RansomShield: Threat-score-driven adaptive backup with multi-modal behavioural ransomware detection

In the digital world, protecting valuable information has long relied on a simple, two-part strategy: watching for intruders and keeping a spare copy of your work. Security software acts as a guard, scanning files and programs to spot known thieves or suspicious behavior. If it sees something dangerous, it raises an alarm. Separately, a backup system acts as a safety net, saving copies of files at regular intervals, like a clock striking every hour or every day. For decades, these two systems operated independently. The guard would shout if it saw a threat, but the backup clock would keep ticking on its own schedule, unaware of the danger. This separation created a vulnerability. Modern thieves, specifically those who hold data hostage for money, have learned to strike quickly and often target the backup systems themselves, deleting old copies or locking them away before a new one can be made. The old rule of keeping three copies in two places with one off-site was designed for a time when backups were passive targets, not active battlegrounds.

Researchers at the University of Medical Sciences in Ondo, Nigeria, have proposed a new way to bridge this gap. They built a system called RansomShield, which connects the guard and the safety net so they work as a single, breathing unit. Instead of a simple on-or-off alarm, their system calculates a continuous "threat score." This score rises and falls based on what the system sees happening inside the computer. If the score is low, the system behaves normally, saving files at a standard pace. If the score begins to climb, indicating that something suspicious is happening, the system automatically tightens its defenses. It starts saving copies more frequently, locks those copies so they cannot be altered, and isolates them from the rest of the network. The system does not wait for absolute certainty to act; it reacts proportionally to the level of danger it perceives.

To build this system, the researchers combined four different ways of watching the computer. First, they looked at the computer's memory, the temporary space where active programs live, searching for specific signs of malicious code. Second, they tracked the sequence of commands a program sends to the operating system, looking for patterns typical of file encryption. Third, they monitored how data was being written to the hard drive, checking for sudden spikes in activity or strange changes in file types. Finally, they measured the randomness of the data being written; encrypted files look like pure static noise, which is mathematically distinct from normal documents or images. The system weighs these four signals together, smoothing out the results to avoid false alarms from momentary glitches. This combined score then drives a controller that decides exactly how to protect the data.

The researchers tested this idea using data from public archives and by simulating attacks from seven different families of ransomware. In these simulations, the system successfully identified every single attack. On average, it detected the threat after observing just thirteen file-system events, which is a very short time in the world of digital operations. Once the threat was spotted, the system immediately escalated its response. It moved from a normal state to a heightened state where it saved a full copy of the data every thirty seconds. These copies were made "immutable," meaning they were locked in a way that prevented even the attacker from deleting or changing them, and they were placed in an isolated environment, effectively air-gapped from the compromised machine. The system did not reach its highest level of alert, which would have involved stopping all processes, because the simulated attacks were detected early enough to trigger the strong, but not extreme, response.

The study also looked at how often the system might cry wolf. In a scenario where only normal, harmless computer activity occurred, the system flagged a potential threat in about five percent of the events. While this is a low rate, the researchers noted that in a real-world setting, this could lead to unnecessary extra work, such as saving files more often than needed. However, the system was smart enough to keep these false alarms at a moderate level; it never escalated to the most extreme, disruptive measures for normal activity. The results showed that the memory watcher was the most powerful single tool, correctly identifying malicious activity with near-perfect accuracy in the tests. The other tools, while less precise on their own, added valuable context when combined.

This work remains a proof of concept, a demonstration that the idea works in a controlled environment. The researchers used simulated attacks rather than live viruses in a real network, and they have not yet tested the system in a hospital or business setting. They acknowledge that the rules they used to judge the computer's behavior were hand-crafted and that the system needs further testing to see how it handles the vast variety of real-world threats. The authors suggest that future work should involve testing the system against live malware in a secure sandbox, refining the rules based on real data, and eventually deploying it in organizations where resources are limited. The core finding is clear: by linking the detection of a threat directly to the intensity of the backup response, it is possible to create a defense that is both faster and more resilient than the traditional, disconnected methods. The system does not just watch for trouble; it adapts its shield in real-time, tightening its grip the moment the danger begins to rise.