Leveraging Deep Learning Models for Ransomware Detection in the Industrial Internet of Things Environment

Muna Al-Hawawreh, Elena Sitnikova

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

31 Citations (Scopus)

Abstract

Local Area Network (LAN) workstations that operate at the edge tier of Industrial Internet of Things systems (IIoT) and have direct or indirect interaction with critical control devices could be a key vector for advanced threats against control systems, such as a ransomware threat. This indicates that there is a necessity for monitoring these workstations to detect any malicious behavior related to ransomware, and generating an alarm to prevent the ransomware from expanding its activity to more critical system entities. The efficient detection of a ransomware attack very much relies on how accurately its activities are understood and how its traits are discovered. This can help in distinguishing ransomware from legitimate system activities. In this paper, we utilize deep learning techniques to extract the latent representation of a high dimension of collected data to identify malicious behavior accurately. Specifically, the model that we propose is based on a hybrid feature engineering technique of classical and variational auto-encoders. This hybrid technique is used to reduce the dimension of data and extract a good representation of the collected system activities. Then, the new feature vector is passed to a classifier that is built based on deep neural network and batch normalization techniques. The paper concludes with experimental results demonstrating that our model performs better in detecting ransomware compared with other existing models.

Original languageEnglish
Title of host publication2019 Military Communications and Information Systems Conference, MilCIS 2019 - Proceedings
PublisherInstitute of Electrical and Electronics Engineers Inc.
ISBN (Electronic)9781728108957
DOIs
Publication statusPublished - Nov 2019
Externally publishedYes
Event2019 Military Communications and Information Systems Conference, MilCIS 2019 - Canberra, Australia
Duration: 12 Nov 201914 Nov 2019

Publication series

Name2019 Military Communications and Information Systems Conference, MilCIS 2019 - Proceedings

Conference

Conference2019 Military Communications and Information Systems Conference, MilCIS 2019
Country/TerritoryAustralia
CityCanberra
Period12/11/1914/11/19

Keywords

  • component
  • deep learning
  • detection
  • feature engineering
  • IIoT
  • LAN
  • ransomware

Fingerprint

Dive into the research topics of 'Leveraging Deep Learning Models for Ransomware Detection in the Industrial Internet of Things Environment'. Together they form a unique fingerprint.

Cite this