Abstract

Ransomware is a type of malware that encrypts a victim’s files and demands payment in exchange for the decryption key, and it has rapidly become one of the most pervasive global cyber threats. This has led to substantial financial losses and has emerged as a serious social problem worldwide. However, reliably detecting zero-day ransomware remains a challenging task. Most commercial antivirus solutions still rely primarily on signature-based detection, which suffers from inherent limitations, as generating accurate signatures requires time-consuming and in-depth analysis of suspicious programs. To overcome these limitations, this paper proposes a hybrid ransomware defense framework that combines previously studied decoy-based detection techniques with a dynamic entropy-based verification mechanism. The deception-based component builds on existing decoy file techniques by strategically deploying decoy files to increase the likelihood of exposing malicious behavior during the early stages of file encryption. In addition, this work newly designs and applies a dynamic entropy checking method that continuously monitors abnormal encryption patterns in file access and content modification, thereby mitigating potential detection blind spots caused by the inherent constraints of decoy-based approaches. In the experimental evaluation, we assess the effectiveness and robustness of the proposed framework, including scenarios involving random-access attacks that may be used to evade traditional decoy-based defenses, and report the corresponding results.