Real-Time Malware Process Detection and Automated Process Killing

Table 13

Total number of files corrupted by ransomware with no process killing and with three process killing models within the first 30 seconds of execution. Damage reduction is the percentage of files spared when no killing is implemented.

Model	Files damaged	Damage reduction	Detection rate (ransomware TPR)	Test set TPR
No killing	19,997	—	—	—
DT pro rolling mean 2	3	99.98%	100.00	88.40
RF glo + pro min alerts 2	1,464	92.68%	100.00	87.97
GBDT regressor + min 4 alerts	15,432	22.83%	22.07	56.04
AdaBoost regressor	20,578	0.00%	9.09	8.83