{"slug": "building-a-ransomware-detection-system-with-blockchain-logging", "title": "Building a Ransomware Detection System with Blockchain Logging", "summary": "Computer Science graduate Anoshay Ambar, as a final-year project at COMSATS University Islamabad, built a ransomware detection system that combines a Random Forest classifier with blockchain-based log storage. The system extracts file-system features such as rapid encryption, extension changes and entropy, plus suspicious API calls, and reports roughly 94-96% detection accuracy with real-time alerts in under two seconds. Logs are chained with SHA-256 hashes so any tampering breaks the hash chain, making them immutable.", "body_md": "Being a Computer Science student from COMSATS University Islamabad, I always wanted my final year project to address a practical issue. We thought of developing a system that detects ransomware as well as maintains the logs using blockchain.\n\nHere’s how I developed it.\n\nA common drawback of traditional anti-virus systems is that their functionality is based on the signature which can be bypassed by the ransomware very easily. In addition, after attacking any system, attackers can remove/delete/modify the system logs.\n\nSo, our project was about solving these two issues:\n\nIt is pretty straightforward yet highly effective:\n\n**1. Data Collection & Feature Extraction:**\n\nWe analyze activity in the file system such as fast file encryption, extension change (.encrypted, .locked), entropy, etc., and also suspicious API calls.\n\n**2. ML Detection (Random Forest):**\n\nRandom Forest machine learning was trained based on two classes – benign programs and ransomware. This particular algorithm was chosen because its accuracy equals 95%, has a few false positives and works fine with tabular data.\n\n**3. Alerting System:**\n\nIn case ransomware was detected the following actions are taken:\n\n**4. Blockchain Logging:**\n\nThis is the best part. In contrast to storing logs in the common database we use hashing of the log files with SHA-256 algorithm with linking to the previous log's hash.\n\n`Block = { data, timestamp, previous_hash, current_hash }`\n\nAny attempt to change the previous block will cause breaking the hash chain. Hence, logs are immutable.\n\n``` python\npython\nimport hashlib\nimport time\n\ndef generate_hash(message, previousHash):\n    block_string = f\"{message}{time.time()}{previousHash}\"\n    return hashlib.sha256(block_string.encode()).hexdigest()\n\n# Generating a safe log\nlog_message = \"Ransomware detected: PID 4042\"\nprevious_hash = \"0000abc...\"\nsafe_hash = generate_hash(log_message, previous_hash)\nprint(f\"Safe Log: {safe_hash}\")\n\n🎯 Achievements \n1.Accuracy in Detection: ≈94-96% on test data\n2.Alerting Real-time alerts within <2 secs\n3.Logs are completely tamper proof and are verifiable\n\nChallenges | Faced\n1.Finding a pure dataset of ransomware behavior was difficult.\n2.Find a balance between false positives and alerts.\n3.To make blockchain lightweight to not affect performance.\n\nConclusion\nThrough this project, I have realized that Cybersecurity is not only about coding but about thinking like a hacker as well. The combination of AI + Blockchain provided me with a different viewpoint.\n\nIf you are working on a similar Final Year Project or looking for the GitHub Code, then let’s connect!\n\n*About the Author*\n\nMy name is Anoshay Ambar. I have graduated in Computer Science from COMSATS University Islamabad. I love cybersecurity, AI, and health tech.\n\nLet’s get connected through: [LinkedIn](https://www.linkedin.com/in/anoshay-ambar-174011397) | Email: anoshayambar@gmail.com\n```\n\n", "url": "https://wpnews.pro/news/building-a-ransomware-detection-system-with-blockchain-logging", "canonical_source": "https://dev.to/anoshay_ambar/building-a-ransomware-detection-system-with-blockchain-logging-13ep", "published_at": "2026-10-20 20:15:15+00:00", "updated_at": "2026-10-20 20:18:39.671886+00:00", "lang": "en", "topics": ["machine-learning", "artificial-intelligence"], "entities": ["Anoshay Ambar", "COMSATS University Islamabad", "Random Forest", "SHA-256"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/building-a-ransomware-detection-system-with-blockchain-logging", "markdown": "https://wpnews.pro/news/building-a-ransomware-detection-system-with-blockchain-logging.md", "text": "https://wpnews.pro/news/building-a-ransomware-detection-system-with-blockchain-logging.txt", "jsonld": "https://wpnews.pro/news/building-a-ransomware-detection-system-with-blockchain-logging.jsonld"}}