Building a Ransomware Detection System with Blockchain Logging

Computer Science graduate Anoshay Ambar, as a final-year project at COMSATS University Islamabad, built a ransomware detection system that combines a Random Forest classifier with blockchain-based log storage. The system extracts file-system features such as rapid encryption, extension changes and entropy, plus suspicious API calls, and reports roughly 94-96% detection accuracy with real-time alerts in under two seconds. Logs are chained with SHA-256 hashes so any tampering breaks the hash chain, making them immutable.

Being a Computer Science student from COMSATS University Islamabad, I always wanted my final year project to address a practical issue. We thought of developing a system that detects ransomware as well as maintains the logs using blockchain. Here’s how I developed it. A common drawback of traditional anti-virus systems is that their functionality is based on the signature which can be bypassed by the ransomware very easily. In addition, after attacking any system, attackers can remove/delete/modify the system logs. So, our project was about solving these two issues: It is pretty straightforward yet highly effective: 1. Data Collection & Feature Extraction: We analyze activity in the file system such as fast file encryption, extension change .encrypted, .locked , entropy, etc., and also suspicious API calls. 2. ML Detection Random Forest : Random Forest machine learning was trained based on two classes – benign programs and ransomware. This particular algorithm was chosen because its accuracy equals 95%, has a few false positives and works fine with tabular data. 3. Alerting System: In case ransomware was detected the following actions are taken: 4. Blockchain Logging: This is the best part. In contrast to storing logs in the common database we use hashing of the log files with SHA-256 algorithm with linking to the previous log's hash. Block = { data, timestamp, previous hash, current hash } Any attempt to change the previous block will cause breaking the hash chain. Hence, logs are immutable. python python import hashlib import time def generate hash message, previousHash : block string = f"{message}{time.time }{previousHash}" return hashlib.sha256 block string.encode .hexdigest Generating a safe log log message = "Ransomware detected: PID 4042" previous hash = "0000abc..." safe hash = generate hash log message, previous hash print f"Safe Log: {safe hash}" 🎯 Achievements 1.Accuracy in Detection: ≈94-96% on test data 2.Alerting Real-time alerts within <2 secs 3.Logs are completely tamper proof and are verifiable Challenges | Faced 1.Finding a pure dataset of ransomware behavior was difficult. 2.Find a balance between false positives and alerts. 3.To make blockchain lightweight to not affect performance. Conclusion Through this project, I have realized that Cybersecurity is not only about coding but about thinking like a hacker as well. The combination of AI + Blockchain provided me with a different viewpoint. If you are working on a similar Final Year Project or looking for the GitHub Code, then let’s connect About the Author My name is Anoshay Ambar. I have graduated in Computer Science from COMSATS University Islamabad. I love cybersecurity, AI, and health tech. Let’s get connected through: LinkedIn https://www.linkedin.com/in/anoshay-ambar-174011397 | Email: anoshayambar@gmail.com