Ransomware Practice Test File (CSV)
===================================

This synthetic dataset is designed for machine learning-based ransomware detection training.
Each row represents 1-minute endpoint activity telemetry.

Label:
0 = Normal Activity
1 = Ransomware Activity

Column Descriptions:

timestamp_utc
Time window timestamp in UTC.

host_id
Unique identifier of the monitored endpoint.

files_modified
Number of files modified in the time window. Ransomware typically modifies many files rapidly.

file_rename_rate_per_min
Rate of file renaming per minute (common during encryption attacks).

avg_file_entropy
Average entropy of modified files. Higher entropy often indicates encryption behavior.

cpu_usage_percent
System CPU usage percentage. Encryption spikes CPU usage.

disk_io_mb_per_min
Disk I/O activity per minute in megabytes.

process_spawn_rate
Number of new processes created during the window.

suspicious_extension_count
Count of files with suspicious encrypted extensions.

shadow_copy_deleted
Indicates whether backups/shadow copies were deleted (1 = Yes, 0 = No).

unusual_process_detected
Flag for abnormal or unknown process behavior.