# Building a Robust Risk-Based Access Control System to Combat Ransomware's Capability to Encrypt

arXiv: https://arxiv.org/abs/2601.16795 · HTML: https://mlsanity.com/paper/2601.16795/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 6 of its 49 references that are in the map.
- First posted on arXiv 23 Jan 2026.

## Builds on (most cited first, 6 of 6)

- [Automated Behavioral Analysis of Malware A Case Study of WannaCry Ransomware](https://mlsanity.com/paper/1709.08753/) (2017)
- [Know Abnormal, Find Evil: Frequent Pattern Mining for Ransomware Threat Hunting and Intelligence](https://mlsanity.com/paper/1808.01957/) (2018)
- [Cryptographic ransomware encryption detection: Survey](https://mlsanity.com/paper/2306.12008/) (2023)
- [Ransomware Detection Using Machine Learning in the Linux Kernel](https://mlsanity.com/paper/2409.06452/) (2024)
- [GuardFS: a File System for Integrated Detection and Mitigation of Linux-based Ransomware](https://mlsanity.com/paper/2401.17917/) (2024)
- [Exploiting ftrace's function_graph Tracer Features for Machine Learning: A Case Study on Encryption Detection](https://mlsanity.com/paper/2512.04590/) (2025)

## Abstract (arXiv)

Ransomware core capability, unauthorized encryption, demands controls that identify and block malicious cryptographic activity without disrupting legitimate use. We present a probabilistic, risk-based access control architecture that couples machine learning inference with mandatory access control to regulate encryption on Linux in real time. The system builds a specialized dataset from the native ftrace framework using the function_graph tracer, yielding high-resolution kernel-function execution traces augmented with resource and I/O counters. These traces support both a supervised classifier and interpretable rules that drive an SELinux policy via lightweight booleans, enabling context-sensitive permit/deny decisions at the moment encryption begins. Compared to approaches centered on sandboxing, hypervisor introspection, or coarse system-call telemetry, the function-level tracing we adopt provides finer behavioral granularity than syscall-only telemetry while avoiding the virtualization/VMI overhead of sandbox-based approaches. Our current user-space prototype has a non-trivial footprint under burst I/O; we quantify it and recognize that a production kernel-space solution should aim to address this. We detail dataset construction, model training and rule extraction, and the run-time integration that gates file writes for suspect encryption while preserving benign cryptographic workflows. During evaluation, the two-layer composition retains model-level detection quality while delivering rule-like responsiveness; we also quantify operational footprint and outline engineering steps to reduce CPU and memory overhead for enterprise deployment. The result is a practical path from behavioral tracing and learning to enforceable, explainable, and risk-proportionate encryption control on production Linux systems.