Article Details

Abstract

With the full cloud-based deployment of 5G core networks, operator cloud resource pools become the primary hosting platform for critical services, and their backup data face severe threats of targeted ransomware attacks. Conventional protection systems show clear deficiencies in anomaly identification and proactive early warning. This paper constructs a ransomware attack detection and early warning model for backup scenarios, proposes a weighted fusion strategy that combines LSTM and Isolation Forest, and designs an adaptive threshold mechanism based on the historical score distribution. In a Cuckoo sandbox environment, 78 malicious samples from 20 ransomware families and 40 normal samples are partitioned in a 7∶2∶1 ratio for ablation and comparative experiments, and pilot validation is conducted on more than 2,000 devices in an operator cloud resource pool. The results show that the fused model achieves an accuracy of 0.978, a false positive rate of 2.2%, and an F1 score of 0.978, which provides a feasible technical path for proactive ransomware protection of core data in operator cloud networks.

Keywords

operator cloud resource pool; backup data security; ransomware attack detection; anomaly detection; proactive early warning

References

1. [1] Wei Songjie, Wu Qinqin, Yuan Junyi Research on Dynamic Detection Method of Ransomware Based on Operational Parameter Enhancement API Sequence [J]. Information Network Security, 2025, 25 (5): 713-721
2. [2] Cen M C，Jiang F，Doss R. RansoGuard: A RNN-based Framework Leveraging Pre-attack Sensitive APIs for Early Ransomware Detection [J/OL].Computers & Security，2025，150.10.1016/j.cose.2024.104293.
3. [3] Zhao Wenyu, Party Chenxi, Du Zhenhua, etc Research and Implementation of Ransomware Detection Technology Based on Hardware Performance Counter [J]. Information Network Security, 2025, 25 (9): 1397-1406
4. [4] Sun Kaixuan, Tang Yuanxin, Li Song, etc Machine learning ransomware detection method based on comprehensive behavioral characteristics [J]. Journal of Harbin Institute of Technology, 2025, 30 (4): 102-110
5. [5] Mahmoud H A，Abdelgawad A E，Soliman A T，et al. Real-Time Ransomware Detection in Cloud VMs Using Behavioral Biometrics, Homomorphic Encryption and GMM-Based Anomaly Detection [J/OL].International Journal of Information Security，2025，24（6）： 235.https://doi.org/10.1007/s10207-025-01151-8.
6. [6] Chen Kai, Ma Duohe, Tang Zhimin, etc Anti ransomware method based on active deception [J]. Journal of Communications, 2024, 45 (7): 148-158
7. [7] Yao Zheng Analysis of the transmission path and protection strategy of ransomware [J]. Information Industry Report, 2025 (9): 89-91
8. [8] Ding Mei, Liu Dan, Peng Yang Research on the Impact of Ransomware on Technological Information Security [J]. Software Guide, 2024, 23 (6): 121-127
9. [9] Zheng Xiaoyu, Yang Ying, Wang Long Research on Ransomware Organization Attack Methods Based on ATT&CK Model [J]. Information Security Research, 2023, 9 (11): 1054-1060
10. [10] Qiu Ling Practical Analysis of Big Data Technology in Computer Network Information Security Processing [J]. Information Recording Materials, 2023, 24 (3): 83-85
11. [11] Liu Xin, Cao Jing, Shao Zhijie, etc Research on Anti Ransomware Countermeasures Based on Storage Technology [J]. Information and Communication Technology and Policy, 2022 (8): 36-42
12. [12] Liu Wenjing, Guo Chun, Shen Guowei, etc Early detection method for ransomware based on deep learning [J]. Computer Science, 2023, 50 (3): 391-398
13. [13] Dong Yuhong, Song Guangjia A Review of the Development of Ransomware Technology [J]. Computer Applications and Software, 2023, 40 (1): 331-343
14. [14] Wang Wei, Zhao Yifang Computer network information security and protection strategies in the era of big data [J]. China Arab Science and Technology Forum (in Chinese and English), 2022 (1): 72-75
15. [15] Lin Wei, Zhang Yuxi, Zhang Chi Application of Data Encryption Technology in Computer Network Information Security [J]. Wireless Internet Technology, 2022, 19 (13): 27-29

About the authors

Li Yu (1974-), male, Han ethnicity, from Cangwu, Guangxi, senior engineer (full grade), master's student, research interests include cloud computing technologies, IP networks and network security technology research and applications; Liang Hongzhi (1991-), male, Han ethnicity, from Cenxi, Guangxi, engineer, bachelor's degree, research interests include network information security and cloud-network security and operations; Yang Junjie (1993-), male, Han ethnicity, from Wuwei, Gansu, engineer, master's student, research interests include cloud computing and SDN/NFV technology research and applications; Peng Zixuan (1994-), female, Han ethnicity, from Zhaoqing, Guangdong, engineer, bachelor's degree, research interests include carrier cloud computing and cloud security consulting and design; Wang Liguo (1981-), male, Han ethnicity, from Loudi, Hunan, engineer, master's student, research interests include data and network information security and business continuity protection and data backup operations.