RansomGuard AI: An AI-Powered Ransomware Detection and Storage Protection System

Abstract: Ransomware continues to pose a severe threat to data availability by executing unauthorized encryption, rapid file alterations, and malicious extension changes across local file storage. This paper introduces RansomGuard AI, an integrated defense-in-depth storage surveillance and recovery system designed to monitor filesystem events, analyze behavioral risk indicators, and maintain cryptographically verified snapshot recovery points. Operating on a Python FastAPI backend paired with a reactive web dashboard, the framework continuously evaluates filesystem activity against key telemetry signals: modification rates, burst write frequencies, Shannon entropy shifts, and file extension mutations. To guarantee disaster recovery without relying on compromised storage, recovery copies are secured using immutable SHA-256 manifest checkpoints. The system includes a sandboxed synthetic attack simulator that reproduces ransomware- like behaviors inside an isolated environment, demonstrating complete monitoring, detection, audit logging, and point- in-time recovery workflows without exposing the host OS to live malware.

Keywords: Ransomware detection, filesystem monitoring, Shannon entropy, behavioral risk profiling, SHA-256 manifests, snapshot recovery, FastAPI, system security.