  In this work, we propose a two-phased approach for real-time detection and
deterrence of ransomware. To achieve this, we leverage the capabilities of eBPF
(Extended Berkeley Packet Filter) and artificial intelligence to develop both
proactive and reactive methods. In the first phase, we utilize signature based
detection, where we employ custom eBPF programs to trace the execution of new
processes and perform hash-based analysis against a known ransomware dataset.
In the second, we employ a behavior-based technique that focuses on monitoring
the process activities using a custom eBPF program and the creation of ransom
notes, a prominent indicator of ransomware activity through the use of Natural
Language Processing (NLP). By leveraging low-level tracing capabilities of eBPF
and integrating NLP based machine learning algorithms, our solution achieves an
impressive 99.76% accuracy in identifying ransomware incidents within a few
seconds on the onset of zero-day attacks.
