Advanced Hybrid Ransomware Detection Using Secure BERT-GAT Framework

Thota, Devendra Kumar (2025) Advanced Hybrid Ransomware Detection Using Secure BERT-GAT Framework. Masters thesis, Dublin, National College of Ireland.

Preview	PDF (Master of Science) Download (766kB) | Preview
Preview	PDF (Configuration Manual) Download (996kB) | Preview

Abstract

Ransomware poses a critical cybersecurity threat, with attacks causing billions in damages annually whilst evolving to evade traditional detection methods. In order to capture the complimentary information available from both modalities, existing techniques usually analyze either static file attributes or dynamic runtime behaviors in isolation. This study presents SecureBERT-GAT, a unified attention framework for multi-modal ransomware classification that combines graph attention methods with domain-specific transformer encoding. The framework encodes 54 Portable Executable header fields into security-aware text narratives using SecureBERT, a language model that has been pre-trained on 2.2 million cybersecurity papers. In parallel, 13 dynamic behavioral features are modeled as nodes in a fully linked graph by a two-layer Graph Attention Network with four attention heads, which uses multi-head attention to learn feature interactions. The encoded representations undergo dual classification head processing for binary detection and 27-family attribution after being fused with skip connections. Evaluation on a balanced dataset of 21,752 samples demonstrates 91.87% F1 score for binary classification and 65.85% F1 Macro for family classification, matching state-of-the-art performance on comparable multi-class tasks. The architectural contribution of merging static and dynamic analysis through unified attention processes is validated by ablation tests, which show that multi-modal fusion increases binary F1 by 8.46 percentage points over the best single-modality option.

Item Type:	Thesis (Masters)
Supervisors:	Name Email Prior, Michael UNSPECIFIED
Subjects:	Q Science > QA Mathematics > Electronic computers. Computer science T Technology > T Technology (General) > Information Technology > Electronic computers. Computer science P Language and Literature > P Philology. Linguistics > Computational linguistics. Natural language processing Q Science > QA Mathematics > Computer software > Computer Security T Technology > T Technology (General) > Information Technology > Computer software > Computer Security
Divisions:	School of Computing > Master of Science in Cyber Security
Depositing User:	Ciara O'Brien
Date Deposited:	04 Sep 2026 11:24
Last Modified:	04 Sep 2026 11:24
URI:	https://norma.ncirl.ie/id/eprint/9839

Actions (login required)

View Item