A stratified ransomware mitigation model based on zero trust and network segmentation architectures

Abstract

Ransomware poses a significant threat to information technology because of its ability to spread laterally across computer networks. This paper presents the design and implementation of a stratified mitigation model that combines Zero Trust Architecture (ZTA) with network segmentation to impede ransomware propagation. The proposed model integrates continuous verification through ZTA with the structural containment provided by network segmentation. It was implemented using pfSense, VMware, and GNS3, and evaluated using actual flow patterns extracted from a Ryuk ransomware packet-capture (PCAP) dataset. The model demonstrated automated containment based on real ransomware activity patterns, including distinctive Server Message Block (SMB) traffic profiles and rapid byte-transfer rates. Detection and containment were achieved within sub-second timescales, with a time-to-detect (TTD) of 0.31 s and a time-to-contain (TTC) of 0.32 s. These results outperform standalone ZTA (TTD: 1.50 s; TTC: 2.50 s) and standalone network segmentation (TTD: 0.65 s; TTC: 0.65 s). Across 20 controlled simulation runs, the model achieved a detection accuracy of 85.0%, precision of 81.8%, recall of 90.0%, an F1-score of 85.7%, and a false positive rate of 10%. The results show that the hybrid approach offers a pragmatic and measurable improvement over individual strategies for securing networks against ransomware.