{"id":867,"date":"2025-04-14T04:07:00","date_gmt":"2025-04-14T04:07:00","guid":{"rendered":"https:\/\/academicsociety.org\/deij\/?p=867"},"modified":"2026-06-27T04:20:56","modified_gmt":"2026-06-27T04:20:56","slug":"a-comprehensive-framework-for-ransomware-prevention-using-trusted-execution-environments-in-localized-blockchain-systems","status":"publish","type":"post","link":"https:\/\/academicsociety.org\/deij\/a-comprehensive-framework-for-ransomware-prevention-using-trusted-execution-environments-in-localized-blockchain-systems\/","title":{"rendered":"A Comprehensive Framework for Ransomware Prevention Using Trusted Execution Environments in Localized Blockchain Systems"},"content":{"rendered":"\n
    \n
  1. Introduction<\/strong><\/li>\n<\/ol>\n\n\n\n

    Rapid evolution has made ransomware one of the most disruptive and financially costly cyber threats, attacking corporations, healthcare systems, financial institutions, and vital infrastructures globally. Ransomware uses powerful encryption algorithms, file-less execution models, and trust exploitation to enter systems, encrypt data, and demand ransom. These complex attack vectors require intelligent, decentralised, and hardware-assisted defence solutions. Antivirus and firewalls are becoming ineffectual. Recent research has examined how blockchain and TEEs might improve cybersecurity architectures. For example, blockchain-enhanced deep learning models can improve TEE intrusion detection [1], and efficient public blockchain frameworks can reduce ransomware threats in digital healthcare [2]. Collaborative blockchain-enabled intrusion detection improves IoT and cloud network security [3]. Blockchain-based federated learning with safe aggregation in TEEs improves secrecy and distributed trust management [4]. Threat modelling methods for blockchain-enabled systems emphasise organised security architecture in decentralised infrastructures [5].Following these advances, this article suggests integrating Trusted Execution Environments into localised blockchain systems to create secure, tamper-resistant, and decentralised ransomware prevention measures. This study aims to develop, build, and evaluate a unified security architecture that prevents ransomware infection using hardware-level isolation, blockchain-based integrity, consensus, and smart contract enforcement.<\/p>\n\n\n\n

    An overview of previous literature that is relevant to this research is provided in the following section<\/p>\n\n\n\n

    Research Gap<\/strong><\/p>\n\n\n\n

    Despite advances in blockchain-enabled cybersecurity, machine learning-based ransomware detection, Zero-Trust architectures, and TEE integrations, most studies focus on detection, mitigation, or post-attack recovery rather than proactive prevention. Some blockchain-based solutions prioritise data integrity and decentralised logging over hardware-level secure execution to prevent ransomware encryption. While machine learning and federated learning improve detection accuracy, they are reactive and vulnerable to sophisticated, file-less, and zero-day ransomware variants. Zero-Trust frameworks improve access control but do not guarantee tamper-proof execution environments or decentralised system process validation. Most frameworks use isolated security layers instead of a cohesive architecture with hardware security, decentralised consensus, and automated smart contract enforcement. Therefore, a comprehensive, prevention-oriented framework that blends Trusted Execution Environments with localised blockchain systems to provide proactive, tamper-resistant, and decentralised ransomware defence is needed, which is this paper’s goal.<\/p>\n\n\n\n

      \n
    • Methodology<\/strong><\/li>\n<\/ul>\n\n\n\n

      Machine learning-based behavioural monitoring, Trusted Execution Environment (TEE) protection, and a localised blockchain (Local-BC) system in a distributed smart-zone architecture create a ransomware prevention framework. The framework starts in a Smart-Home Zone with various IoT nodes (A\u2013E) connected to a Master Node. IoT data generated from these nodes is continuously monitored using a Behaviour Monitor module. Based on file access patterns, encryption attempts, privilege escalation, and odd network call-backs, machine learning classifies system actions as normal or malicious.Critical transactions and system events are cryptographically hashed and sent to a TEE-enabled Local Blockchain ledger after classification. The TEE secures policy validation, encryption authorisation, and transaction verification to prevent ransomware processes from modifying data. Tamper-proof logging and integrity verification are ensured by the Local-BC’s immutable policy records and validated transaction entries.Decentralised trust validation across Smart Healthcare, Smart School, and Smart Grid zones is enabled by the localised blockchain and Public Blockchain layer. Smart contracts immediately activate containment features when malicious activity is identified.The integrated architecture across smart environments is shown in the Proposed TEE-Enabled Localised Blockchain Framework for Ransomware Prevention.<\/p>\n\n\n\n

