Robust Ransomware Detection Through Cross-Family Evaluation and Behavioral Feature Analysis

The main contributions of this work are summarized as follows:

Cross-family evaluation: We evaluate ransomware de
tection on unseen families using cross-family and 12-fold
LOFO protocols.
Comprehensive evaluation: We compare seven classi
fiers using Accuracy, Precision, Recall, F1-score, Speci
ficity, and AUC.
Feature ablation: We analyze static and dynamic fea
tures to identify which feature type provides better gen
eralization across unseen families.
Ensemble analysis: We evaluate voting and stacking en
sembles against individual classifiers under cross-family
and LOFO settings.
Explainability: We identify the most important transfer
able features using permutation importance on held-out
families.
Category-level validation: We perform five-way classifi
cation to verify ransomware-specific detection capability.