Deep MCRan: Hybrid Analysis-Based Ransomware Detection Using Multi-Channel Data Fusion
IEEE Access, cilt.14, ss.131574-131594, 2026 (SCI-Expanded, Scopus)
- Yayın Türü: Makale / Tam Makale
- Cilt numarası: 14
- Basım Tarihi: 2026
- Doi Numarası: 10.1109/access.2026.3727310
- Dergi Adı: IEEE Access
- Derginin Tarandığı İndeksler: Science Citation Index Expanded (SCI-EXPANDED), Scopus, Compendex, INSPEC, Directory of Open Access Journals
- Sayfa Sayıları: ss.131574-131594
- Anahtar Kelimeler: data fusion, deep learning, hybrid analysis, malware, multi-channel, Ransomware detection
- Yıldız Teknik Üniversitesi Adresli: Evet
Özet
Ransomware has emerged as one of the most destructive cybersecurity threats, causing substantial financial losses and operational disruptions. Attackers increasingly employ obfuscation and evasion techniques to bypass traditional security mechanisms, making reliable detection increasingly difficult. Although static and dynamic analysis remain the primary approaches for ransomware detection, each suffers from fundamental limitations. Static methods are often ineffective against obfuscated code, whereas dynamic analysis requires significant time and computational resources, making real-time detection impractical in most cases. These limitations have motivated hybrid detection strategies. However, existing approaches still struggle to achieve an effective balance between detection accuracy and efficiency due to the high cost of dynamic execution and the difficulty of integrating heterogeneous behavioral features. To address these challenges, we propose Deep MCRan, a multi-channel hybrid ransomware detection framework that integrates static and dynamic information within a unified deep learning architecture. The proposed method processes operation codes, Application Programming Interface calls, dynamic-link libraries, and mutual exclusions through dedicated channels, each capturing complementary aspects of ransomware execution. This multi-channel fusion architecture reduces computational complexity while mitigating information loss through complementary feature learning across channels. Experimental results demonstrate that Deep MCRan achieves 99.1% accuracy and a 98.5% true positive rate, while reducing analysis time to approximately 2 seconds per sample. The reduced analysis time supports practical deployment and near real-time ransomware detection. The evaluations on three additional datasets and comparisons with state-of-the-art methods demonstrate that Deep MCRan generalizes well across datasets, effectively detects previously unseen ransomware families, and outperforms the compared detection methods.