        \n
      • Results and Discussion<\/strong><\/li>\n<\/ul>\n\n\n\n

        Experimental results show that the behaviour-monitoring and trust-evaluation framework secures IoT-Blockchain environments. To learn typical behaviour, the deep autoencoder model was trained on benign data from Eco bee-thermostat, Webcam, and Security-camera traffic in real time. When tested against malicious traffic, including Mirai-based DDoS attacks, the framework achieved a high True Positive Rate (TPR) of 99.2% with a significantly low False Positive Rate (FPR), outperforming conventional algorithms such as Support Vector Machine (SVM), Isolation Forest, and Local Outlier Factor (LOF). Figure 2 (Detection Accuracy Comparison with Other Algorithms) reveals that the proposed model outperforms Isolation Forest across all devices.<\/p>\n\n\n\n

        The autoencoder-based technique has the lowest average detection time among all investigated models, as shown in Figure 3 (Detection Time Comparison with Other Algorithms). The framework has an average detection latency of 175\u00b1230 milliseconds, allowing for attack identification and alert production in under one second. SVM and LOF take longer to process, while Isolation Forest is less accurate and slower.<\/p>\n\n\n\n

        Figure 3: Detection time comparison with other Algorithms<\/p>\n\n\n\n

        Master nodes’ local blockchains enable tamper-proof transaction logging through hash storage, and the Trusted Execution Environment (TEE) safeguards sensitive computations in secure enclaves. Deep learning, blockchain, and TEE-based architecture improve detection accuracy, reaction time, and device-level trust evaluation across IoT zones. The TEE-enabled localised blockchain framework’s results accord with and improve on Lawal [9] and Matnale & Jadhav [10]. Lawal [9] presents a Zero-Trust Architecture (ZTA) for financial cloud ransomware prevention that emphasises tight identity verification, least-privilege access control, and continuous authentication. The ZTA concept lowers unauthorised access and lateral movement but focuses on perimeter and access-layer security. Deep learning-based behavioural monitoring, blockchain-based immutability, and TEE isolation are added to the proposed system beyond access control. This solution provides infiltration prevention, real-time detection (99.2% TPR), and rapid reaction (\u2248175\u00b1230 ms), enhancing device-level trust validation. Matnale & Jadhav [10]’s ML-RDM methodology uses multi-layered machine learning to defend against developing ransomware ecosystems. ML-RDM uses layered ML to improve adaptive detection, however it lacks decentralised trust validation and hardware-assisted safe execution. The current study outperforms ML-only techniques by integrating intelligent anomaly detection with blockchain-backed tamper-proof logging and TEE-secured execution. Thus, the proposed framework offers a more complete, prevention-oriented, and hardware-enforced cybersecurity architecture for dispersed IoT and smart environments than Zero-Trust and ML-RDM.<\/p>\n\n\n\n

          \n
        • Conclusion<\/strong><\/li>\n<\/ul>\n\n\n\n

          Behaviour-based deep learning, Trusted Execution Environments (TEEs), and localised blockchain architecture in IoT-enabled smart zones create a secure ransomware prevention framework. The proposed system observes device behaviour, classifies activities using an autoencoder model, and computes zone-level trust for secure communication. Experimental results show outstanding performance, with 99.2% True Positive Rate, low False Positive Rate, and 175\u00b1230 millisecond detection time, surpassing classic algorithms like SVM, Isolation Forest, and LOF. TEE secures sensitive activities, while the local blockchain ensures immutability and tamper-proof transaction logging. The framework prevents ransomware and DDoS attacks with decentralised trust management, hardware-level security, and intelligent behavioural analysis. This work creates a scalable, robust, and trustworthy cybersecurity architecture for smart homes and other distributed IoT contexts, advancing safe digital infrastructures.<\/strong><\/p>\n\n\n\n

