Ransomware detection and family classification using fine-tuned BERT and RoBERTa models
Amjad Hussain, Ayesha Saadia, Faeiz Alserhani · Egyptian Informatics Journal · 2025
Integrating Internet of Things (IoT) technologies in healthcare has revolutionized patient care, enabling real-time monitoring, predictive analytics, and personalized treatments. However, it presents significant challenges that must be addressed to ensure secure and reliable implementation. IoT devices in healthcare, such as remote patient monitors, are often constrained by limited computational power, making them vulnerable to sophisticated cyberattacks, including ransomware. In 2017 the WannaCry ransomware attack disrupted many National Health Service facilities in the United Kingdom and emphasized the critical need for robust cybersecurity measures. The lack of standardization across IoT devices creates interoperability issues and complicates data transfer between medical devices and healthcare systems. This research explores these challenges and proposes a novel approach using hyperparameter-optimized transfer learning-based models, Bidirectional Encoder Representations from Transformers (BERT), and a Robustly Optimized BERT Approach (RoBERTa), to not only detect but also classify ransomware targeting IoT devices by analyzing dynamically executed API call sequences in a sandbox environment. A total of 3300 samples from 10 ransomware families including 300 benign cases are analyzed dynamically in a sandbox environment. The newly created dataset is then preprocessed and fed to the BERT and RoBERTa models for training. The BERT achieved 95.60% accuracy with a minimal loss of 0.1650 while the RoBERTa achieved 94.39% accuracy with 0.1948 loss in classifying ransomware families. These results indicate that the proposed approach is game-changing in the classification of previously unidentified behavioral patterns inside ransomware and enhances the ability to tackle newly developing threats. By leveraging the dynamic analysis with API call sequences in a correct format, and training hyperparameter-optimized transformer learning-based models, the methodology efficiently captures behavioral patterns unique to ransomware. The research provides a scalable framework for integrating advanced detection mechanisms into real-world healthcare IoT systems, enhancing their resilience against cyber threats.