DroidRan: hardware behavior dataset for multi-stage android ransomware detection

Abstract

Android ransomware increasingly exploits unpatched kernel vulnerabilities, still conventional detection methods rely on static application features, system logs, or network flows that polymorphic variants readily obfuscate. Hardware-level behavioral telemetry offers a tamper-resistant alternative, but no public dataset links such telemetry to the ransomware lifecycle. This paper presents DroidRan, a benchmark dataset of 22 dynamic hardware-behavior features spanning six resource categories, collected from an Android device carrying the unpatched CVE-2024-36971 vulnerability while 12 ransomware families were executed through three squatting attack vectors. Feature variations are mapped to four MITRE ATT&CK mobile stages: initial access (IA), privilege escalation (PE), command and control (CC), and impact (Im). A gated recurrent unit–long short-term memory (GRU-LSTM) framework combining parallel stage-specific branches, a cluster-based graph Bayesian network with correlation attention, and a dynamic threat intelligence module is proposed to exploit these traces. The Friedman test confirms that all 22 features discriminate benign from ransomware behavior, and cross-dataset benchmarking against CICMaldroid2017, CICAndMal2020, and HelDroid with Wilcoxon post-hoc analysis ranks DroidRan first for both accuracy and F1-score. The proposed framework outperforms four recent deep learning baselines on DroidRan, supporting stage-aware and obfuscation-resilient ransomware detection.