Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Detection of ransomware attacks using federated learning based on the CNN model

Hong-Nhung Nguyen, Ha-Thanh Nguyen, Damien Lescos

TL;DR

This work tackles ransomware detection in cyber-physical systems by proposing a privacy-preserving, image-based CNN classifier trained via federated learning. It converts PE binaries into 300x300 grayscale images and uses a compact CNN architecture to distinguish normal from ransomware data, while federated training across multiple clients preserves data privacy. Experiments show high performance, with a CNN baseline achieving near-perfect training/validation accuracy and federated training yielding strong class-wise metrics under realistic privacy constraints. The approach offers a scalable framework for distributed ransomware detection in smart-grid contexts, balancing detection effectiveness with data privacy.

Abstract

Computing is still under a significant threat from ransomware, which necessitates prompt action to prevent it. Ransomware attacks can have a negative impact on how smart grids, particularly digital substations. In addition to examining a ransomware detection method using artificial intelligence (AI), this paper offers a ransomware attack modeling technique that targets the disrupted operation of a digital substation. The first, binary data is transformed into image data and fed into the convolution neural network model using federated learning. The experimental findings demonstrate that the suggested technique detects ransomware with a high accuracy rate.

Detection of ransomware attacks using federated learning based on the CNN model

TL;DR

This work tackles ransomware detection in cyber-physical systems by proposing a privacy-preserving, image-based CNN classifier trained via federated learning. It converts PE binaries into 300x300 grayscale images and uses a compact CNN architecture to distinguish normal from ransomware data, while federated training across multiple clients preserves data privacy. Experiments show high performance, with a CNN baseline achieving near-perfect training/validation accuracy and federated training yielding strong class-wise metrics under realistic privacy constraints. The approach offers a scalable framework for distributed ransomware detection in smart-grid contexts, balancing detection effectiveness with data privacy.

Abstract

Computing is still under a significant threat from ransomware, which necessitates prompt action to prevent it. Ransomware attacks can have a negative impact on how smart grids, particularly digital substations. In addition to examining a ransomware detection method using artificial intelligence (AI), this paper offers a ransomware attack modeling technique that targets the disrupted operation of a digital substation. The first, binary data is transformed into image data and fed into the convolution neural network model using federated learning. The experimental findings demonstrate that the suggested technique detects ransomware with a high accuracy rate.
Paper Structure (15 sections, 3 equations, 7 figures, 4 tables)

This paper contains 15 sections, 3 equations, 7 figures, 4 tables.

Table of Contents

  1. Introduction
  2. Background
  3. Machine Learning for Cyber Security
  4. Deep Learning
  5. Proposed Method
  6. Input for the CNN model
  7. Data collection
  8. Transforming binaries into images
  9. Proposed CNN model for classification
  10. Federated Learning using CNN model
  11. Experiments
  12. Results with CNN model
  13. CNN model using Federated Learning
  14. Discussions
  15. Conclusions

Figures (7)

  • Figure 1: Machine learning: a new programming paradigm
  • Figure 2: Federated Learning
  • Figure 3: Structure of CNN model
  • Figure 4: Data Processing
  • Figure 5: Benign binary data (a); Unusual binary (b)
  • ...and 2 more figures