A Weighted Minimum Redundancy Maximum Relevance Technique for Ransomware Early Detection in Industrial IoT

Ransomware attacks against Industrial Internet of Things (IIoT) have catastrophic consequences not only to the targeted infrastructure, but also services provided public. By encrypting operational data, ransomware can disrupt normal operations, which represents a serious problem for industrial systems. employs several avoidance techniques, such as packing, obfuscation, noise insertion, irrelevant and redundant system call injection, deceive security measures make both static dynamic analysis more difficult. In this paper, Weighted minimum Redundancy maximum Relevance (WmRmR) technique was proposed better feature significance estimation in data captured during early stages attacks. The combines an enhanced mRMR (EmRmR) with Term Frequency-Inverse Document Frequency (TF-IDF) so that it filter out runtime noisy behavior based on weights calculated by TF-IDF. has capability assess whether relevant set is important or not. It low-dimensional complexity smaller number evaluations compared original mRmR method. TF-IDF used evaluate features generated EmRmR algorithm. Then, inclusive entropy-based refinement method decrease size extracted identifying calls strong behavioral indication. After extensive experimentation, shown be effective detection low-complexity few false-positive rates. To technique, we existing methods.