RansomShield: Threat-score-driven adaptive backup with multi-modal behavioural ransomware detection
This paper presents RansomShield, an adaptive backup architecture that dynamically adjusts snapshot frequency and immutability based on a continuous, multi-modal threat score derived from memory, API, I/O, and entropy analyses, achieving near-perfect detection accuracy and rapid escalation to air-gapped backups during simulated ransomware attacks.