Arquitetura reconfigurável (FPGA) baseada em modelo de Machine Learning para detecção de Ransomware em ambientes pervasivos

Abstract

The growing number of ransomware attacks has put data security and service availabi lity at risk worldwide, causing an estimated financial impact of billions of dollars annually. Traditional signature-based detection approaches struggle to identify new variants due to obfuscation and polymorphism, limiting their effectiveness against zero-day attacks. At the same time, general-purpose processor architectures lack the hardware-level reconfi guration flexibility required for adaptive processing of Machine Learning (ML) models in pervasive computing environments, which are characterized by devices with limited processing, memory, and energy resources. This work proposes a ransomware detection architecture based on Field-Programmable Gate Array (FPGA) that combines Machine Learning techniques with the implementation of a classifier as combinational logic, priori tizing deterministic, low-latency inference for resource-constrained devices. The proposed method comprises training and comparing five supervised models (Decision Tree, Random Forest, eXtreme Gradient Boosting (XGBoost), Neural Network and Support Vector Ma chine (SVM)) on the CIC-MalMem-2022 dataset, using an 80/20 hold-out split combined with 5-fold cross-validation, followed by an explainability analysis using SHAP (SHa pley Additive exPlanations) to identify the consensus among models regarding the most relevant features for detection. The model that best balances predictive performance and structural simplicity will then be translated into a VHSIC Hardware Description Language (VHDL) description, in which the learned decision thresholds are embedded as constants in fixed-point comparators, enabling the synthesis of a single-cycle FPGA classifier. This work is expected to contribute to the state of the art in ransomware de tection by proposing a lightweight, low-latency hardware model suitable for embedded and pervasive devices with constrained computational resources, as an alternative to the high-performance, data-center-oriented architectures that predominate in the literature.