          References<\/strong><\/p>\n\n\n\n

          [1].         Aliyu, A. A., Ibrahim, M., & Abdulkadir, S. A. (2025). A Blockchain\u2011Enhanced Deep Learning Approach for Intrusion Detection in Trusted Execution Environments. Digital Technologies Research and Applications<\/em>, 4<\/em>(1), 135-157.<\/p>\n\n\n\n

          [2].         Lakhan, A., Thinnukool, O., Groenli, T. M., &Khuwuthyakorn, P. (2023). RBEF: ransomware efficient public blockchain framework for digital healthcare application. Sensors<\/em>, 23<\/em>(11), 5256.<\/p>\n\n\n\n

          [3].         Alkadi, O., Moustafa, N., Turnbull, B., & Choo, K. K. R. (2020). A deep blockchain framework-enabled collaborative intrusion detection for protecting IoT and cloud networks. IEEE Internet of Things Journal<\/em>, 8<\/em>(12), 9463-9472.<\/p>\n\n\n\n

          [4].         Kalapaaking, A. P., Khalil, I., Rahman, M. S., Atiquzzaman, M., Yi, X., &Almashor, M. (2022). Blockchain-based federated learning with secure aggregation in trusted execution environment for internet-of-things. IEEE Transactions on Industrial Informatics<\/em>, 19<\/em>(2), 1703-1714.<\/p>\n\n\n\n

          [5].         Olaogun, B. O., Amini-Philips, A., & Ibrahim, A. K. (2022). Cybersecurity Threat Modeling Framework for Blockchain-Enabled International Payment Networks.<\/p>\n\n\n\n

          [6].         Ahmed, K. R., Semi, M. M. A., Akther, S., Rabbi, M. M. K., Raja, M. R., Chakraborty, U., & Rial, M. I. H. (2025, April). Blockchain-integrated malware detection systems: Enhancing accuracy and trust in cybersecurity. In 2025 4th OPJU International Technology Conference (OTCON) on Smart Computing for Innovation and Advancement in Industry 5.0<\/em> (pp. 1-6). IEEE.<\/p>\n\n\n\n

          [7].         Chitraju, S. (2024). Blockchain-Based Data Integrity Mechanisms for Mitigating Ransomware Impact in Cloud Finance Systems. Available at SSRN 5385143<\/em>.<\/p>\n\n\n\n

          [8].         Jabid, T., Rashid, M. R. A., Ferdaus, M. H., Ali, M. S., Islam, M. M., Hasan, M., … & Islam, M. (2024). Ransomware prevention strategies: Building robust cyber defenses. In Ransomware Evolution<\/em> (pp. 144-171). CRC Press.<\/p>\n\n\n\n

          [9].         Lawal, S. (2024). Zero-Trust Architecture for Preventing Ransomware Infiltration in Financial Cloud Environments. Available at SSRN 5384216<\/em>.<\/p>\n\n\n\n

          <\/p>\n","protected":false},"excerpt":{"rendered":"

