Ransomsheild

Risk Assessment Dashboard Showing Overall Threat Score and Module-Wise Risk Contributions.
System Health Dashboard Displaying Resource Utilization and Running Processes.
Model Performance Dashboard Presenting Evaluation Metrics and Confusion Matrices.
Live Monitoring Dashboard Showing Real-Time Status of Detection Modules.
RansomShield Overview Dashboard Summarizing Security Status and Threat Alerts.
Threats and Incidents Dashboard Showing Incident Details and Response Actions.
RansomShield Project Directory Structure – Part I.
RansomShield Project Directory Structure – Part II.
RansomShield Project Directory Structure – Part III.

RansomShield: Detect Ransomware Before Encryption Begins

Inspiration

Ransomware attacks can encrypt important files, disrupt business operations, and cause significant data loss. Traditional security approaches may detect malicious activity only after suspicious behavior has already progressed. This inspired us to build RansomShield, a proactive ransomware detection framework designed to identify suspicious behavior before widespread file encryption occurs.

Our goal was to explore how multiple behavioral signals can work together to improve early threat detection and provide users with a clearer picture of potential security risks.

What it does

RansomShield monitors four key areas of system behavior:

File-Guard: Detects suspicious file operations and encryption-like patterns.
Net-Guard: Identifies unusual network activity and potentially suspicious connections.
Memory-Guard: Monitors CPU, memory, and process behavior for anomalies.
Access-Guard: Examines authentication activity and unusual access patterns.

An ensemble decision engine combines the outputs of these detection modules to produce an overall threat assessment. The dashboard presents security alerts, recent activity, system health, and model performance to help users investigate suspicious behavior.

How we built it

We developed RansomShield using Python and machine-learning libraries, with Streamlit providing the monitoring dashboard and SQLite supporting local event storage.

The framework integrates XGBoost for file behavior, Random Forest for network behavior, Isolation Forest for memory anomalies, and Decision Tree for authentication behavior. We used data preprocessing, feature extraction, model evaluation, and a combined decision engine to bring these modules together.

The dashboard provides a centralized view of detection activity, threat assessments, incidents, and system resource usage.

Challenges we faced

One of our main challenges was integrating multiple detection modules, each using different behavioral features and machine-learning algorithms, into a unified framework. We also worked on presenting detector outputs consistently, handling missing or stale monitoring data, and designing a dashboard that makes security information easier to understand.

Balancing early threat detection with false-positive reduction was another important challenge, particularly for anomaly detection, where unusual behavior does not always indicate a real attack.

What we learned

Building RansomShield strengthened our understanding of machine learning for cybersecurity, behavioral anomaly detection, ensemble-based decision systems, system monitoring, database integration, and security dashboard design.

We also learned that a useful security solution must do more than generate predictions: it should present meaningful findings, support investigation, and communicate uncertainty clearly.

What's next

We aim to improve detection reliability, evaluate the framework against more diverse real-world datasets, reduce false positives, and strengthen testing in controlled environments. We also plan to improve incident investigation and response capabilities while keeping the interface accessible to both technical and non-technical users.

RansomShield is our step toward proactive, behavior-driven ransomware detection that aims to identify suspicious activity before encryption causes widespread damage.