Cloud based Human Resource (HR) systems are now part of most modern companies [1]. These systems include tools for hiring, employee records, payroll, and internal communication [2]. They often work through Software as a Service (SaaS) models hosted on shared cloud platforms [3]. This structure offers fast access, cost control, and simple updates, making them a good fit for large and small firms [4]. However, the same cloud structure creates more ways for attackers to get in [5]. Since these systems use containers and shared services, an attack on one part can affect many others. Among all threats, ransomware has become the most dangerous. It spreads fast, locks access, and often steals private records [6]. These attacks can stop daily work, delay payments, and put user data at risk. Despite growing risks, many HR systems still depend on static defense tools. Ransomware has become more advanced and harder to block [7]. Early ransomware only locked files, but now it also steals information and threatens to release it [8]. These attacks stay hidden before they activate and often spread through shared containers. In HR systems, one infected service can impact hiring, payroll, or leave management. Because many HR tasks run on microservices, they rely on smooth internal connections [9]. Once those links break, user actions fail. Detection systems are often too slow or based on known patterns. By the time a threat is found, damage has started. Backup tools help with recovery, but they do not stop spread or protect live sessions. This gap creates risk for both the company and its users. HR systems need real-time protection that works with their service model [10]. The idea of changing the system layout during use has gained interest [11]. Moving Target Defense (MTD) is one such model. It works by shifting or hiding parts of the system to confuse attacks [12]. This includes Internet Protocol (IP) changes, route updates, and container mutations. It reduces the attack surface by changing targets before they are hit. Some works have tested this in general cloud systems. These early tests show promise, but few focus on HR use cases. In HR tools, tasks must not break while security tools run [13]. There are user sessions, state data, and linked workflows. These must stay active, even if some containers rotate or change. A good defense model should work quietly and fit these limits. This balance between live use and safety is the main reason for studying MTD in HR cloud systems. Prior approaches to ransomware defense in cloud or IoT domains have shown promising accuracy and containment times, but they are not sufficient for HR-specific environments. Static defenses such as firewalls or backup strategies do not prevent ransomware spread during live sessions, while signature-based systems lag against new variants. Even existing MTD models often ignore session continuity, multi-tenant namespace isolation, and compliance constraints such as General Data Protection Regulation (GDPR) and System and Organization Control (SOC 2). In HR SaaS, interruptions during payroll or hiring processes can directly disrupt operations and harm business outcomes. These limitations highlight why generic defenses are inadequate and establish the novelty of our MTD-HR framework, which introduces compliance-aware and runtime-safe adaptations tailored to HR workflows.

The problem is to design a ransomware defense method that works inside HR cloud systems during live usage [14]. The model must block ransomware from moving across linked containers. It must reduce attack paths without causing user errors. It must also detect ransomware before full encryption begins. HR systems cannot stop for updates or long scans [15]. They need fast tools that can run in the background. The method must avoid false alarms and keep service quality steady. It must work without knowing which ransomware will strike [16]. Many HR platforms are multi-tenant, so the system must scale without manual steps. The problem is not just about stopping one threat. It is about building a structure that limits attack success in any case [17]. Some methods try to solve this using detection systems. These use access logs, file changes, and network patterns to spot attacks [18]. A few apply machine learning models that study user behavior. These tools are good at flagging known threats. But they often act too late. In many cases, the system is already damaged when the alarm goes off [19]. Others depend on strong backups or quick restores. These help with recovery, but not with defense. They do not stop the ransomware from spreading [20]. Other methods use static hardening like firewall rules or image scans. These can block weak attacks, but they do not work against modern ransomware. These methods treat defense as a one-time setup. They do not change with the system or the attack [21].

