⌘
Telemetry-based data
Uses pre-collected Sysmon event records from the SILRAD dataset rather than executing malicious software.
Cybersecurity · Machine Learning
Recognize ransomware through behavioral signals.
A machine-learning project that evaluates labeled Sysmon event records to distinguish ransomware-related activity from goodware using the SILRAD dataset.
DETECTION OVERVIEW
Offline evaluation
⌁
Behavioral Threat Classifier
Sysmon telemetry · Feature-based ML · Binary classification
MODEL STATUS TRAINED LOCALLY
DATA SOURCE SILRAD DATASET
Project overview
From endpoint events to model predictions
The project explores whether numerical representations of collected endpoint events can help a classifier identify ransomware-associated records.
◈
Machine-learning model
A Random Forest baseline trained with a preprocessing pipeline and evaluated on the supplied test dataset.
▤
Experiment tracking
MLflow records the baseline experiment's metrics, parameters and model artifacts for review.
Methodology
A reproducible evaluation workflow
The current implementation evaluates offline records. It is not a live endpoint protection product.
STEP 01
Dataset
Load the supplied SILRAD training and testing CSV files.
STEP 02
Preprocess
Prepare the 36 input features and handle missing numeric values.
STEP 03
Train & evaluate
Fit the Random Forest model and measure classification performance.
STEP 04
Demonstrate
Use the local Gradio app to inspect a test record and compare its predicted label with its actual label.
Baseline evaluation
Results from the supplied test set
These values are from the current local Random Forest baseline evaluation. They are not a guarantee of future detection performance.
95.00%
Overall accuracy
97.24%
Ransomware precision
61.60%
Ransomware recall
75.42%
Ransomware F1-score
Interpretation: The model misses some ransomware-labeled
test records. Accuracy alone is insufficient for a security detector;
ransomware recall and false-negative analysis are especially important.
Responsible evaluation
What this prototype does — and doesn't do
What it does
Classifies records from a prepared dataset, reports model metrics and demonstrates experiment tracking.
What it doesn't do
It does not currently collect live endpoint telemetry, block ransomware, quarantine files or guarantee protection.
Next improvements
Improve ransomware recall, investigate false negatives, validate data splits and test on independent endpoint data.
Academic project demonstration
Explore the implementation
This page documents the current prototype and its measured baseline results.