Desarrollo de detección de amenazas cibernéticas en redes empresariales usando algoritmos supervisados

Abstract

Currently, ransomware poses a serious threat to business operations by hal- ting internal processes and essential services. Given the constant evolution of these techniques, more effective and flexible detection methods are essential. To address this difficulty, a strategy based on the CRISP-DM model was applied, combining machine learning algorithms with storage access analysis. The study used the public RanSAP dataset, which includes activity logs of both legitimate programs and ransomware variants. By extracting features and using techniques such as SHAP, it was possible to analyze system behavior. Among the trained models, Random Forest provided the best results, with an F1 score of 0.96 and an AUC of 0.98, standing out as the most capable option.