Developing Ransomware Detection System Using Blockchain Logging - My FYP Project

Being a Computer Science student from COMSATS University Islamabad, I always wanted my final year project to address a practical issue. We thought of developing a system that detects ransomware as well as maintains the logs using blockchain.

Here’s how I developed it.

❌The Problem

A common drawback of traditional anti-virus systems is that their functionality is based on the signature which can be bypassed by the ransomware very easily. In addition, after attacking any system, attackers can remove/delete/modify the system logs.

So, our project was about solving these two issues:

  1. Detect ransomware behavior using Machine Learning
  2. Ensure that the logging is secure and tamper proof

🔧Tech Stack Used

  • Frontend: Flutter
  • Backend: Python Flask/FastAPI
  • Database: SQLite
  • Machine Learning Model: Random Forest Classifier
  • Blockchain Logging: Custom blockchain based on SHA-256 hashing
  • API: REST APIs

🏗️ How It Works - Architecture

It is pretty straightforward yet highly effective:

1. Data Collection & Feature Extraction:
We analyze activity in the file system such as fast file encryption, extension change (.encrypted, .locked), entropy, etc., and also suspicious API calls.

2. ML Detection (Random Forest):
Random Forest machine learning was trained based on two classes – benign programs and ransomware. This particular algorithm was chosen because its accuracy equals 95%, has a few false positives and works fine with tabular data.

3. Alerting System:
In case ransomware was detected the following actions are taken:

  • The process is stopped.
  • Alert is delivered to the Flutter application.
  • Log is created.

4. Blockchain Logging:
This is the best part. In contrast to storing logs in the common database we use hashing of the log files with SHA-256 algorithm with linking to the previous log's hash.

Block = { data, timestamp, previous_hash, current_hash }

Any attempt to change the previous block will cause breaking the hash chain. Hence, logs are immutable.

💻 A Quick Code Snippet (Blockchain Log) 

 python import hashlib import time def generate_hash(message, previousHash): block_string = f"{message}{time.time()}{previousHash}" return hashlib.sha256(block_string.encode()).hexdigest() # Generating a safe log log_message = "Ransomware detected: PID 4042" previous_hash = "0000abc..." safe_hash = generate_hash(log_message, previous_hash) print(f"Safe Log: {safe_hash}") 🎯 Achievements 1.Accuracy in Detection: ≈94-96% on test data 2.Alerting Real-time alerts within <2 secs 3.Logs are completely tamper proof and are verifiable Challenges | Faced 1.Finding a pure dataset of ransomware behavior was difficult. 2.Find a balance between false positives and alerts. 3.To make blockchain lightweight to not affect performance. Conclusion Through this project, I have realized that Cybersecurity is not only about coding but about thinking like a hacker as well. The combination of AI + Blockchain provided me with a different viewpoint. If you are working on a similar Final Year Project or looking for the GitHub Code, then let’s connect! *About the Author* My name is Anoshay Ambar. I have graduated in Computer Science from COMSATS University Islamabad. I love cybersecurity, AI, and health tech. Let’s get connected through: [LinkedIn](https://www.linkedin.com/in/anoshay-ambar-174011397) | Email: anoshayambar@gmail.com