Adaptive federated learning improves ransomware detection efficiency and explainability
AdaFedXplain: Adaptive Federated Learning with Explainable AI for Ransomware Detection
Cryptography and SecurityArtificial Intelligence
Summary
Ransomware attacks are costly and hard to detect, especially new types that traditional methods miss. The authors created AdaFedXplain, a system where many users train a ransomware detector together without sharing private data. This system is faster, uses less energy, and explains its decisions better than older methods. It helps security teams spot ransomware by pointing out which parts of a file are suspicious.
What this means in practice
- •For cybersecurity teams: Detect ransomware collaboratively across devices while preserving user data privacy and reducing resource use with an interpretable federated learning model.
- •For cloud infrastructure operators: Deploy federated ransomware detection models that dynamically prioritize clients based on data quality to reduce communication and latency in distributed systems.
Authors
Md. Emran Biswas, Md. Delowar Hossain, Mst. Tanbin Yasmin Tanny, Muhammad Aminur Rahaman, Md Al Amin, Tangina Sultana
Abstract
Attacks using ransomware have developed into complex multiphase campaigns that target vital infrastructure, resulting in annual damages of billions of dollars. Conventional detection techniques are ineffective against zero-day variations, and privacy issues are raised by centralized machine learning algorithms. Federated learning allows for cooperative model training without data sharing, however current FL approaches suffer from explainability issues, high communication cost, and non-IID data heterogeneity. In this study, we present AdaFedXplain, an explainable AI-based adaptive federated learning system for ransomware detection. Our approach includes progressive XGBoost complexity to avoid overfitting, a decaying learning rate schedule for stable convergence, and dynamic client grading based on ransomware prevalence and data sufficiency. Using 62,485 real-world ransomware samples from four OS-based non-IID clients, we compare AdaFedXplain against FedAvg, FedProx, and SCAFFOLD. According to experimental data, AdaFedXplain outperforms all baselines with 99.59% detection accuracy and 99.64% F1-score while cutting energy usage by 75%, latency by 65%, and communication overhead by 75%. The ablation investigation demonstrates that every element enhances performance. Security analysts can use SHAP explainability to identify important PE header characteristics that influence detection decisions. Our system provides a collaborative ransomware detection solution that is efficient and interpretable, while reducing privacy risks through federated learnings data-local training paradigm.