Multi-classification of imbalance worm ransomware in the IoMT system

Abstract

Worm-like ransomware strains spread quickly to critical systems such as IoMT without human interaction. Therefore, detecting different worm-like ransomware attacks during their spread is vital. Nevertheless, the low detection rate due to the imbalanced ransomware data and the detection systems' disability for multiclass simultaneous detection are two apparent problems. In this work, we proposed a new approach for multi-classifying ransomware using preprocessing, resampling, and different classifiers. The proposed system uses network traffic NetFlow data, which is privacy-friendly and not heavy. In the first phase, preprocessing techniques were used on the collected and aggregated ransomware traffic, and then an optimized Synthetic Minority Oversampling Technique (SMOTE) was used for resampling the low-class samples. After that, four classifiers were applied, namely, Bayes Net, Hoeffding Tree, K-Nearest Neighbor, and a lightweight Multi-Layered Perceptron (MLP). The experimental results showed that the efficient preprocessing ensured accurate and simultaneous ransomware detection while the resampling technique improved the detection rate, F1, and PRC curve.