Next Generation of AI-based Ransomware

In the era of the Internet of Things and Artificial Intelligence (AI), cybersecurity has become a critical challenge. Existing AI-based detection systems have shown merit in detecting heterogeneous malware, but their effectiveness against the next generation of AI-powered ransomware encrypting data intelligently is under discussion. In this context, this work introduces a novel AI-powered ransomware that combines Reinforcement Learning and fingerprints based on system calls to evade AI-based cybersecurity detection systems. More in detail, an RL-based agent utilizes Deep Q-Learning as a learning algorithm, system calls to model device states, and the result of unsupervised learning as input for the reward function. The efficacy of this approach has been evaluated on a Raspberry Pi acting as a real spectrum sensor that hosts a behavioral AI-based anomaly detector. Experiments have compared the AI-based ransomware evasion performance with the literature and analyzed how various benign and realistic behaviors affect evasion performance. Results showed that precise and adaptive evasion capabilities can be learned in a few minutes, motivating the need for better cybersecurity systems.

I. Introduction

The proliferation of the Internet of Things (IoT) has increased dramatically over the past two decades, with projections indicating continued growth to nearly 30 billion devices by 2030 [1]. This expansion has influenced the creation and collection of massive amounts of data, ushering in the era of Big Data. Within this landscape, significant challenges have emerged, particularly concerning the security and privacy of devices and data. The inherent resource constraints of many IoT devices, coupled with the heterogeneous nature of the IoT paradigm, complicate the development of robust security mechanisms [2]. Moreover, manufacturers often prioritize cost and time-to-market over security, resulting in low-security devices lacking support for patching and upgrades.