An Intelligent Sensing Framework for Early Ransomware Detection Using MHSA-LSTM Machine Learning.

Area of Science:

• Cybersecurity
• Artificial Intelligence
• Machine Learning

Background:

• Ransomware poses a significant and evolving cybersecurity threat, often bypassing traditional security measures.
• Early detection of ransomware is crucial for mitigating damage and preventing widespread impact.
• Existing deep learning models face challenges with data scarcity and noise in initial attack phases.

Purpose of the Study:

• To introduce a novel intelligent sensing framework (ISF) for proactive, early-stage ransomware detection.
• To enhance the accuracy and reduce false positives in ransomware detection using a specialized sensor model.
• To overcome limitations of traditional defenses against stealthy ransomware attacks.

Main Methods:

• Development of a Multi-Head Self-Attention Long Short-Term Memory (MHSA-LSTM) sensor model.
• Incorporation of a relevance coefficient (μ) based on information gain to prioritize discriminative behavioral features.
• Validation using dynamic analysis of 39,378 ransomware and 9,732 benign application samples.

Main Results:

• The MHSA-LSTM sensor achieved a peak accuracy of 98.4%, an F1 score of 0.972, and a low False Positive Rate (FPR) of 0.089.
• The ISF demonstrated superior performance compared to CNN-LSTM and Stacked LSTM models.
• Integration of the relevance coefficient (μ) led to a 49% reduction in FPRs compared to standard attention models.

Conclusions:

• The novel ISF, powered by the MHSA-LSTM sensor, offers a robust and scalable solution for early-stage ransomware detection.
• The self-attention mechanism with information gain effectively filters noise and addresses data scarcity.
• The significant reduction in false positives makes the ISF a practical solution for live cybersecurity environments.