Real-Time Endpoint Ransomware Detection and Prevention via Strategic Deception Directories and Block-Level Entropy Analysis

Abstract

Ransomware remains a major endpoint-security threat because destructive file operations can progress rapidly and modern attacks may use fileless execution and Living-off-the-Land (LotL) techniques. This paper presents a lightweight host-based ransomware detection and prevention prototype for Windows endpoints that combines three mechanisms: strategically placed deception directories (1000_Trap), localized Shannon-entropy analysis, and automated process termination using psutil. The prototype was evaluated in a controlled Windows 10 virtual-machine testbed using the PSRansom simulator across 50 executions. Under this specific PSRansom configuration, all 50 runs were detected, 5-15 decoy files were encrypted before termination, and no protected user files in Desktop, Documents, Downloads, or Pictures were modified. Mean end-to-end containment latency was approximately 5 s, with observed active-phase values ranging from 4820 to 5150 ms, reflecting user-space event-queue and process-handling overhead. Idle CPU utilization remained below 5%. The benign workload cases evaluated in this study, ZIP compression, document editing, spreadsheet processing, media playback, and PDF generation, produced no mitigation events. These results demonstrate feasibility within the tested PSRansom scenario rather than general robustness against all ransomware families or traversal strategies. Random or selective traversal, multi-process encryption, intermittent encryption, privilege escalation, and user-space evasion were not experimentally validated and are treated as limitations and priorities for future evaluation.