A few research works have tested MTD in cloud systems [22]. They use IP hopping, service migration, and random routing. These methods help lower the risk but often ignore live workflows [23]. In HR systems, even a short delay in session tracking can cause job loss or payroll failure. Many current MTD models do not support multi-tenant use. They are also not tested on real ransomware attacks [24]. HR systems need targeted protection that works during normal use. They need security tools that rotate or shift without breaking user paths. These systems also need to meet privacy rules like GDPR and SOC 2. Most existing MTD tools do not check for compliance under live usage. This limits their value in real HR setups [25].

The method used in this work adds MTD to real HR cloud systems. It includes three layers of action: container mutation, IP hopping, and runtime service rotation. These tools run in a Kubernetes setup and shift attack surfaces without breaking service. They also track behavior to detect spread early. Ransomware samples such as WannaCry, Locky, and Ryuk are used in testing. The system lowers spread time and improves detection rates. It also keeps service loss and false alarms low. This method works without stopping the system or needing new software. It fits with zero-trust goals and helps meet privacy rules. This makes it useful for HR vendors who want stronger security without new problems.

The aim of this research study is to develop a dynamic MTD framework for cloud based HR systems that reduces ransomware impact by blocking lateral spread, increasing detection speed, and maintaining service continuity during active attacks.

How can MTD be applied to cloud-based HR systems without interrupting essential services such as hiring, payroll, and employee management?

This research offers practical value for cloud-based HR systems that manage personal and organizational data. These systems control processes such as hiring, payroll, leave, and staff evaluation. Any disruption in these areas can affect daily operations and harm business goals. Ransomware attacks that block access or steal data can stop key HR tasks. The method introduced here adds a defense layer that works during live system use. It helps stop attacks without needing full system updates or human input. This makes it easier to adopt for real business use. It is designed to support privacy and uptime requirements at the same time. The model uses features like container mutation and IP rotation to confuse ransomware behavior. These steps reduce harm without creating new problems for users or admins.

The study also helps fill a known gap in how ransomware is handled in HR cloud systems. Most tools only work after the attack starts or when damage is already done. Few methods are made for runtime defense that works without delay. This model changes that by using a set of live actions that block and isolate attacks early. It does not stop the system or drop user tasks. It is tested on real datasets and with known ransomware types to show that it works. These tests match real HR system traffic and service use. This makes the results more useful for future tools. The model also supports privacy rules and keeps service smooth. It can help vendors who want to add safety without slowing down work. Its design is flexible and can be adjusted for different cloud platforms.

The remainder of this paper is structured as follows. Section 2 reviews existing approaches to ransomware defense and outlines key limitations in current MTD-based systems. Section 3 describes the proposed MTD-HR framework, including its modular components and deployment design. Section 4 details the experimental setup, datasets, and simulation parameters. Section 5 presents the evaluation results, ablation analysis, and performance comparisons. Finally, Section 6 concludes with a summary of findings and possible future improvements.

The integration ofMTD-HR techniques into cybersecurity frameworks has gained momentum as a proactive strategy against ransomware threats, particularly in dynamic and distributed environments. Multiple studies have introduced diverse MTD models targeting containerized infrastructures, microservices, and hybrid cloud systems. Shinde et al. [26] achieved 96.1% accuracy using IP hopping combined with behavioral analysis, while Ge et al. [27] applied syscall-level detection in Linux containers, reporting 93.2% accuracy. Wang et al. [28] extended this by using multi-view machine learning for ransomware detection, achieving 94.6% accuracy and a 3.8% False Positive Rate (FPR). In parallel, time-based containment strategies have been explored; Lee and Park [29] used resource hopping in simulated microservice environments and achieved a 109-s Mean Time To Containment (MTTC), while Singh et al. [30] implemented multi agent MTD logic with a blocking rate of 87% and 148-s MTTC. Punitha and Preetha [31] incorporated ML-driven MTD in a ransomware-specific context using CIC Ransomware 2020 data, reducing encryption success to 22.7%. While these approaches show strong detection or containment metrics, few are tailored for domain-specific, real-time service environments like HR SaaS, and most lack integration with compliance-aware mutation policies necessary for maintaining regulatory adherence under live attack conditions. A structured comparison of representative MTD and ransomware-defense studies, including datasets, methods, limitations, and outcomes is given in Table 1.

