TL-RL-FusionNet: Reinforcement Learning-Guided Residual MLP with Fused CNN Embeddings for Efficient and Adaptive...

Area of Science:

• Cybersecurity
• Machine Learning
• Artificial Intelligence

Background:

• Ransomware detection is challenged by diverse, evasive, and rapidly propagating variants.
• Existing methods like signature-based and static detection are insufficient.
• Machine learning approaches struggle with uniform sample weighting, limiting adaptation to heterogeneous data.

Purpose of the Study:

• To develop an adaptive ransomware detection framework using reinforcement learning (RL) and transfer learning (TL).
• To improve detection accuracy and efficiency by addressing data heterogeneity and sample overlaps.
• To ensure model interpretability and robustness in cyber-physical systems.

Main Methods:

• Introduced TL-RL-FusionNet, a hybrid framework combining EfficientNetB0 and InceptionV3 TL backbones with a residual MLP classifier.
• Converted sandbox reports into RGB grids for feature extraction using frozen CNNs.
• Employed a tabular Q-learning agent for sample reweighting, formulated as a per-sample bandit.
• Ensured cross-fold validation integrity by reinitializing the Q-table per fold.

Main Results:

• Achieved 99.20% accuracy, 99.40% recall, and 99.84% AUC on a custom dataset.
• Attained 90.36% accuracy on the EldeRan benchmark using full features and 92.08% with a compact subset.
• Demonstrated robustness via grid-order sensitivity analysis and interpretability through t-SNE and Grad-CAM.

Conclusions:

• RL-guided sample reweighting significantly enhances adaptive ransomware detection capabilities.
• The TL-RL-FusionNet framework offers an efficient and interpretable solution for cybersecurity.
• Publicly available dataset and code facilitate further research and development in ransomware defense.