--- title: Acronis Machine Learning Improves Ransomware Detection description: Using machine learning models, Acronis Active Protection recognizes unusual patterns of file access and blocks ransomware from damaging files. canonical_url: https://www.acronis.com/en/blog/posts/acronis-machine-learning-improves-ransomware-detection/ locale: en last_updated: 2026-10-27 --- [Acronis Blog](https://www.acronis.com/en/blog/) # Acronis Machine Learning Improves Ransomware Detection Acronis Active Protection is an advanced technology that uses sophisticated analysis to monitor and stop erratic processes on your system. If ransomware somehow manages to get through your anti-virus and starts to encrypt files, Acronis Active Protection will detect the encryption and immediately halt it – automatically restoring the files to the most recently backed up version. While performing well in independent testing and earning accolades from the media, Acronis has worked diligently to make it even better. The result is an improved version that incorporates machine learning and artificial intelligence technologies. [Learn More](https://www.acronis.com/en/products/cyber-protect/) [![Image 2: MSP Threats Security Team](https://staticfiles.acronis.com/images/content/1578b8dff96325855c4525d865e7fc63.png)](https://www.acronis.com/en/blog/authors/acronis-security-team/ "MSP Threats Security Team") [MSP Threats Security Team](https://www.acronis.com/en/blog/authors/acronis-security-team/) 3 min read Last updated 28 November 2019 ![Image 3: Acronis Machine Learning](https://staticfiles.acronis.com/images/content/76c02055923a783466491aeb988fa2f4.png) Acronis Machine Learning [Acronis Active Protection](https://www.acronis.com/en-us/active-protection/) is an advanced technology that uses sophisticated analysis to monitor and stop erratic processes on your system. If [ransomware](https://www.acronis.com/en-us/ransomware-protection/) somehow manages to get through your anti-virus and starts to encrypt files, Acronis Active Protection will detect the encryption and immediately halt it – automatically restoring the files to the most recently backed up version. While performing well in [independent testing](https://www.acronis.com/en-us/blog/posts/nioguard-security-lab-are-you-protected-next-generation-ransomware-attacks) and earning accolades from the media, Acronis has worked diligently to make it even better. The result is an improved version that incorporates machine learning and artificial intelligence technologies. ## Why machine learning? Machine learning is often associated with big data, referring to the analysis of enormous volumes of data to produce some actionable results. The larger the data, the better the result as machine learning based on the amount of data and the algorithms chosen. So how does Acronis machine learning work? The first step is a stack trace analysis. A stack trace is a report of the active stack frames at a certain point in time during the execution of a program. When a program is run, memory is often dynamically allocated in two places: the stack and the heap. Memory is contiguously allocated on a stack, but not on a heap – as indicated by their names. Put simply, it is possible to detect code injections from ransomware using process stack trace analysis based on machine learning approach. ## Real-life scenario Acronis compiled massive volumes of data by taking clean Windows systems that run scores of legitimate processes. Then, we obtained millions of legitimate stack traces of these processes and, using decision tree learning, built different models of “good” behavior. We also took malicious stack traces from various sources to provide bad examples. Based on these millions of learning samples, patterns are developed. Using decision tree learning, we move from observations about an item to conclusions about the item's target value. The goal is to create a model that predicts the value of a target variable based on several input variables. Acronis experts use decision tree because we shouldn’t affect the performance of the client machine while collecting and sending the data and this algorithm allow us to achieve this goal. So when Machine Learning is activated in the actual product? As we already said, Acronis Active Protection is based on behavioral heuristics. In version 2.0 we added several new heuristics which are looking for legitimate processes. If Active Protection notices something strange is going on with a legitimate process, it takes a stack trace and sends it to our Machine Learning module, where the behavior is compared with existing models of clean and infected stack traces to determine if it’s a threat or not. If the behavior is confirmed to be malicious, the user gets an alert suggesting that he should block the ransomware-like process. As a result, Machine Learning also reduces any potential false positives as it