Shinde et al. [26] developed an MTD-based system using IP hopping and behavioral analysis, tested on CTU-13 and NSL-KDD datasets. Their model improved detection accuracy to 96.1% with a 3.2% FPR but lacked HR-specific adaptation. Lee et al. [33] introduced a visualization platform in a Kubernetes environment to control MTD service mappings. Though ransomware testing was not included, the simulated results enabled clear architectural defense planning. Xu et al. [34] introduced an MTD approach for randomizing Kubernetes configurations using a custom-built testbed. The results showed a 38% reduction in MTTC, but the method was constrained by its computational demand. Ge et al. [27] developed a syscall-based container monitoring system using the UNSW-NB15 dataset, achieving a detection accuracy of 93.2%. The method operated in real time but was dependent on Linux containers and lacked compatibility with non-Unix systems.

Hyder et al. [35] implemented IP and port shuffling in a microservice environment using CIC-IDS 2018 logs. Their model reduced MTTC to 122 s while maintaining a 4.1% FPR, though static timing affected consistency. Ravichandran et al. [36] used a hybrid cloud setup with real ransomware samples including WannaCry and Locky. Their approach monitored propagation behavior and achieved high attack detection, though the study involved only limited ransomware variants.

Abdullayeva [37] applied zero-trust access controls to simulated HR SaaS logs. The model improved RBAC enforcement but did not involve MTD mechanisms or ransomware resilience metrics. Punitha and Preetha [31] combined machine learning with MTD mutation using the CIC Ransomware 2020 dataset. Their framework reduced ransomware success from 91.6% to 22.7%, but high training time limited rapid deployment. Sharma [38] applied a Time-To-Compromise scoring mechanism on the UNSW-NB15 dataset to quantify the resilience introduced by MTD. The model improved TTC by 40% but lacked validation in containerized workloads. Masud et al. [39] examined anomaly-based ML detection in multi-cloud logs and achieved 89.4% accuracy. Their model handled diverse traffic but lacked ransomware-specific training samples, reducing specificity. Singh et al. [30] proposed a multi-agent MTD mechanism using CICIDS2017 and synthetic data, reaching 87% ransomware blocking and a containment time of 148 s. The architecture lacked full system integration due to its agent-only design.

Sun and Jung [40] addressed MTD for edge-cloud systems using simulation logs. Their decentralized framework enhanced resilience by 22.3% but lacked scalability validation for enterprise settings. Lee and Park [29] presented a resource hopping model for microservice resilience in a simulated cloud. They achieved 92.5% accuracy and 109-s MTTC, though their results were impacted under high load conditions. Escaleira et al. [41] used blockchain logs to describe HR data access auditing. Their method improved audit trail integrity but did not include MTD integration or threat response capabilities. Santos et al. [42] designed a scoring-based evaluation model to measure the effectiveness of different MTD methods using simulated datasets. Though qualitative in nature, the work contributed insights into defense layer prioritization for cloud systems. Wang et al. [28] introduced a multi-view ML architecture using UNSW-NB15 for ransomware detection. The model reached 94.6% accuracy with 3.8% false positives, though it required large-scale data to maintain robustness. Abutu et al. [32] implemented an Azure-native defense system based on MTD techniques. Their real-world deployment reduced average response time by 36.5%, but the model was tied to Azure infrastructure. Bose et al. [43] applied VM-level isolation via MTD agents in a custom log environment. Their system reduced ransomware spread by 58.7% and achieved containment within 118 s, though HR-specific scenarios were not tested.

This section defines a formal methodology to implement a MTD-HR system for cloud-based HR infrastructures vulnerable to ransomware threats. The system operates over Kubernetes-based microservice deployments hosting Applicant Tracking Systems (ATS) and Candidate Relationship Management (CRM) modules. The framework is composed of configuration mutation, network surface randomization, dynamic monitoring, and container reassignment.

