Building a Ransomware Detection System with Blockchain Logging

anoshay ambar — Tue, 20 Oct 2026 20:15:15 +0000

Developing Ransomware Detection System Using Blockchain Logging - My FYP Project

Being a Computer Science student from COMSATS University Islamabad, I always wanted my final year project to address a practical issue. We thought of developing a system that detects ransomware as well as maintains the logs using blockchain.

Here’s how I developed it.

❌The Problem

A common drawback of traditional anti-virus systems is that their functionality is based on the signature which can be bypassed by the ransomware very easily. In addition, after attacking any system, attackers can remove/delete/modify the system logs.

So, our project was about solving these two issues:

Detect ransomware behavior using Machine Learning
Ensure that the logging is secure and tamper proof

🔧Tech Stack Used

Frontend: Flutter
Backend: Python Flask/FastAPI
Database: SQLite
Machine Learning Model: Random Forest Classifier
Blockchain Logging: Custom blockchain based on SHA-256 hashing
API: REST APIs

🏗️ How It Works - Architecture

It is pretty straightforward yet highly effective:

1. Data Collection & Feature Extraction:
We analyze activity in the file system such as fast file encryption, extension change (.encrypted, .locked), entropy, etc., and also suspicious API calls.

2. ML Detection (Random Forest):
Random Forest machine learning was trained based on two classes – benign programs and ransomware. This particular algorithm was chosen because its accuracy equals 95%, has a few false positives and works fine with tabular data.

3. Alerting System:
In case ransomware was detected the following actions are taken:

The process is stopped.
Alert is delivered to the Flutter application.
Log is created.

4. Blockchain Logging:
This is the best part. In contrast to storing logs in the common database we use hashing of the log files with SHA-256 algorithm with linking to the previous log's hash.

Block = { data, timestamp, previous_hash, current_hash }

Any attempt to change the previous block will cause breaking the hash chain. Hence, logs are immutable.

💻 A Quick Code Snippet (Blockchain Log)