FlagThis

Abstract

Ransomware poses an escalating cybersecurity threat as attackers continuously modify behavioural patterns to evade static defenses. Although existing machine learning-based detectors often achieve strong predictive performance, they generally assume fxed training data and do not support the selective removal of previously learned samples. This limitation conficts with privacy regulations such as the GDPR and CCPA, which require the removal of sensitive user data upon request. To address this challenge, we propose an auditable ransomware detection and unlearning framework that integrates deep reinforcement learning with multi-shard SISA retraining. In the proposed system, a Double Deep Q-Network (DDQN) learns a reward-guided detection policy from behavioral features under asymmetric security costs, while multi-shard SISA enables privacy-compliant selective sample removal through shard-level retraining. The framework was evaluated using four criteria: utility preservation, oracle-based forgetting validation, membership inference auditing, and computational efciency. On a balanced Windows 11 behavioral dataset comprising 2,000 samples and 103 features, the baseline DDQN detector achieved an F1 score of 0.9925 and an AUC of 0.9983. The experimental results show that single-shard unlearning maintains minimal utility degradation and low oracle disagreement, whereas moderate shard counts (__= 510) provide the best efciency-performance trade-of, reducing retraining time to 530 s compared with 80330 s for full retraining. In addition, the membership inference scores remain close to 0.5 across most confgurations, indicating limited privacy leakage after unlearning. These fndings demonstrate that a privacy-compliant ransomware detection framework can jointly achieve high detection performance, auditable deletion verifcation, and efcient sample removal.