The methodology implements a dynamic MTD-HR framework within a Kubernetes-based cloud HR environment. The architecture integrates key layers including ingress control, microservice routing, and authentication, followed by core HR modules such as payroll and leave management. These modules run as containerized services that are subject to real-time mutation using three MTD strategies: IP hopping, container image transformation, and node reassignment. A statistical anomaly detection module triggers these defenses based on KL divergence between observed and baseline traffic distributions. Upon activation, services are reconfigured without disrupting user access. The defense logic is aligned with GDPR and SOC 2 compliance constraints to maintain policy adherence during runtime adaptation. Fig. 1 depicts the layered architecture of the proposed MTD-HR framework, designed for cloud-based HR environments. At the top, user access is facilitated by HR personnel and external candidates interacting with microservices through an ingress controller and service router. Authentication services and core HR modules like payroll and leave management operate within isolated containers managed by Kubernetes. The MTD system actively applies IP hopping, container mutation, and node reassignment to prevent ransomware from spreading. Real-time anomaly detection, power KL divergence, triggers reconfiguration actions, while a compliance monitor confirm s adherence to data protection standards such as GDPR and SOC 2.

The experimental setup was deployed on a simulated HR cloud environment configured using a three-node Kubernetes cluster running on Ubuntu 22.04. Each node was provisioned with 4 virtual CPUs, 8 GB RAM, and Docker engine with Calico CNI for network policy enforcement. The microservices emulated HR functions such as employee onboarding, candidate tracking, and payroll access, distributed across namespaces and exposed via ingress rules. The system clock was synchronized using Network Time Protocol (NTP) to support time-sensitive mutation scheduling. The controller operates per service and per namespace, and its actions are independent of cluster size; the scalability notes appear in Section 3.

To model realistic HR traffic, we used the Employee Dataset from Kaggle [44] to seed user identities, roles, and departments. We then generated access events that mirror HR tasks such as record lookup, file upload, and form submission. Malicious sequences were shaped by event templates derived from CIC Ransomware 2020. We copied no packet fields from public sets into HR logs. Instead, we matched high-level statistics such as inter-arrival time, burst size, and session length. To guide benign traffic shape, we referenced summary statistics from UNSW-NB15 and CTU-13 at the aggregate level. This approach gives HR-domain events while keeping timing and burst patterns close to public traces. We used public datasets only to shape timing and attack staging. CIC Ransomware 2020 informed the order of actions, discovery, staging, encryption, while UNSW-NB15 and CTU-13 supplied aggregate timing and burst statistics. Network-style fields were mapped to HR events as follows: arrival rate → user action rate per service; flow size → payload class (document size bucket); service port → HR endpoint class (e.g., payroll or records); destination IP → pod or node identifier; label → benign or ransomware stage. To preserve realism and prevent leakage, we stratified by role and module, split folds by user ID and day, and matched marginals for arrival time and burst size with Kolmogorov-Smirnov tests at α=0.05. All tuning was done on training folds. Detection thresholds did not use HR-specific tokens. CIC Ransomware 2020 provided attack templates and timing only; the detector was not trained on that dataset. The results in Section 5 come from HR-domain logs produced under these controls. The evaluation uses synthetic HR logs shaped by public statistics; production traces were not available. Table 2 maps public network features to equivalent HR event fields, preserving behavioral structure while maintaining domain relevance. Similar mapping logic was described by Ge et al. [27].

Attack scenarios were crafted to simulate ransomware infiltration, lateral movement, and data encryption phases. The injection patterns were based on behavioral signatures derived from CIC Ransomware 2020 and included variants of WannaCry and Locky targeting shared storage and service metadata APIs. No alerts were hardcoded; all mutations were initiated only when the KL divergence-based detection signal exceeded a threshold as formalized in Eq. (8). The mutations included reassigning nodes, IP rotation, and real-time container morphing.

