Unveiling ransomware before the lock: a hybrid framework for pre-encryption detection

Ransomware has become one of the most damaging types of malware, attacking critical systems and locking away valuable data by encrypting it. Most traditional detection methods only detect ransomware after it starts encrypting files, by then, it is often too late, and the file loss process is already done. To fix this problem, we have developed a new hybrid detection system that spots ransomware before it begins encryption, allowing defenders to stop it early and prevent data loss. Our solution combines machine learning (ML) with a rule-based detector built from unknown ransomware behaviors. We tested several ML models, including Support Vector Machine, Decision Tree, Random Forest, K-Nearest Neighbor, and XGBoost, using real-world ransomware and normal software samples. The rule-based part of our system is lightweight and easy to understand, based on common early warning signs of ransomware. When tested, our hybrid approach proved far more accurate and faster than traditional detection methods, with better precision and fewer missed threats. This research aims to explain why detecting ransomware early is so crucial, and our framework provides a practical, scalable way to do it, making it ideal for real-world security software. Our model works robustly and achieves good results, detection accuracy rate of 98.5% and reduces false positive and false negative rates.