Multi-Classification of Imbalance Worm Ransomware in the IoMT System

Result code in IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F62690094%3A18450%2F22%3A50019520" target="_blank" >RIV/62690094:18450/22:50019520 - isvavai.cz</a>

Result on the web

<a href="http://dx.doi.org/10.3233/FAIA220282" target="_blank" >http://dx.doi.org/10.3233/FAIA220282</a>

DOI - Digital Object Identifier

<a href="http://dx.doi.org/10.3233/FAIA220282" target="_blank" >10.3233/FAIA220282</a>

Result language

angličtina

Original language name

Multi-Classification of Imbalance Worm Ransomware in the IoMT System

Original language description

Worm-like ransomware strains spread quickly to critical systems such as IoMT without human interaction. Therefore, detecting different worm-like ransomware attacks during their spread is vital. Nevertheless, the low detection rate due to the imbalanced ransomware data and the detection systems&apos; disability for multiclass simultaneous detection are two apparent problems. In this work, we proposed a new approach for multi-classifying ransomware using preprocessing, resampling, and different classifiers. The proposed system uses network traffic NetFlow data, which is privacy-friendly and not heavy. In the first phase, preprocessing techniques were used on the collected and aggregated ransomware traffic, and then an optimized Synthetic Minority Oversampling Technique (SMOTE) was used for resampling the low-class samples. After that, four classifiers were applied, namely, Bayes Net, Hoeffding Tree, K-Nearest Neighbor, and a lightweight Multi-Layered Perceptron (MLP). The experimental results showed that the efficient preprocessing ensured accurate and simultaneous ransomware detection while the resampling technique improved the detection rate, F1, and PRC curve. © 2022 The authors and IOS Press. All rights reserved.

Czech name

—

Czech description

—

Type

D - Article in proceedings

CEP classification

—

OECD FORD branch

10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)

Project

—

Continuities

I - Institucionalni podpora na dlouhodoby koncepcni rozvoj vyzkumne organizace

Publication year

2022

Confidentiality

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Article name in the collection

Frontiers in Artificial Intelligence and Applications

ISBN

978-1-64368-316-4

ISSN

0922-6389

e-ISSN

1535-6698

Number of pages

11

Pages from-to

531-541

Publisher name

IOS Press BV

Place of publication

Amsterdam

Event location

Kitakyushu

Event date

Sep 20, 2022

Type of event by nationality

WRD - Celosvětová akce

UT code for WoS article

—