Copyright © 2026 Authors retain the copyright of this article. This article is an open access article distributed under the Creative Commons Attribution License which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

@article{197420,
        author = {Zeba unnisa and Md Shoaib Uddin Chanda and Mohammed Asim and Maimona Jaweed},
        title = {Enhanced Ransomware Detection Using VMware-Based HPC Feature Extraction and CNN2D Optimisation with SHAP Explainability Analysis},
        journal = {International Journal of Innovative Research in Technology},
        year = {2026},
        volume = {12},
        number = {11},
        pages = {5997-6008},
        issn = {2349-6002},
        url = {https://ijirt.org/article?manuscript=197420},
        abstract = {Ransomware continues to be one of the most financially destructive categories of malware, with projected annual global damages exceeding $265 billion by 2031. Conventional detection systems that operate within the victim machine are increasingly inadequate: they introduce runtime overhead and are vulnerable to being disabled by the attacker. This paper proposes a detection framework that collects Hardware Performance Counter (HPC) data and disk I/O event counts entirely through the VMware hypervisor interface, external to the victim environment, and applies a two-dimensional Convolutional Neural Network (CNN2D) to the resulting 13-feature vector. Experiments on the publicly available Harvard Dataverse HPC and I/O Events dataset — 6,000 labelled samples, 22 ransomware families, six user workloads — show the Extension CNN2D achieves 98.92% accuracy with an average inference latency of 3.21 ms, against a 400 ms baseline in the prior work of Thummapudi et al. Seven baseline classifiers are evaluated in full, with XGBoost achieving 100% on the test set and Random Forest 98.42%. A SHAP explainability analysis, applied here for the first time on this dataset, reveals that Branch Mispredictions and Cache Misses are the two dominant ransomware indicators — an unexpected result that challenges the assumption that disk write activity is the primary detection signal. Adversarial robustness testing under Gaussian feature perturbation confirms 98.67% attack detection at 50% noise. Ten-fold stratified cross-validation yields 99.08% ± 0.39%, confirming that results are stable across all data partitions.},
        keywords = {Ransomware Detection; Hardware Performance Counters; CNN2D; VMware; SHAP; Machine Learning; Deep Learning; Adversarial Robustness; Real-Time Detection; Cybersecurity},
        month = {April},
        }