The MTD policy engine orchestrated five core actions upon anomaly: IP hopping (Eq. (3)), service reassignment (Eq. (11)), attack surface shrinkage (Eq. (1)), mutation application (Eq. (4)), and compliance update checks (Eq. (12)). These actions operated concurrently using multi-threaded Go routines to avoid disruption in user-facing applications. All changes were audit-logged, and the deployment state was captured before and after every mutation window.

The experiment used a static baseline configuration for comparison. Metrics were computed across multiple sessions with varying user load and attack intervals. Key metrics include MTTC (Eq. (9)), mutation cost (Eq. (5)), encrypted byte ratio (Eq. (10)), and overall compliance penalty. Each session lasted 30 min and was repeated 100 times for statistical averaging. All results were benchmarked to validate the MTD-enhanced resilience and quantify trade-offs under real-time HR traffic conditions. The anomaly detection dataset consisted of both benign and ransomware-labeled log entries. Each experimental run included approximately 85% benign interactions and 15% ransomware behaviors, reflecting real-world HR system traffic skew. This class imbalance was maintained across all modules to simulate realistic detection conditions and complete model precision under minority attack prevalence.

To quantify the runtime overhead introduced by MTD, resource usage was monitored throughout each mutation cycle. Metrics such as average CPU load, memory footprint, and mutation latency per container were collected using Kubernetes-native telemetry (cAdvisor) and Prometheus exporters. These metrics were sampled at one-second intervals across the three-node cluster and logged for post-run analysis.

Each experimental configuration was repeated 100 times under randomized user behavior and threat injections. For each metric (Accuracy, MTTC, Encryption Success Rate), we report the mean and standard deviation. In addition, 95% confidence intervals were calculated to assess the statistical reliability of the results. Where applicable, paired t-tests were conducted between the proposed framework and baseline models to verify performance differences.

This section presents the experimental findings from the deployment of our proposed MTD-HR framework on simulated HR SaaS access logs. The main metrics classified include Accuracy, FPR, MTTC, and Ransomware Encryption Success Ratio. Each experiment was repeated three times and averaged to confirm robustness. The proposed system achieved superior results compared to prior literature, demonstrating improved containment and reduced encryption effectiveness under active ransomware propagation. To assess the statistical validity of the observed improvements, paired t-tests were conducted between the MTD-HR system and selected baseline models, including those by Punitha and Preetha [31] and Lee and Park [29]. The tests were applied to both the ransomware encryption rate and MTTC across 100 experimental runs. Results showed statistically complete differences (p < 0.01) in favor of the proposed framework, confirming that the observed gains in containment speed and reduction in encryption success are not due to random variation. These findings support the reliability and robustness of the MTD-HR architecture under varied threat scenarios.

Table 3 presents the detection performance of the proposed MTC framework across five functional modules in a cloud-based HR environment. For each module, results are reported as mean ± standard deviation based on 100 independent simulation runs. The metrics include classification accuracy, FPR, MTTC, and encryption success rate. The Exit module yielded the highest accuracy (97.1%) and the lowest encryption success (11.7%), indicating its strong containment capability. In contrast, the Payroll and Onboarding modules exhibited nearly higher encryption rates despite maintaining high detection accuracy. The low standard deviation across all metrics confirms the stability and consistency of the system under varying traffic and threat conditions. The average MTTC of 91.4 s shows that containment actions are triggered quickly across modules, and the overall encryption rate remains below 13.2%, reflecting the effectiveness of real-time defense mechanisms. These findings validate the robustness and uniform performance of the MTD-HR framework in securing multi-tenant HR microservices during ransomware attacks.

In addition to accuracy and containment performance, we monitored the resource impact of dynamic reconfiguration as provided in Table 4. During high-traffic simulations, CPU utilization increased by an average of 7.6% and memory overhead remained below 6.1% across mutation cycles. This overhead is moderate and did not interrupt HR SaaS workflows, though the cost rises with larger cluster sizes or denser microservice graphs. These findings highlight the trade-off between resilience and resource consumption: while MTD actions reduce attack success rates, they temporarily increase system load. For production deployments, the mutation frequency and reassignment policy may be tuned to balance security gains with operational efficiency. This observation confirms the practicality of the proposed approach in live HR environments where both reliability and compliance are critical.

