New host telemetry dataset enables robust and explainable ransomware detection and family attribution

Ransomware remains one of the most disruptive cyber threats facing organizations today, interfering with business operations and compromising the availability, confidentiality, and privacy of data. Although detection and mitigation techniques have improved over time, researchers have been held back by a persistent problem: the lack of diverse and realistic datasets that capture how modern ransomware actually behaves on real machines. A new study published in Cluster Computing addresses this gap by presenting a hybrid host-level dataset that records the behavioral patterns of multiple ransomware families alongside benign software.

The dataset was collected on both Cuckoo Sandbox environments and physical Windows 10 hosts, combining controlled analysis conditions with real-system telemetry. It contains 5,326 executions described by 392 features, covering four broad categories of host activity: processes, files, registry operations, and API calls. This breadth is intended to reflect the range of traces ransomware leaves behind when it encrypts files, manipulates the registry, and interacts with system resources.

Using this dataset, the researchers implemented both Machine Learning and Deep Learning pipelines for two related tasks. The first is binary detection, distinguishing ransomware from goodware. The second, and more demanding, is multiclass family attribution, identifying which ransomware family a given sample belongs to. The reported results show high accuracy, with F1-scores of 0.982 for the binary detection task and 0.840 for multiclass attribution, indicating that family-level identification remains considerably harder than simply flagging a sample as malicious.

A distinctive contribution of the work is its systematic robustness assessment. Rather than reporting accuracy only under ideal conditions, the authors introduced controlled perturbations into the data, including noise, outliers, and missing features, to measure how performance degrades and how stable the models’ decisions remain when telemetry is imperfect. This kind of evaluation matters in practice, because real-world telemetry is rarely as clean as laboratory data, and a detector that collapses when a few features are missing is of limited operational value.

The study also incorporates explainability analysis based on SHAP, a technique for interpreting machine learning model outputs. The SHAP-based analyses highlight which features drive the models’ decisions and provide local decision insights for individual executions. By making the reasoning behind detections more transparent, the approach aims to move ransomware detection toward systems that are not only accurate but also robust and explainable, addressing a key requirement for security analysts who must understand and act on automated verdicts.

Subject of Research: A hybrid host telemetry dataset and machine learning pipelines for robust, explainable ransomware detection and family attribution

Article Title: Towards robust and explainable ransomware detection and attribution with host telemetry datasets

Article References: Beltrán-Lopez, P., Gil Pérez, M., & Nespoli, P. (2026). Towards robust and explainable ransomware detection and attribution with host telemetry datasets. Cluster Computing, 29(15), Article 886. https://doi.org/10.1007/s10586-026-06734-1

Image Credits: AI Generated

DOI: 10.1007/s10586-026-06734-1

Keywords: ransomware, host telemetry, machine learning, deep learning, malware detection, family attribution, SHAP explainability, robustness assessment, Cuckoo Sandbox, Windows 10, cybersecurity, dataset