Research Article
FedDICE: A Ransomware Spread Detection in a Distributed Integrated Clinical Environment Using Federated Learning and SDN Based Mitigation
@INPROCEEDINGS{10.1007/978-3-030-91424-0_1, author={Chandra Thapa and Kallol Krishna Karmakar and Alberto Huertas Celdran and Seyit Camtepe and Vijay Varadharajan and Surya Nepal}, title={FedDICE: A Ransomware Spread Detection in a Distributed Integrated Clinical Environment Using Federated Learning and SDN Based Mitigation}, proceedings={Quality, Reliability, Security and Robustness in Heterogeneous Systems. 17th EAI International Conference, QShine 2021, Virtual Event, November 29--30, 2021, Proceedings}, proceedings_a={QSHINE}, year={2021}, month={11}, keywords={}, doi={10.1007/978-3-030-91424-0_1} }- Chandra Thapa
Kallol Krishna Karmakar
Alberto Huertas Celdran
Seyit Camtepe
Vijay Varadharajan
Surya Nepal
Year: 2021
FedDICE: A Ransomware Spread Detection in a Distributed Integrated Clinical Environment Using Federated Learning and SDN Based Mitigation
QSHINE
Springer
DOI: 10.1007/978-3-030-91424-0_1
Abstract
An integrated clinical environment (ICE) enables the connection and coordination of the internet of medical things around the care of patients in hospitals. However, ransomware attacks and their spread on hospital infrastructures, including ICE, are rising. Often the adversaries are targeting multiple hospitals with the same ransomware attacks. These attacks are detected by using machine learning algorithms. But the challenge is devising the anti-ransomware learning mechanisms and services under the following conditions: (1) provide immunity to other hospitals if one of them got the attack, (2) hospitals are usually distributed over geographical locations, and (3) direct data sharing is avoided due to privacy concerns. In this regard, this paper presents a federated distributed integrated clinical environment, aka.FedDICE. FedDICE integrates federated learning (FL), which is privacy-preserving learning, to SDN-oriented security architecture to enable collaborative learning, detection, and mitigation of ransomware attacks. We demonstrate the importance of FedDICE in a collaborative environment with up to 4 hospitals and 4 ransomware families, namely WannaCry, Petya, BadRabbit and PowerGhost. Our results find that in both IID and non-IID data setups, FedDICE achieves the centralized baseline performance that needs direct data sharing for detection. However, as a trade-off to data privacy, FedDICE observes overhead in the anti-ransomware model training, e.g.,(28{\times })for the logistic regression model. Besides, FedDICE utilizes SDN’s dynamic network programmability feature to remove the infected devices in ICE.
