GAN-Enhanced Ransomware Detection in SDN-Based IIoT Networks

Abstract

The escalating threat of ransomware in Industrial Internet of Things (IIoT) networks necessitates advanced detection methods to protect critical infrastructure. This article proposes a robust ransomware detection and mitigation framework that integrates generative adversarial network (GAN)-based data augmentation with machine learning (ML) classifiers within a software-defined networking (SDN) environment. To address severe class imbalance in IIoT traffic, synthetic ransomware samples are generated to augment the EdgeIIoTset dataset. This enhanced dataset trains multiple ML classifiers—including decision tree (DT), light gradient boosting machine (LightGBM), eXtreme gradient boosting (XGBoost), and random forest (RF)—leveraging dynamic feature selection to identify critical network attributes. Experimental evaluations demonstrate that GAN-enhanced training enables the XGBoost classifier to achieve 99.92% accuracy, 100% precision, 99.26% recall, and a 99.63% F1-score, alongside a low false positive rate of 3.73 × 10⁻⁶. This represents a 4.5% improvement in recall compared to nonaugmented baseline models. Furthermore, an adaptive mitigation threshold of 97% malicious packets effectively blocks attack flows in real time, reducing attack throughput to zero. These figures of merit confirm the efficacy and scalability of coupling generative data balancing with programmable SDN control for IIoT security.