Fig. 2 presents the ROC curves for the five core functional modules of the HR system, measured during active ransomware attacks simulated using CIC Ransomware 2020 behavioral profiles. The modules checkd include Onboarding, Employee Records, Leave Management, Payroll, and Exit. Each curve plots the trade-off between true positive rate and FPR, providing a visual assessment of detection performance. The resulting AUC values range from 0.94 to 0.98, reflecting high discrimination ability of the KL-divergence-based anomaly detector integrated within the MTD mechanism. These results support the model’s consistent accuracy across different microservices, reinforcing the robustness of the defense architecture under live cloud workloads and multi-tenant configurations, as discussed in Section 6 of the paper.

Fig. 3 presents a comparative evaluation of ransomware encryption success rates across selected defense mechanisms. The proposed MTD for HR systems achieves the lowest encryption rate at 13.2%, outperforming the ML-integrated MTD framework by Punitha and Preetha [31], which reports a 22.7% encryption success rate. It also surpasses agent-based containment models developed by Singh et al. [30] and the resource-hopping model introduced by Lee and Park [29], which report higher rates of 35.0% and 25.6%, respectively. The reduced encryption ratio confirms that the integrated use of container mutation, IP hopping, and node reassignment in the proposed method effectively limits ransomware propagation and execution within Kubernetes-based HR microservices. These findings support the resilience and containment capabilities of the MTD-HR system in preserving sensitive data during active threats, as discussed.

Table 4 summarizes the average and peak resource overhead measured during active mutation events. The CPU and memory usage remained within acceptable bounds, with no observable impact on core HR service availability. The average container mutation delay was 114 ms, confirming the feasibility of real-time adaptation. Node reassignment incurred nearly higher latency due to internal rebalancing, but still operated within sub-second thresholds. These results validate the framework’s ability to deliver responsive defense without compromising system throughput or violating service-level agreements.

To examine peak-demand conditions, we replayed the HR log stream with a high-concurrency multiplier to mimic payroll close and onboarding surges. During mutation windows, resource use and delays stayed within the bounds reported in Table 5. CPU and memory stayed below the peak values in the table, and node reassignment was the largest contributor to delay, yet within sub-second limits. No request timeouts or pod restarts were observed. These results indicate that the mutation budget remains compatible with short, intense bursts common in HR workloads.

Fig. 4 illustrates the proportional contribution of each MTD operation to the overall system overhead. The left chart represents mean values, while the right chart captures peak usage observed during active mutation cycles. Memory usage and container mutation latency contribute most to mean overhead, followed by node reassignment. In the peak scenario, memory and node reassignment latency dominate the resource profile. These charts provide a visual confirmation that, despite dynamic reconfiguration, the overhead remains distributed and manageable without bottlenecking a specific service component. In order to quantify the trade-offs more clearly, Table 5 reports the average CPU and memory overhead observed across different mutation intervals. As expected, shorter mutation windows increase load due to more frequent container reconfiguration and IP reassignment, whereas longer intervals reduce overhead but risk leaving services exposed for longer periods. A balanced configuration of 60 s produced the most favorable trade-off in our HR SaaS testbed, combining improved containment with manageable resource usage.

