From Rules to ML: Detecting Ransomware in Sysmon Logs

Built ransomware detector for Sysmon logs using SILRAD dataset (196k events, 8.5:1 imbalance). Compared simple rule-based detection vs…