MSc Cybersecurity Project — University of Roehampton, 2026
This project develops and evaluates an AI-assisted detection system for identifying Living-off-the-Land (LotL) ransomware attacks in Windows Sysmon log data. LotL attacks abuse legitimate, pre-installed Windows tools such as PowerShell and WMI to carry out malicious activity, leaving no external files to scan and no signatures to match. This makes them exceptionally difficult to detect using conventional rule-based approaches.
The system uses a Random Forest machine learning classifier trained on the CSU Ransomware Dataset, compared against Decision Tree and Logistic Regression as baseline classifiers, and evaluated against a feature-based Sigma rule approximation. LIME (Local Interpretable Model-Agnostic Explanations) is applied to generate interpretable, feature-level explanations for individual model predictions, making the system practical and transparent for SOC analysts.
| Model | Accuracy | Precision | Recall | F1 Score |
|---|---|---|---|---|
| Random Forest | 98.15% | 93.04% | 99.37% | 96.10% |
| Decision Tree | 98.12% | 93.03% | 99.23% | 96.03% |
| Logistic Regression | 95.59% | 89.86% | 91.02% | 90.43% |
| Sigma Rules (Strict) | 77.12% | 85.34% | 0.20% | 0.40% |
| Sigma Rules (Loosened) | 75.26% | 44.46% | 31.95% | 37.18% |
The Random Forest model achieved a recall of 99.37%, catching 16,075 out of 16,177 ransomware entries in the test set, missing only 102. The feature-based Sigma rule baseline achieved just 0.20% recall, missing 80,720 ransomware entries. This represents a recall gap of 99.17 percentage points, confirming that machine learning significantly outperforms rule-based detection for this task.
LIME explainability analysis identified process_vs_parent_freq_ratio as the single most important detection feature, corresponding to MITRE ATT&CK technique T1059 (Command and Scripting Interpreter), validating that the model is detecting behaviourally meaningful attack patterns rather than statistical noise.
The primary dataset used is the CSU Ransomware Dataset, publicly available at:
https://github.com/CSCRC-SCREED/CSU-Ransomware-Data
- 352,876 labelled Windows Sysmon log entries
- 19 pre-engineered behavioural features
- Binary labels: benign (good) and ransomware (ransom)
├── explore_data.py # Load and explore the dataset ├── preprocess.py # Label encoding, feature split, train/test split ├── train_model.py # Train the Random Forest classifier ├── evaluate_model.py # Evaluate model performance and confusion matrix ├── model_comparison.py # Compare Random Forest, Decision Tree, Logistic Regression ├── model_comparison_cv.py # Cross-validation comparison of all three models ├── hyperparameter_tuning.py # Grid Search hyperparameter optimisation ├── sigma_rules.py # Feature-based Sigma rule baseline (strict) ├── sigma_rules_updated.py # Sigma rule sensitivity analysis (loosened) ├── lime_explain.py # LIME explainability for individual predictions ├── feature_importance.py # Feature importance analysis and visualisation └── requirements.txt # Required Python libraries
- Python 3.13.5
- See requirements.txt for all required libraries
To install all required libraries, run:
pip install -r requirements.txt
- Clone this repository or download the files
- Download the CSU Ransomware Dataset from the link above and save it as
Ransomware_Data.csvin the same folder as the scripts - Install the required libraries using the command above
- Run the scripts in this order:
python explore_data.py python preprocess.py python train_model.py python evaluate_model.py python model_comparison.py python model_comparison_cv.py python hyperparameter_tuning.py python sigma_rules.py python sigma_rules_updated.py python lime_explain.py python feature_importance.py
| Tool | Purpose |
|---|---|
| Python 3.13.5 | Primary programming language |
| Pandas 3.0.3 | Data loading and manipulation |
| Scikit-learn 1.9.0 | Model training and evaluation |
| LIME 0.2.0.1 | Explainability |
| Matplotlib 3.11.0 | Data visualisation |
Faith Okonoboh MSc Cybersecurity University of Roehampton 2026
This project was supervised by Dr Mastaneh Davis, University of Roehampton. The CSU Ransomware Dataset was created by CSCRC-SCREED and is used here for academic research purposes only.
This project is licensed under the MIT Licence — see the LICENSE file for details.