Abstract: A system and a method for terminating ransomware based on detection of anomalous data is disclosed. The system and the method comprise a registry activity monitoring subsystem, a file trap monitoring subsystem, a decision generating subsystem, and a termination subsystem. The registry activity monitoring subsystem is configured to generate first data and the file trap monitoring subsystem is configured to generate second data. The first data and the second data are transferred to the decision generating subsystem for retrieving Process IDs (PIDs) to initiate a ransomware termination process. Upon confirmation from the decision generating subsystem, the termination subsystem is configured to terminate the retrieved Process IDs (PIDs) to terminate the ransomware based on the detection of the anomalous data from one or more computing devices.

Abstract: A system and method for kernel-level active darknet monitoring in a communication network is disclosed. The system receives TCP packets from initiator devices and determines dark internet protocol (IP) addresses in the packets by comparing destination IP address with a plurality of IP addresses stored in a dark IP pool. If the packets are determined to be destined for dark IP addresses, the system modifies flag and type in socket buffer and routing entry associated with packets. The system retrieves outbound interface IP addresses and creates a socket corresponding to the retrieved outbound interface IP addresses, for transmitting a SYN-ACK packet corresponding to the TCP packets. The system is configured to monitor dark IP addresses received through network traffic. Finally, the system outputs the SYN-ACK packet to initiator devices to establish a three-way handshake. The system receives an ACK from initiator devices (attackers) to establish a 3-way handshake.