Radial Spike and Slab Bayesian Neural Networks for Sparse Data in Ransomware Attacks
Ransomware attacks are increasing at an alarming rate, leading to large
financial losses, unrecoverable encrypted data, data leakage, and privacy
concerns. The prompt detection of ransomware attacks is required to minimize
further damage, particularly during the encryption stage. However, the
frequency and structure of the observed ransomware attack data makes this task
difficult to accomplish in practice. The data corresponding to ransomware
attacks represents temporal, high-dimensional sparse signals, with limited
records and very imbalanced classes. While traditional deep learning models
have been able to achieve state-of-the-art results in a wide variety of
domains, Bayesian Neural Networks, which are a class of probabilistic models,
are better suited to the issues of the ransomware data. These models combine
ideas from Bayesian statistics with the rich expressive power of neural
networks. In this paper, we propose the Radial Spike and Slab Bayesian Neural
Network, which is a new type of Bayesian Neural network that includes a new
form of the approximate posterior distribution. The model scales well to large
architectures and recovers the sparse structure of target functions. We provide
a theoretical justification for using this type of distribution, as well as a
computationally efficient method to perform variational inference. We
demonstrate the performance of our model on a real dataset of ransomware
attacks and show improvement over a large number of baselines, including
state-of-the-art models such as Neural ODEs (ordinary differential equations).
In addition, we propose to represent low-level events as MITRE ATT\&CK tactics,
techniques, and procedures (TTPs) which allows the model to better generalize
to unseen ransomware attacks.