acts like second authority for heuristics to make a final decision. _Example of Machine Learning-based detection of infamous ransomware family CTB-Locker._ ![Image 4: Acronis Machine Learning](https://staticfiles.acronis.com/images/content/1058653221366cd2ff30c0c0fc9e2af4.png) Acronis Machine Learning ## New level of anti-ransomware defense With Machine Learning leading the way, all of these technologies bring Acronis Active Protection to a whole new level, especially when it comes to zero-day threats. It creates a model of which processes are legitimate, so even if bad guys find a new vulnerability or way to infiltrate the system, Machine Learning will detect the ransomware’s processes and put a stop to them. Machine learning models can be used to analyze scripts, and we are already working in this direction. NioGuard Security Lab [performed a test](https://www.acronis.com/en-us/blog/posts/nioguard-security-lab-are-you-protected-next-generation-ransomware-attacks) that showed that most anti-virus solutions are unable to detect a script-based attack. Acronis Active Protection already performs much better compared to most other anti-malware solutions, but we are aiming to make our anti-ransomware technologies even better. **READ MORE:** * [Whitepaper: Acronis Machine Learning on guard of your data](https://www.acronis.com/en-au/resource-center/resource/277/) * [NioGuard Security Lab: Are You Protected From Next Generation Ransomware Attacks?](https://www.acronis.com/en-us/blog/posts/nioguard-security-lab-are-you-protected-next-generation-ransomware-attacks) * [What is Ransomware?](https://www.acronis.com/en-us/blog/posts/what-ransomware) * [Acronis True Image 2018: Artificial Intelligence Meets Intelligent Backup](https://www.acronis.com/en-us/blog/posts/acronis-true-image-2018-artificial-intelligence-meets-intelligent-backup) [Cybersecurity](https://www.acronis.com/en/blog/tags/cybersecurity/) [Cyber protection](https://www.acronis.com/en/blog/tags/cyber-protection/) ## Written by ![Image 5: MSP Threats Security Team](https://staticfiles.acronis.com/images/content/1578b8dff96325855c4525d865e7fc63.png) MSP Threats Security Team [Previous post](https://www.acronis.com/en/blog/posts/gdpr-primer-general-concepts/) [GDPR Primer — General Concepts](https://www.acronis.com/en/blog/posts/gdpr-primer-general-concepts/) [Next post](https://www.acronis.com/en/blog/posts/how-data-driving-formula-1-success/) [How Data is Driving Formula 1 Success](https://www.acronis.com/en/blog/posts/how-data-driving-formula-1-success/) About Acronis Acronis is a leader in AI-native cyber protection, unifying data protection, cybersecurity, IT operations and hybrid infrastructure to deliver business continuity, security and compliance with less cost and complexity. More than 21,000 service providers trust Acronis to protect over 750,000 businesses in 150 countries. Acronis is headquartered in Schaffhausen, Switzerland. [Add as a preferred source on Google](https://google.com/preferences/source?q=acronis.com) ## Related stories Want to learn more? Read the latest stories featuring this solution on our blog. [Acronis Blog](https://www.acronis.com/en/blog/) ![Image 6: stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://staticfiles.acronis.com/images/blog-card/9600f3eea83b8f4e168ea6c1409c8c26.png) [stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://www.acronis.com/en/blog/posts/stc-bahrain-and-acronis-partner-to-bring-endpoint-security-to-businesses/) We are proud to announce a strategic partnership with stc Bahrain, expanding access to advanced cybersecurity services for businesses across Bahrain. **October 26, 2026**3 min read ![Image 7: Introducing New Acronis CEO: Prakash Panjwani](https://staticfiles.acronis.com/images/blog-card/30cb571f6f1aaa131733e5727a4a250c.png) [Introducing New Acronis CEO: Prakash Panjwani](https://www.acronis.com/en/blog/posts/introducing-new-acronis-ceo-prakash-panjwani/) We are pleased to announce the appointment of our new Chief Executive Officer, Prakash Panjwani. A veteran cybersecurity CEO, Panjwani previously served as CEO of WatchGuard Technologies and SafeNet. **October 15, 2026**2 min read ![Image 8: Acronis expands MDR toward broader workspace protection](https://staticfiles.acronis.com/images/blog-card/18e90e89f5ec4ef0901f19008d4ccbf2.png) [Acronis expands MDR toward broader workspace protection](https://www.acronis.com/en/blog/posts/acronis-expands-mdr-toward-broader-workspace-protection/) Acronis is expanding the MDR service with capabilities that make this expertise easier to deliver and help partners address more risks. The developments build on a broader commitment to managed security: helping service providers protect the connected workspace while giving customers access to the expertise needed to investigate threats, respond effectively and maintain business continuity. **October 13, 2026**6 min read