Reconnaissance-Driven Ransomware Prediction using Interpretable Machine Learning

Document Type

Conference Proceeding

Source of Publication

International Conference for Innovations in Intelligent Computing and Cybersecurity Iicc 2026 Part of 2026 16th Iceeng International Congress on Electrical Engineering

Publication Date

5-11-2026

Abstract

Ransomware continues to inflict severe operational and economic damage across sectors. Recent research on ransomware defence has largely focused on detection during execution or after encryption. This limits their practical value for proactive defence, as alerts are often raised when damage is already in progress. In addition, Explainable AI has contributed to improving trust and transparency in ransomware detection. However, there is a lack of ransomware detection and explainability before the attack has taken place, which does not support early intervention. This paper proposes a novel Proactive Ransomware Detection (Pro- RanDet) model based on reconnaissance behavior modeling. The Pro-RanDet model is a host-level behavioral model making use of the features of the reconnaissance phase, and it adopts interpretable machine learning algorithms, thus not only predicting impending ransomware attacks but also providing transparent and explainable reasoning that can be understood by non-technical stakeholders. The results showed that Pro-RanDet can provide interpretable accuracy at 95.5%.

ISBN

[9798331547028]

Publisher

IEEE

Disciplines

Computer Sciences

Keywords

behavioral telemetry, ensemble learning, interpretable machine learning, Proactive ransomware detection, reconnaissance modeling

Scopus ID

105045254715

Indexed in Scopus

yes

Open Access

no

Link to Full Text

Share

COinS