Autonomous Ransomware Containment and Recovery Optimization across Enterprise Systems Using Deep Reinforcement Learning

Abstract

The increasing frequency and sophistication of ransomware attacks pose significant challenges to enterprise cybersecurity, particularly in organizations operating complex and interconnected information systems. Traditional ransomware defense mechanisms primarily focus on signature-based detection, manual incident response, and predefined recovery procedures, which may be insufficient for addressing rapidly evolving ransomware threats. This research proposes an autonomous ransomware containment and recovery optimization framework using Deep Reinforcement Learning (DRL) to improve enterprise system resilience. The proposed approach integrates intelligent threat detection, automated containment decision-making, attack impact assessment, and recovery resource optimization. Deep reinforcement learning algorithms are investigated to enable security systems to learn optimal defensive policies through interactions with simulated enterprise environments. The framework considers important security parameters, including attack severity, compromised system identification, network connectivity, data availability, recovery costs, and business service priorities. Intelligent agents evaluate defensive actions such as workload isolation, access restriction, backup protection, service restoration, and recovery prioritization within controlled environments. The research aims to minimize ransomware propagation, reduce operational disruption, optimize recovery time, and maintain enterprise service availability. Performance evaluation considers containment effectiveness, recovery efficiency, decision-making latency, and resource utilization. By combining autonomous decision-making with adaptive learning, the proposed framework seeks to establish an intelligent and scalable approach for strengthening enterprise cybersecurity and improving organizational resilience against ransomware incidents.