Intelligent and Dynamic Ransomware Spread Detection and Mitigation in Integrated Clinical Environments

Area of Science:

• Cybersecurity in Healthcare
• Medical Device Security
• Machine Learning Applications

Background:

• Medical Cyber-Physical Systems (MCPS) offer advanced patient monitoring, diagnosis, and treatment within Integrated Clinical Environments (ICE).
• Existing MCPS and ICE devices often lack robust cybersecurity, leaving them vulnerable to ransomware and data breaches, which are prevalent in healthcare.

Purpose of the Study:

• To develop and evaluate an automatic, intelligent, real-time system for detecting, classifying, and mitigating ransomware attacks specifically targeting ICE.
• To enhance the security of medical devices within integrated clinical environments against prevalent cyber threats.

Main Methods:

• Implementation of a system integrated with the ICE++ architecture, utilizing Machine Learning (ML) for ransomware detection and classification during the spreading phase.
• Leveraging Network Function Virtualization (NFV) and Software Defined Networking (SDN) paradigms to mitigate ransomware spread by isolating and replacing compromised devices.
• Creation and public release of labeled ransomware datasets specific to ICE.

Main Results:

• Achieved 92.32% precision and 99.97% recall in anomaly detection.
• Demonstrated 99.99% accuracy in ransomware classification.
• Showcased promising real-time detection and mitigation capabilities for ransomware attacks in ICE.

Conclusions:

• The proposed system effectively detects, classifies, and mitigates ransomware in ICE, significantly improving cybersecurity for medical devices.
• The integration of ML, NFV, and SDN provides a robust defense mechanism against ransomware, safeguarding sensitive patient data and healthcare continuity.
• Publicly available datasets will aid future research in securing medical cyber-physical systems.