Multi-Classification of Imbalance Worm Ransomware in the IoMT System

Kód výsledku v IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F62690094%3A18450%2F22%3A50019520" target="_blank" >RIV/62690094:18450/22:50019520 - isvavai.cz</a>

Výsledek na webu

<a href="http://dx.doi.org/10.3233/FAIA220282" target="_blank" >http://dx.doi.org/10.3233/FAIA220282</a>

DOI - Digital Object Identifier

<a href="http://dx.doi.org/10.3233/FAIA220282" target="_blank" >10.3233/FAIA220282</a>

Jazyk výsledku

angličtina

Název v původním jazyce

Multi-Classification of Imbalance Worm Ransomware in the IoMT System

Popis výsledku v původním jazyce

Worm-like ransomware strains spread quickly to critical systems such as IoMT without human interaction. Therefore, detecting different worm-like ransomware attacks during their spread is vital. Nevertheless, the low detection rate due to the imbalanced ransomware data and the detection systems&apos; disability for multiclass simultaneous detection are two apparent problems. In this work, we proposed a new approach for multi-classifying ransomware using preprocessing, resampling, and different classifiers. The proposed system uses network traffic NetFlow data, which is privacy-friendly and not heavy. In the first phase, preprocessing techniques were used on the collected and aggregated ransomware traffic, and then an optimized Synthetic Minority Oversampling Technique (SMOTE) was used for resampling the low-class samples. After that, four classifiers were applied, namely, Bayes Net, Hoeffding Tree, K-Nearest Neighbor, and a lightweight Multi-Layered Perceptron (MLP). The experimental results showed that the efficient preprocessing ensured accurate and simultaneous ransomware detection while the resampling technique improved the detection rate, F1, and PRC curve. © 2022 The authors and IOS Press. All rights reserved.

Název v anglickém jazyce

Multi-Classification of Imbalance Worm Ransomware in the IoMT System

Popis výsledku anglicky

Worm-like ransomware strains spread quickly to critical systems such as IoMT without human interaction. Therefore, detecting different worm-like ransomware attacks during their spread is vital. Nevertheless, the low detection rate due to the imbalanced ransomware data and the detection systems&apos; disability for multiclass simultaneous detection are two apparent problems. In this work, we proposed a new approach for multi-classifying ransomware using preprocessing, resampling, and different classifiers. The proposed system uses network traffic NetFlow data, which is privacy-friendly and not heavy. In the first phase, preprocessing techniques were used on the collected and aggregated ransomware traffic, and then an optimized Synthetic Minority Oversampling Technique (SMOTE) was used for resampling the low-class samples. After that, four classifiers were applied, namely, Bayes Net, Hoeffding Tree, K-Nearest Neighbor, and a lightweight Multi-Layered Perceptron (MLP). The experimental results showed that the efficient preprocessing ensured accurate and simultaneous ransomware detection while the resampling technique improved the detection rate, F1, and PRC curve. © 2022 The authors and IOS Press. All rights reserved.

Druh

D - Stať ve sborníku

CEP obor

—

OECD FORD obor

10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)

Projekt

—

Návaznosti

I - Institucionalni podpora na dlouhodoby koncepcni rozvoj vyzkumne organizace

Rok uplatnění

2022

Kód důvěrnosti údajů

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Název statě ve sborníku

Frontiers in Artificial Intelligence and Applications

ISBN

978-1-64368-316-4

ISSN

0922-6389

e-ISSN

1535-6698

Počet stran výsledku

11

Strana od-do

531-541

Název nakladatele

IOS Press BV

Místo vydání

Amsterdam

Místo konání akce

Kitakyushu

Datum konání akce

20. 9. 2022

Typ akce podle státní příslušnosti

WRD - Celosvětová akce

Kód UT WoS článku

—