RANSEC: Hybrid Ensemble Learning-based Secure Approach for Ransomware Detection in Cyber-Physical Defence Systems

Abstract

Sophisticated ransomware attacks increasingly target cyber-physical systems (CPS), therefore seriously compromising security for vital infrastructure. Stronger and more intelligent protection systems are necessary, as conventional detection systems can struggle to adapt to evolving attack patterns. This work proposes a novel hybrid ensemble learning model that is driven by artificial intelligence and makes use of weighted voting, combining Random Forest classifiers with SVM classifiers and another technique, stacking, which utilizes SVM with XGBoost as base classifiers and logistic regression as a meta classifier to improve the accuracy of ransomware detection. Experiments performed on the publicly accessible Kaggle ransomware dataset, containing 62,485 records of process, network activities, validate the superiority of the proposed approach, as the stacking-based hybrid model provides 93.15% accuracy compared to current single and ensemble classifiers. The adaptive resilience of the framework is guaranteed by the dynamic weighting, the meta-learning combination, which reduces the number of false positives and provides low-latency performance that is necessary in the real-world implementation of CPS. This secure model is the first step towards extending the existing literature and provides a scalable means to defend against future ransomware attacks on cyber-physical systems, protecting critical infrastructure in smart manufacturing, healthcare, and energy systems.