← Back to Publications List

Multi-Zone AI-Based Ransomware Defense: Tier-Based Alerts and Priority Protection in Endpoint Devices

Students & Supervisors

Student Authors
1 Md.risul Islam Rifat
Bachelor of Science in Computer Science & Engineering, FST
Sheikh Mumitur Rahman Saba
Bachelor of Science in Computer Science & Engineering, FST
Mst. Nusrat Jahan Nijhum
Bachelor of Science in Computer Science & Engineering, FST
Md.ashraful Islam
Bachelor of Science in Computer Science & Engineering, FST
Supervisors
Md. Mazid-ul-haque
Assistant Professor, Special Assistant [osa], FST

Abstract

Ransomware can quickly encrypt user files, shared folders, sensitive data, and backup-adjacent files on endpoint devices. Many defenses focus on detecting suspicious behavior, but they often do not consider which data locations should be protected first. This paper presents MZAIR, a Multi-Zone AI- Based Ransomware Defense framework for Windows endpoints. MZAIR places honeypot files across four priority-based zones: user areas, shared/team areas, sensitive repositories, and backup- adjacent locations. The framework combines leakage-controlled AI detection, honeypot-trigger signals, zone-aware risk scoring, and tier-based response actions. MZAIR is evaluated using MZAIR-Trace, an 885-record session-augmented dataset for ran- somware detection and response analysis. In the evaluated setting, Random Forest, Gradient Boosting, and SVM achieved 1.000 accuracy, precision, recall, F1-score, and ROC-AUC. Compared with the average single-zone setting, multi-zone MZAIR reduced first-trigger time by 86.6%, alert time by 67.0%, and containment time by 34.4%. The response results show faster recovery and stronger protection based on zone priority. These results show strong performance on the constructed dataset, but should be viewed as controlled validation rather than guaranteed real-world performance.

Keywords

ransomware detection endpoint security multi- zone honeypot honeyfile tier-based response priority protection ransomware recovery cross-zone containment

Publication Details

  • Type of Publication:
  • Conference Name: EEE International Conference on Signal Processing, Information, Communication and Systems 2026 (SPICSCON)
  • Date of Conference: 13/08/2026 - 13/08/2026
  • Venue: Bangladesh Army University of Engineering & Technology (BAUET)
  • Organizer: IEEE International Conference on Signal Processing, Information, Communication and Systems 2026 (SPICSCON)
View on Publisher