AI-DRIVEN RANSOMWARE DETECTION AND PREVENTION FRAMEWORK FOR ENTERPRISE NETWORKS USING BEHAVIORAL AND NETWORK TELEMETRY

Objective: To address this challenge, this research presents an AI-Driven Ransomware Detection and Prevention Framework for Enterprise Networks Using Behavioral and Network Telemetry, a framework that supports the early detection and prevention of ransomware attacks by leveraging intelligent analysis of network behavior and traffic characteristics. The proposed framework aims to combine machine learning with behavioral analytics to detect malicious activities by analyzing network telemetry attributes, traffic patterns, and communication behaviors in enterprise contexts. Method: The UNSW-NB15 benchmark dataset is used to train and test the proposed framework due to the availability of a complete set of enterprise network traffic with both normal and malicious traffic having forty-nine engineered behavioral and network telemetry features. While the dataset is not 100% ransomware-specific, it is suitable for representing malicious network behaviour, which can be used to develop and test AI-based models of cyber threats. The framework consists of data preprocessing, feature engineering, model development using supervised machine learning, anomaly detection, and automated prevention mechanisms, to help boost detection efficiency while minimizing false positive rates. The performance is evaluated based on well-known cyber security metrics such as Accuracy, Precision, Recall, F1-Score, Receiver Operating Characteristic (ROC), Area under the Curve (AUC), and Confusion Matrix analysis. Results: The planned policy will boost enterprise cyber security by facilitating proactive detection of suspicious network activity that can prevent ransomware attacks from becoming a threat to organizational assets. The results should help to prove the value of artificial intelligence in today's cyber security landscapes and offer real support for enterprise-scale adoption of AI ransomware mitigation techniques. Novelty: The research provides a scalable, intelligent, data-driven security framework capable of responding to threats quickly, augmenting incident response capabilities and bolstering the resiliency of enterprise networks to the changing nature of ransomware attacks.