# Detecting Ransomware Execution in a Timely Manner

arXiv: https://arxiv.org/abs/2201.04424 · HTML: https://mlsanity.com/paper/2201.04424/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 0 of its 23 references that are in the map.
- First posted on arXiv 12 Jan 2022.

## Abstract (arXiv)

Ransomware has been an ongoing issue since the early 1990s. In recent times ransomware has spread from traditional computational resources to cyber-physical systems and industrial controls. We devised a series of experiments in which virtual instances are infected with ransomware. We instrumented the instances and collected resource utilization data across a variety of metrics (CPU, Memory, Disk Utility). We design a change point detection and learning method for identifying ransomware execution. Finally we evaluate and demonstrate its ability to detect ransomware efficiently in a timely manner when trained on a minimal set of samples. Our results represent a step forward for defense, and we conclude with further remarks for the path forward.