SentinelML: Behavioral Machine-Learning-Based Ransomware Detection with Decoupled AI Security Analysis

Abstract: Ransomware remains a critical threat to modern enterprise and personal computing infrastructure. Traditional signature-based detection mechanisms exhibit operational degradation when confronted with previously unobserved polymorphic or zero-day variants. This paper presents SentinelML, an autonomous endpoint detection architecture that identifies ransomware activity through 19 dynamic behavioral indicators collected entirely in user space without requiring kernel-level filter drivers. By sampling filesystem Shannon entropy, process concurrency anomalies, shadow copy deletion commands, and cryptographic module bindings, SentinelML trains a local Random Forest classifier that operates as an unprivileged host daemon. To address operational triage transparency, the local classifier is coupled with an architecturally decoupled Large Language Model (LLM) advisory explainer operating via an isolated HTTPS interface. We conduct an exhaustive technical audit of the production system: confirming that Shannon entropy accounts for 41.31% of aggregate Gini importance, documenting the operational tradeoffs of heuristic user-space proxies, analyzing platform asymmetry between Windows and Linux deployments, and evaluating the system strictly as an Intrusion Detection System (IDS). Finally, we disclose that previously reported internal metrics (0.9567 accuracy across candidate algorithms) could not be independently reproduced due to unpreserved training artifacts, and establish an open empirical evaluation protocol for reproducible validation.

Keywords: Ransomware Detection, Behavioral Analysis, Random Forest, Shannon Entropy, User-Space Monitoring, Explainable AI, Endpoint Security.