Abstract: Disclosed are techniques to detect and prevent malware attacks, and more specifically, a subset of malware attacks called ransomware (which is not to suggest that the disclosed techniques are not applicable to detecting other types of malware attacks that exhibit some of the same behaviors). Example embodiments disclose systems, like a ransomware protection service (RPS) and platform, and techniques employed by such systems to detect and stop ransomware from encrypting files and systems. Disclosed techniques implemented by the RPS and platform are expected to provide protection against new or unknown ransomware malware, also known as zero-day attacks.