Deep MCRan: Hybrid Analysis-Based Ransomware Detection Using Multi-Channel Data Fusion
Year: 2026
Type: article
Abstract: Ransomware has emerged as one of the most destructive cybersecurity threats, causing substantial financial losses and operational disruptions. Attackers increasingly employ obfuscation and evasion techniques to bypass traditional security mechanisms, making reliable detection increasingly difficult. Although static and dynamic analysis remain the primary approaches for ransomware detection, each suffers from fundamental limitations. Static methods are often ineffective against obfuscated code, whereas dynamic analysis requires significant time and computational resources, making real-time detection impractical in most cases. These limitations have motivated hybrid detection strategies. However, existing approaches still struggle to achieve an effective balance between detection accuracy and efficiency due to the high cost of dynamic execution and the difficulty of integrating heterogeneous behavioral features. To address these challenges, we propose Deep MCRan, a multi-channel hybrid ransomware detection framework that integrates static and dynamic information within a unified deep learning architecture. The proposed method processes operation codes, Application Programming Interface calls, dynamic-link libraries, and mutual exclusions through dedicated channels, each capturing complementary aspects of ransomware execution. This multi-channel fusion architecture reduces computational complexity while mitigating information loss through complementary feature learning across channels. Experimental results demonstrate that Deep MCRan achieves 99.1% accuracy and a 98.5% true positive rate, while reducing analysis time to approximately 2 seconds per sample. The reduced analysis time supports practical deployment and near real-time ransomware detection. The evaluations on three additional datasets and comparisons with state-of-the-art methods demonstrate that Deep MCRan generalizes well across datasets, effectively detects previously unseen ransomware families, and outperforms the compared detection methods.
Source: IEEE Access
Language: English
Subfield: Signal Processing
Field: Computer Science
Domain: Physical Sciences
Open Access status: gold
Estimated APC paid: $2,075
OpenAlex ID: W7204175158