Sequence Learning over Behavioral Attack Patterns for Early Detection of Human-Operated Ransomware
Year: 2025
Type: article
Abstract: Human-Operated Ransomware (HoR) is one of the most persistent and evolving threats in cybersecurity, as attackers use changing Tactics, Techniques, and Procedures (TTPs) to evade traditional detection. The lack of structured and publicly available TTP-level datasets has limited the development of models capable of identifying HoR behavior early. In this study, we construct a dataset of TTP sequences from 15 prominent ransomware families observed in 2023 and 2024, structured according to the MITRE ATT&CK framework. We evaluate a range of sequence modeling approaches, including Markov chains, n-gram analysis, LSTM, GRU, and RNN, to classify ransomware behavior based on the progression of observed TTPs. The RNN model achieved the highest accuracy of 82% and an AUC of 0.9694 (95% CI: 0.0087–0.0168), with an average false positive rate between 0.0087 and 0.0168 using 10-fold cross-validation. SMOTE was used to address class imbalance, improving model accuracy by 6% (from 76% to 82%). These results show that learning from ordered TTP patterns can support timely detection of ransomware activity, enabling earlier intervention in threat response workflows.
DOI: 10.1145/3786772
Institution: King Fahd University of Petroleum and Minerals
Language: English
Subfield: Signal Processing
Field: Computer Science
Domain: Physical Sciences
Open Access status: diamond
OpenAlex ID: W7117301536