Toward a New Approach Based on Conditional Tabular Generative Adversarial Network for Ransomware Attack Detection in IoT Systems

Abstract

IoT systems are increasingly targeted by ransomware attacks, exploiting weak authentication, limited processing capabilities, and the lack of robust security mechanisms on many devices. The interconnected nature of these systems makes a single compromised device a gateway to a large-scale disruptions. While GAN has been used to address class imbalance in intrusion detection datasets, conventional Generative Adversarial Networks (GAN) often fail to accurately understand the complexity of tabular network traffic. Similarly, classical oversampling methods risk generating redundant or unrealistic samples, leading to overfitting and reduced generalization. In this paper, we employ Conditional Tabular GAN (CTGAN) to generate both normal and ransomware traffic from Ton-IoT dataset, targeting the challenge of class imbalance in IoT network intrusion detection systems. The artificially generated data are used in order to train a Tabular Network (TabNet) model and Machine Learning models including Random Forest, Decision Tree, Logistic Regression, KNN, Gaussian NB, MLP based on a two-layer architecture and Gradient Boosting. The proposed approach achieves 100 % of accuracy, precision, recall and F1-score for Tabnet. We can say that our methodology improves the resilience of training models against ransomware attacks, contributing to more secure IoT systems.