Development of an AI-Powered Ransomware Early Warning System for Hospital Managements
Ransomware poses an escalating threat to healthcare institutions, where attacks disrupt clinical workflows, compromise patient data, and directly endanger patient safety. Existing detection systems are reactive, binary in classification, and lack contextual awareness of hospital-specific risk. This paper presents the design and implementation of Leadeks REWS, an AI-powered, hospital-aware ransomware early warning system that classifies system behaviour into three stages: normal, pre-encryption, and encryption, using a Random Forest ensemble classifier trained on dynamic behavioural features. The system identifies the affected hospital subsystem (Electronic Health Records, Picture Archiving and Communication Systems, or Administrative Systems), assigns a clinical risk level, and surfaces confidence-scored alerts through a real-time Flask and MongoDB dashboard with stage-specific mitigation recommendations. A rule-based Hospital Security Monitor additionally detects brute-force, privilege-escalation, and cross-system attacks within three interactive hospital subsystems. The Random Forest model, trained on an 80/20 stratified split of a 2,000-sample dynamic ransomware dataset, achieved 91% overall classification accuracy and 87% recall for the pre-encryption stage, outperforming Logistic Regression, single Decision Tree, and Support Vector Machine baselines. Twenty-five structured test cases and a formal evaluation against eight non-functional requirements confirm that the system delivers low-latency, reliable, and clinically prioritised ransomware detection suited to resource-constrained hospital environments.