          Rapid evolution has made ransomware one of the most disruptive and financially costly cyber threats, attacking corporations, healthcare systems, financial institutions, and vital infrastructures globally. Ransomware uses powerful encryption algorithms, file-less execution models, and trust exploitation to enter systems, encrypt data, and demand ransom. These complex attack vectors require intelligent, decentralised, and hardware-assisted defence solutions. […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"ocean_post_layout":"","ocean_both_sidebars_style":"","ocean_both_sidebars_content_width":0,"ocean_both_sidebars_sidebars_width":0,"ocean_sidebar":"","ocean_second_sidebar":"","ocean_disable_margins":"enable","ocean_add_body_class":"","ocean_shortcode_before_top_bar":"","ocean_shortcode_after_top_bar":"","ocean_shortcode_before_header":"","ocean_shortcode_after_header":"","ocean_has_shortcode":"","ocean_shortcode_after_title":"","ocean_shortcode_before_footer_widgets":"","ocean_shortcode_after_footer_widgets":"","ocean_shortcode_before_footer_bottom":"","ocean_shortcode_after_footer_bottom":"","ocean_display_top_bar":"default","ocean_display_header":"default","ocean_header_style":"","ocean_center_header_left_menu":"","ocean_custom_header_template":"","ocean_custom_logo":0,"ocean_custom_retina_logo":0,"ocean_custom_logo_max_width":0,"ocean_custom_logo_tablet_max_width":0,"ocean_custom_logo_mobile_max_width":0,"ocean_custom_logo_max_height":0,"ocean_custom_logo_tablet_max_height":0,"ocean_custom_logo_mobile_max_height":0,"ocean_header_custom_menu":"","ocean_menu_typo_font_family":"","ocean_menu_typo_font_subset":"","ocean_menu_typo_font_size":0,"ocean_menu_typo_font_size_tablet":0,"ocean_menu_typo_font_size_mobile":0,"ocean_menu_typo_font_size_unit":"px","ocean_menu_typo_font_weight":"","ocean_menu_typo_font_weight_tablet":"","ocean_menu_typo_font_weight_mobile":"","ocean_menu_typo_transform":"","ocean_menu_typo_transform_tablet":"","ocean_menu_typo_transform_mobile":"","ocean_menu_typo_line_height":0,"ocean_menu_typo_line_height_tablet":0,"ocean_menu_typo_line_height_mobile":0,"ocean_menu_typo_line_height_unit":"","ocean_menu_typo_spacing":0,"ocean_menu_typo_spacing_tablet":0,"ocean_menu_typo_spacing_mobile":0,"ocean_menu_typo_spacing_unit":"","ocean_menu_link_color":"","ocean_menu_link_color_hover":"","ocean_menu_link_color_active":"","ocean_menu_link_background":"","ocean_menu_link_hover_background":"","ocean_menu_link_active_background":"","ocean_menu_social_links_bg":"","ocean_menu_social_hover_links_bg":"","ocean_menu_social_links_color":"","ocean_menu_social_hover_links_color":"","ocean_disable_title":"default","ocean_disable_heading":"default","ocean_post_title":"","ocean_post_subheading":"","ocean_post_title_style":"","ocean_post_title_background_color":"","ocean_post_title_background":0,"ocean_post_title_bg_image_position":"","ocean_post_title_bg_image_attachment":"","ocean_post_title_bg_image_repeat":"","ocean_post_title_bg_image_size":"","ocean_post_title_height":0,"ocean_post_title_bg_overlay":0.5,"ocean_post_title_bg_overlay_color":"","ocean_disable_breadcrumbs":"default","ocean_breadcrumbs_color":"","ocean_breadcrumbs_separator_color":"","ocean_breadcrumbs_links_color":"","ocean_breadcrumbs_links_hover_color":"","ocean_display_footer_widgets":"default","ocean_display_footer_bottom":"default","ocean_custom_footer_template":"","omw_enable_modal_window":"enable","ocean_post_oembed":"","ocean_post_self_hosted_media":"","ocean_post_video_embed":"","ocean_link_format":"","ocean_link_format_target":"self","ocean_quote_format":"","ocean_quote_format_link":"post","ocean_gallery_link_images":"on","ocean_gallery_id":[],"footnotes":""},"categories":[25],"tags":[41,39,38,40,37],"article-archive":[20],"class_list":["post-867","post","type-post","status-publish","format-standard","hentry","category-original-research-article","tag-blockchain-architecture","tag-decentralized-security","tag-ransomware-prevention","tag-smart-contracts","tag-trusted-execution-environment","article-archive-volume-6-issue-1-2025","entry"],"acf":[],"_links":{"self":[{"href":"https:\/\/academicsociety.org\/deij\/wp-json\/wp\/v2\/posts\/867","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/academicsociety.org\/deij\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/academicsociety.org\/deij\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/academicsociety.org\/deij\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/academicsociety.org\/deij\/wp-json\/wp\/v2\/comments?post=867"}],"version-history":[{"count":1,"href":"https:\/\/academicsociety.org\/deij\/wp-json\/wp\/v2\/posts\/867\/revisions"}],"predecessor-version":[{"id":869,"href":"https:\/\/academicsociety.org\/deij\/wp-json\/wp\/v2\/posts\/867\/revisions\/869"}],"wp:attachment":[{"href":"https:\/\/academicsociety.org\/deij\/wp-json\/wp\/v2\/media?parent=867"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/academicsociety.org\/deij\/wp-json\/wp\/v2\/categories?post=867"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/academicsociety.org\/deij\/wp-json\/wp\/v2\/tags?post=867"},{"taxonomy":"article-archive","embeddable":true,"href":"https:\/\/academicsociety.org\/deij\/wp-json\/wp\/v2\/article-archive?post=867"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}