A comparative summary of performance metrics across selected MTD based ransomware defense systems is presented in Table 6. Unlike most prior studies, which primarily report only accuracy, the proposed MTD-HR model includes additional indicators such as precision, recall, F1-score, and root mean square error (RMSE). This broader metric coverage enables more nuanced evaluation of detection reliability and classification quality. As shown in Several recent studies, including those by Shinde et al. [26], Wang et al. [28], and Ge et al. [27], achieved strong accuracy in detecting ransomware threats, yet lacked comprehensive statistical reporting. Metrics such as mean squared error (MSE), root mean square error, and explainable AI (XAI) integration were largely absent across these works. In contrast, the proposed MTD-HR model demonstrates competitive accuracy (96.9%) alongside high F1-score (95.6%) and low RMSE (0.151), indicating robust detection capability and minimal classification error. Moreover, while existing models focus mainly on accuracy, the inclusion of precision, recall, and planned XAI support in the proposed method enhances its practical applicability and auditability. This broader metric reporting helps address critical gaps in current comparative evaluation practices.

Fig. 5 provides a visual overview of detection accuracy per module, highlighting consistent performance across the pipeline.

To visualize the classification quality of the proposed anomaly detection model, a normalized confusion matrix was constructed based on aggregate predictions across all HR modules. As shown in Fig. 6, the model maintains a high true positive rate for ransomware detection while minimizing false positives and false negatives. The diagonal dominance in the matrix indicates strong agreement between predicted and actual labels. Notably, ransomware events are detected with minimal misclassification, which is critical in high-impact modules such as Payroll and Exit. The low false positive counts further validate the system’s suitability for live deployment, where alert fatigue must be avoided. This visual confirms the effectiveness of the KL-divergence-based detection logic under realistic multi-tenant traffic conditions, reinforcing the statistical metrics previously reported.

To assess the per-module consistency of the proposed framework, a heatmap was generated using precision and recall values from each of the five HR service components. The results indicate that all modules performed above 93% on both metrics, demonstrating balanced detection capabilities across varied workloads. The Exit and Employee Records modules showed the highest scores, suggesting stronger separation between benign and malicious behavior in those workflows. In contrast, the Onboarding and Leave Management modules showed nearly lower precision, possibly due to overlapping access patterns and greater traffic diversity. Despite this, overall detection performance remained robust and stable across the microservice pipeline. This analysis further confirms the generalizability of the model across HR domains and supports the quantitative findings reported earlier (Fig. 7).

To examine the role of individual MTD components, we conducted an ablation study. Table 7 reports the results of systematically disabling one component at a time. Removing container mutation caused the encryption rate to rise to 29.8%, while disabling IP hopping and node reassignment also reduced performance.

Fig. 8 presents a dual-axis visualization to highlight the effect of disabling individual MTD components on both containment time and ransomware encryption rate. The blue bars represent MTTC in seconds, while the green line plots the corresponding encryption success rate as a percentage. The full system configuration shows the lowest MTTC (92s) and encryption rate (13.2%), confirming the efficiency of all modules when activated together. Removal of container mutation results in the highest encryption success (29.8%) and increased containment delay (123s), indicating its critical role in active defense. Similarly, omitting IP hopping and node reassignment also degrades system performance, with encryption rates rising above 23% and MTTC extending beyond 110 s. This combined visualization reinforces the necessity of architectural synergy among all MTD components to minimize propagation and accelerate isolation under active ransomware scenarios.

The Receiver Operating Characteristic (ROC) curves illustrate ransomware detection performance across five HR functional modules, with AUC values ranging from 0.94 to 0.98. As shown in Table 8, the exit module achieved the highest AUC (0.98), followed by Payroll (0.97), Employee Records (0.96), Onboarding (0.95), and Leave Management (0.94). These results indicate that the anomaly detection engine integrated within the MTD framework maintains strong classification performance across varied workloads. Higher AUC scores reflect clear separability between benign and malicious activity, minimizing false positives while preserving detection accuracy. Slight variation across modules is linked to differences in workflow regularity and access patterns. Overall, the close range of high AUC values confirms the system’s consistent and reliable behavior under active threat conditions, as demonstrated [26].

Although the current deployment does not include visual explanations, the KL divergence values used for anomaly detection are fully auditable and can be post-processed using SHAP to highlight the most influential traffic features. For instance, spikes in access frequency or unusual endpoints could be identified as dominant triggers. Future work will incorporate this layer into a real-time explanation interface to improve interpretability and support forensic analysis in compliance-focused HR environments.

