Prioritizing ransomware indicators of compromise using algorithmic scoring for enhanced threat detection

Abstract

Ransomware is a very serious cybersecurity threat. Its attack methods are continually evolving, which means that it is not very easy to detect it quickly. A big challenge faced in the ransomware defense is how to prioritize indicators of compromise (IoC) efficiently. This paper introduces a hybrid IoC ranking scheme based on static and dynamic analysis of the behavior of commonly circulating ransomware variants. Each IoC is given a weighted score according to its significance for investigations based on actual patterns of occurrence and contextual behavior. Experimental results clearly separate high-confidence indicators from low-confidence ones. Deleting shadow copy and connecting to Tor2web receive the highest rank scores of about 99.99, while older behaviors like locking screen show lower relevance, around 73.11. The proposed algorithm has a linear time complexity of O(n·m) for score calculation and a bounded space complexity of O(n·m), allowing it to scale for large IoC sets. The findings show that this ranked IoC framework enhances early ransomware detection and helps prioritize responses based on evidence in current security systems.