extension changes, and event frequency. The framework uses ten detection models: Random Forest, SVM, KNN, Gradient Boosting, Logistic Regression, Gaussian Naive Bayes, K-Means, Isolation Forest, DBSCAN, and a hybrid Random Forest + DBSCAN model. Detection decisions were explained using SHAP and the most influential features were highlighted. The experimental findings indicate that the highest accuracy of 98.67 was obtained with Random Forest and Gradient Boosting. The framework also offers real-time and early-stage detection, which detects ransomware within 0.01-0.20 s of the attack onset, before massive file encryption takes place. The system also facilitates Telegram alerting and MITRE ATT&CK mapping, which makes it appropriate to be used in real-life applications in Security Operations Centers.
A. Al-rikabi, M. A. Mohammed, and H. M. Salih, “GPT-4 to Mitigate Ransomware: A Survey of Explainable and Intelligent Detection Techniques,” 2025.
H. Ibrahim, K. Hassan, and M. Abdullah, “Towards an Explainable Deep Learning Framework for Ransomware Detection,” 2024.
H. Al-Samarraie, S. Ahmed, and L. Chen, “RansoGuard: A Real-Time Behavioral Framework for Ransomware Detection,” 2025.
Y. Zhang, R. Chen, and T. Lee, “Early Ransomware Detection Using Behavioral Features,” 2024.
S. A. Chamkar, M. Zaydi, Y. Maleh, and N. Gherabi, “Improving Threat Detection in Wazuh Using Machine Learning Techniques,” Journal of Cybersecurity and Privacy, vol. 5, no. 2, p. 34, 2025.
A. Ibrahim and M. Kareem, “A Comprehensive Review of Ransomware Detection Techniques,” 2025.
M. Roberts and P. Singh, “Decrypting Files Encrypted by Modern Ransomware: Challenges and Opportunities,” 2025.
R. Khan and M. Lewis, “Double Extortion Ransomware: Analysis and Defense Strategies,” 2025.
N. Mahmood and A. Tariq, “Literature Review of Machine Learning-Based Ransomware Detection,” 2021.
F. Ahmed and B. Saleh, “Mitigating Ransomware Attacks Using Machine Learning,” 2025.
K. Lee and M. Ahmed, “An Intelligent Ransomware Attack Detection Framework,” 2025.
J. Peterson and H. Wang, “API Call-Based Detection of Ransomware Behavior,” 2025.
S. Kumar and R. Patel, “Vision Transformer Technique for Behavioral Ransomware Detection,” 2025.
M. Kareem and S. Ahmed, “A Novel Technique for Ransomware Detection Based on Behavioral Telemetry,” 2025.
J. Smith and K. Zhao, “Generative AI for Intelligent Malware and Ransomware Mitigation Systems,” 2025.
L. Chen and P. Kumar, “Mitigating Zero-Day Ransomware Using Behavioral Analysis,” 2025.
R. Gupta and M. Ibrahim, “A Zero-Day Ransomware Detection Framework Based on Anomaly Analysis,” 2025.
M. Ali and S. Hussein, “Explainable Deep Learning-Based Ransomware Detection Using Dynamic Behavioral Features,” 2025.
A. Ahmed, T. Hasan, F. A. Abdullatif, M. S. T., and M. S. M. Rahim, “A Digital Signature System Based on Real Time Face Recognition,” in 2019 IEEE 9th International Conference on System Engineering and Technology (ICSET), Shah Alam, Malaysia, 2019, pp. 298-302, [Online]. Available: https://doi.org/10.1109/ICSEngT.2019.8906410.
A. Alhawi, J. Baldwin, and A. Dehghantanha, “Leveraging Machine Learning Techniques for Ransomware Detection,” Future Generation Computer Systems, vol. 87, pp. 197-212, 2018.
T. Wilson and P. Zhao, “A Swarm Intelligence-Enhanced Ransomware Detection Model,” 2026.
M. Hassan, T. Nguyen, and J. Park, “Ransomware-as-a-Service: Recent Trends and Detection Challenges,” 2025.
S. Ali, M. Rahman, and J. Kim, “Enhanced Ransomware Attack Detection Using Machine Learning,” 2025.
M. Al-Hadithi and A. Kareem, “A Behavioral and Explainable Real-Time Framework for Ransomware Detection Using System Telemetry,” unpublished manuscript, 2026.
D. Kareem and F. Hasan, “Early Detection and Defense Countermeasure Inference for Ransomware,” 2025.
R. Ahmed and L. Saeed, “Ransomware Detection Using Deep Learning,” 2025.
R. Vinayakumar et al., “Deep Learning Approach for Intelligent Intrusion Detection System,” IEEE Access, vol. 7, pp. 41525-41550, 2019.
