The white paper explains how Acronis Active Protection uses machine‑learning stack‑trace analysis to detect and block ransomware threats.
This white paper describes the machine‑learning approach behind Acronis Active Protection. It details how millions of clean and malicious process stack traces are collected, how decision‑tree and random‑forest models are trained, and how the resulting model (15 MB, compressed to 1 MB) is used to evaluate process behavior in real time.
The document also outlines the infrastructure that continuously uploads anonymized data for analysis, the high detection accuracy (99.95 %) and fast response time (1‑2 ms), and how the system can block ransomware before it executes, even for zero‑day threats. This manual is written in Chinese.
| Model size | 15 MB (compressed 1 MB) |
|---|---|
| Detection accuracy | 99.95 % |
| Detection latency | 1‑2 ms |
| Training data volume | over 100 million events |
| Number of trees in ensemble | 100 |
It uses machine‑learning‑based stack‑trace analysis to compare process behavior against models of clean and malicious executions.
The average detection accuracy reaches 99.95 %.
The detection and decision process takes about 1‑2 milliseconds.