Lightweight Machine Learning Models for Real-Time Ransomware Detection on Resource-Constrained Devices

Abstract

Ransomware remains one of the most destructive forms of cyberattacks, increasingly targeting mobile, IoT, and embedded systems with limited computational capabilities. Traditional deep learning–based ransomware detection solutions impose heavy computational overhead and are unsuitable for devices operating with constrained memory, battery, and processing power. This study proposes a lightweight machine learning framework designed to detect ransomware in real time using low-latency, low-complexity classifiers optimized for resource-constrained devices. Using the CIC-Ransomware 2020 dataset, which contains network-flow features of multiple ransomware families, six lightweight models Logistic Regression (LR), Naïve Bayes (NB), k-Nearest Neighbors (kNN), Support Vector Machine (SVM-linear), Decision Tree (DT), and Random Forest (RF-light) were trained and evaluated. Feature reduction was performed using Mutual Information and Recursive Feature Elimination to limit the model to 12 optimal features suitable for edge deployment. Experimental results show that the optimized Random Forest and Logistic Regression models achieve high accuracy (97.8% and 94.6%), low inference time (<3 ms), and small memory footprints (<1.2 MB), demonstrating suitability for real-time ransomware detection on IoT gateways, smartphones, and microcontrollers. The results highlight that lightweight ML approaches when optimized can effectively secure edge devices without requiring heavy deep learning models.