An online incremental (stream) learning system for real-time ransomware detection that ingests detailed Windows system-activity telemetry from Sysmon, selects the most informative features with the Pearson Correlation Coefficient, and continuously updates a streaming classifier while an ADWIN concept-drift detector keeps it responsive to evolving ransomware behaviour. By learning incrementally rather than retraining from scratch it closes the 'training gap' left by non-incremental models; benchmarked against Hoeffding Trees and the Leveraging Bagging Classifier it reaches high accuracy and Matthews Correlation Coefficient on an imbalanced stream while using less memory and running faster.
Most machine-learning ransomware detectors are non-incremental: to catch a new strain the model must be rebuilt from scratch, which is slow, resource-intensive, and leaves a 'training gap' during whi…