Full Text Available
Note: Clicking the button above will open the full text document at the original institutional repository in a new window.
IoT-based ransomware detection using reinforcement learning feature selection
Dissertation (MSc (Computer Science)) -University of Pretoria,2026.
Saved in:
| Other Authors: | |
|---|---|
| Format: | Thesis |
| Language: | English |
| Published: |
University of Pretoria
2026
|
| Subjects: | |
| Tags: |
No Tags, Be the first to tag this record!
|
| _version_ | 1869484114240864256 |
|---|---|
| access_status_str | Open Access |
| author2 | Singh, Avinash |
| author_browse | Singh, Avinash |
| author_facet | Singh, Avinash |
| collection | Thesis |
| dc_rights_str_mv | © 2024 University of Pretoria. All rights reserved. The copyright in this work vests in the University of Pretoria. No part of this work may be reproduced or transmitted in any form or by any means, without the prior written permission of the University of Pretoria. |
| description | Dissertation (MSc (Computer Science)) -University of Pretoria,2026. |
| format | Thesis |
| id | oai:repository.up.ac.za:2263/108510 |
| institution | University of Pretoria (South Africa) |
| language | English |
| last_indexed | 2026-07-01T04:09:44.681Z |
| license_str | Other — see source repository |
| provenance_str_mv | Harvested via OAI-PMH from UPSpace — University of Pretoria Institutional Repository |
| publishDate | 2026 |
| publishDateRange | 2026 |
| publishDateSort | 2026 |
| publisher | University of Pretoria |
| publisherStr | University of Pretoria |
| record_format | dspace |
| source_str | UPSpace — University of Pretoria Institutional Repository |
| spelling | oai:repository.up.ac.za:2263/108510 IoT-based ransomware detection using reinforcement learning feature selection Singh, Avinash u04960174@tuks.co.za Nchabeleng, Mohlale Anthony UCTD Sustainable Development Goals (SDGs) Internet of Things Ransomware detection Machine learning Deep reinforcement learning Feature selection Soft actor–critic Dissertation (MSc (Computer Science)) -University of Pretoria,2026. The rapid expansion of the Internet of Things (IoT) has transformed modern digital infrastructure by connecting billions of resource constrained devices across homes, industries, healthcare systems and national critical infrastructure. While this pervasive connectivity enables automation and real time intelligence, it also exposes IoT ecosystems to a growing spectrum of cyber threats. Ransomware represents one of the most critical and potentially disruptive forms of malicious activity in this domain, largely by exploiting inherent vulnerabilities such as weak configurations, limited computing capability and the absence of robust defence mechanisms on many IoT devices. Traditional detection methods rely heavily on manually engineered features and signature-based techniques that require expert knowledge and struggle to keep pace with the fast evolution of modern ransomware. These limitations create an urgent need for adaptive security approaches that can operate efficiently within the strict resource boundaries of IoT environments. This study presents a novel IoT Ransomware Detection Framework (IRDF) to automatically select features instead of relying on manual feature selection. The framework leverages the Deep Reinforcement Learning (DRL) method Soft Actor Critic (SAC) together with a shaped reward function and a Prioritized Experience Replay (PER) buffer to learn a small number of highly discriminative feature subsets. This automated process eliminates the manual feature selection step and reduces feature dimensionality, which in turn reduces computational cost while maintaining a high level of detection accuracy. The EdgeIIoT dataset is used to train and evaluate the framework across several traditional supervised Machine Learning (ML) classifiers such as Decision Tree (DT), Random Forest (RF), Linear Regression (LR), Support Vector Machine (SVM) and K Nearest Neighbour (KNN). The framework achieves an impressive average accuracy of 99.27% and an F1-score of 99.28% while selecting only one or two features out of the original 61 features. The optimized feature subsets are then utilized to derive a lightweight classification model for deployment. Runtime evaluation of this inference model, implemented as a DT classifier and utilizing a single selected feature in a constrained virtual IoT environment, demonstrates exceptional operational efficiency. The key efficiency metrics include a fast 1.81 ms latency and minimal resource consumption, such as 0.50% CPU utilization, 81.92 MB RAM utilization, a deployment model size of only 1.7 KB and an energy consumption of 0.0017 joules per inference. These quantitative results confirm the superior performance of the framework compared with both alternative models and the baseline DT model trained on the full high dimensional feature set. Furthermore, they show that the proposed IRDF, when paired with a resource efficient inference classification model, provides an efficient, scalable and adaptable ransomware detection solution suitable for vulnerable and resource constrained IoT environments such as smart city infrastructures, sensor network environments and a wide range of industrial IoT systems. Computer Science MSc (Computer Science) Unrestricted Faculty of Engineering, Built Environment and Information Technology SDG-09: Industry, innovation and infrastructure 2026-02-20T09:41:35Z 2026-02-20T09:41:35Z 2026-05-28 2026-02-18 Dissertation * A2026 http://hdl.handle.net/2263/108510 https://github.com/ICFL-UP/IoTRDF en © 2024 University of Pretoria. All rights reserved. The copyright in this work vests in the University of Pretoria. No part of this work may be reproduced or transmitted in any form or by any means, without the prior written permission of the University of Pretoria. application/pdf University of Pretoria |
| spellingShingle | UCTD Sustainable Development Goals (SDGs) Internet of Things Ransomware detection Machine learning Deep reinforcement learning Feature selection Soft actor–critic IoT-based ransomware detection using reinforcement learning feature selection |
| title | IoT-based ransomware detection using reinforcement learning feature selection |
| title_full | IoT-based ransomware detection using reinforcement learning feature selection |
| title_fullStr | IoT-based ransomware detection using reinforcement learning feature selection |
| title_full_unstemmed | IoT-based ransomware detection using reinforcement learning feature selection |
| title_short | IoT-based ransomware detection using reinforcement learning feature selection |
| title_sort | iot based ransomware detection using reinforcement learning feature selection |
| topic | UCTD Sustainable Development Goals (SDGs) Internet of Things Ransomware detection Machine learning Deep reinforcement learning Feature selection Soft actor–critic |
| url | http://hdl.handle.net/2263/108510 https://github.com/ICFL-UP/IoTRDF |