Document Type
Conference Proceeding
Publication Date
1-1-2023
Abstract
Ransomware is a type of malware which encrypts user data and extorts payments in return for the decryption keys. This cyberthreat is one of the most serious challenges facing organizations today and has already caused immense financial damage. As a result, many researchers have been developing techniques to counter ransomware. Recently, the federated learning (FL) approach has also been applied for ransomware analysis, allowing corporations to achieve scalable, effective detection and attribution without having to share their private data. However, in reality there is much variation in the quantity and composition of ransomware data collected across multiple FL client sites/regions. This imbalance will inevitably degrade the effectiveness of any defense mechanisms. To address this concern, a modified FL scheme is proposed using a weighted cross-entropy loss function approach to mitigate dataset imbalance. A detailed performance evaluation study is then presented for the case of static analysis using the latest Windows-based ransomware families. The findings confirm improved ML classifier performance for a highly imbalanced dataset.
Publication Source (Journal or Book title)
2023 IEEE 20th International Conference on Smart Communities: Improving Quality of Life using AI, Robotics and IoT, HONET 2023
First Page
255
Last Page
260
Recommended Citation
Vehabovic, A., Zanddizari, H., Ghani, N., Javidi, G., Uluagac, S., Rahouti, M., Bou-Harb, E., & Safaei Pour, M. (2023). Ransomware Detection Using Federated Learning with Imbalanced Datasets. 2023 IEEE 20th International Conference on Smart Communities: Improving Quality of Life using AI, Robotics and IoT, HONET 2023, 255-260. https://doi.org/10.1109/HONET59747.2023.10375023
