Abstract: The technology disclosed herein provides a method including receiving a plurality of input/output (IO) requests at an object store, removing one or more fields from each of the plurality of input/output (IO) requests to generate a plurality of condensed IO requests, transforming one or more fields of each of the plurality of condensed IO requests to generate transformed IO requests, combining a predetermined number of transformed IO requests to generate IO trace temporal sequences, generating machine learning (ML) model input feature vectors by assigning each of the IO trace temporal sequences a ground truth value indicating whether the IO trace temporal sequence represents a ransomware attack, and training an ML model using a plurality of the ML model input feature vectors.