# On the Generalizability of Machine Learning-based Ransomware Detection in Block Storage

arXiv: https://arxiv.org/abs/2412.21084 · HTML: https://mlsanity.com/paper/2412.21084/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 6 of its 58 references that are in the map.
- First posted on arXiv 30 Dec 2024.

## Builds on (most cited first, 6 of 6)

- [A Survey on Ransomware: Evolution, Taxonomy, and Defense Solutions](https://mlsanity.com/paper/2102.06249/) (2021)
- [Unsupervised Anomaly-based Malware Detection using Hardware Features](https://mlsanity.com/paper/1403.1631/) (2014)
- [DroidAnalytics: A Signature Based Analytic System to Collect, Extract, Analyze and Associate Android Malware](https://mlsanity.com/paper/1302.7212/) (2013)
- [Poisoning Network Flow Classifiers](https://mlsanity.com/paper/2306.01655/) (2023)
- [Leveraging Machine Learning Techniques for Windows Ransomware Network Traffic Detection](https://mlsanity.com/paper/1807.10440/) (2018)
- [WannaLaugh: A Configurable Ransomware Emulator -- Learning to Mimic Malicious Storage Traces](https://mlsanity.com/paper/2403.07540/) (2024)

## Abstract (arXiv)

Ransomware represents a pervasive threat, traditionally countered at the operating system, file-system, or network levels. However, these approaches often introduce significant overhead and remain susceptible to circumvention by attackers. Recent research activity started looking into the detection of ransomware by observing block IO operations. However, this approach exhibits significant detection challenges. Recognizing these limitations, our research pivots towards enabling robust ransomware detection in storage systems keeping in mind their limited computational resources available. To perform our studies, we propose a kernel-based framework capable of efficiently extracting and analyzing IO operations to identify ransomware activity. The framework can be adopted to storage systems using computational storage devices to improve security and fully hide detection overheads. Our method employs a refined set of computationally light features optimized for ML models to accurately discern malicious from benign activities. Using this lightweight approach, we study a wide range of generalizability aspects and analyze the performance of these models across a large space of setups and configurations covering a wide range of realistic real-world scenarios. We reveal various trade-offs and provide strong arguments for the generalizability of storage-based detection of ransomware and show that our approach outperforms currently available ML-based ransomware detection in storage. Empirical validation reveals that our decision tree-based models achieve remarkable effectiveness, evidenced by higher median F1 scores of up to 12.8%, lower false negative rates of up to 10.9% and particularly decreased false positive rates of up to 17.1% compared to existing storage-based detection approaches.