While ROC curves provide a general view of detection trade-offs, they can be misleading under class imbalance. To address this, we also computed Precision-Recall (PR) curves for each HR module. These curves better highlight performance on the minority (ransomware) class. Across all modules, the proposed model achieved high area under the PR curve (AUPRC), with Exit and Payroll modules reaching 0.91 and 0.89, respectively. This indicates reliable precision and minimal false alerts even under rare attack conditions. Table 9 compares detection accuracy among selected MTD-based ransomware defense methods. The proposed MTD-HR framework achieves the highest accuracy, surpassing prior models reported by Shinde et al. [26] and Wang et al. [28].

Fig. 9 presents a comparative analysis of detection accuracy across selected MTD-based ransomware defense methods. Shinde et al. [26] reported the highest accuracy at 96.1%, followed by the proposed MTD-HR framework with 96.9%. Other approaches such as those by Wang et al. [28], Ge et al. [27], and Lee and Park [29] reported 94.6%, 93.2%, and 92.5%, respectively. The lowest accuracy was observed in Masud et al. [39], with 89.4%. These results highlight the competitiveness of MTD-HR in terms of accurate detection under simulated HR microservice workloads. The close performance with top-tier methods affirms its utility for real-time ransomware containment.

Fig. 10 provides a holistic visualization of the MTD-HR system’s effectiveness across both detection accuracy and operational containment. All values are normalized, with lower-is-better metrics (MTTC and encryption rate) inverted for scale alignment. The balanced shape and strong spread across all axes confirm that the model not only maintains high predictive quality (AUC and F1) but also performs efficiently under real-time constraints. This figure complements earlier tabular results by highlighting the framework’s overall performance stability across multiple security and runtime dimensions.

The research study introduced a dynamic MTD framework designed for ransomware detection and containment within HR-focused SaaS environments. The architecture integrated container mutation, IP hopping, and node reassignment to disrupt attack patterns in real time. Module-specific results across onboarding, records, leave, payroll, and exit services showed consistent detection accuracy. The average AUC exceeded 0.94, with the Exit module reaching 0.98. The system achieved 96.9% accuracy and lowered encryption success to 13.2%. Compared with previous defense strategies, this approach showed improved containment with fewer false positives. The ablation study confirmed that removing any component led to increased MTTC and encryption rates, highlighting the role of each mechanism in maintaining performance across distributed services. We will release the log generator and configuration files to support reuse and external checks.

The architecture supported modular deployment and worked with varied workflows without redesign. Its design aligned with containerized infrastructures and supported anomaly-based detection without fixed signature dependencies. Beyond experimental validation, the applicability of the framework to live HR SaaS deployments is notable. Practical integration requires careful management of mutation intervals, overhead monitoring, and rollback policies to prevent disruptions during payroll or recruitment operations. Our experiments indicated moderate resource costs, yet at cloud scale adaptive tuning of CPU and memory thresholds will be critical. Operationalization also involves ensuring multi-tenant scalability and strict compliance with GDPR and SOC 2, which our design locally addresses through compliance-aware scheduling. These considerations demonstrate that MTD-HR can be transitioned to production settings with practical configuration adjustments, making it suitable for enterprise adoption in HR systems that demand both resilience and regulatory assurance.

Future extensions will explore deployment in live Kubernetes clusters, integration with real-time traffic, and the use of explainable models for auditability. Long-term monitoring and user behavior modeling may help refine the defense logic under changing workloads. Overall, the system addressed current security challenges in HR systems and contributed to practical defenses for ransomware threats across cloud-based enterprise microservices. The lack of complete metrics in existing work limits fair benchmarking, so future studies should adopt a standardized evaluation suite with full classification and error metrics for MTD-based ransomware defense. Further improvements will focus on integrating SHAP-based explainability tools to generate real-time interpretations of detection decisions, aiding transparency and compliance with HR audit requirements.