RansomSentry: Hardware-Level Monitoring for Ransomware Protection in IoT Environments

With the rise of Internet of Things (IoT) devices integral to daily life and critical infrastructure, new security challenges have emerged, notably increased vulnerability to ransomware attacks. Traditional intrusion detection systems and antivirus software are too resource-intensive for IoT devices with limited processing, memory, and power, causing performance degradation and reduced battery life. To address this issue, this paper proposes RansomSentry, a lightweight machine learning (ML)-based approach that relies on existing hardware capabilities of the IoT device to detect ransomware. RansomSentry uses hardware performance counters to record and analyze key low-level CPU activities to identify patterns that are indicative of a malicious activity behavior. This study focused on commonly accessible events and low-cost unsupervised methods that do not require data training and labeling, ensuring robust IoT security without heavy computational burden. Our results show that combining more HPC events and different ML algorithms improves ransomware detection and insights into malicious behaviors.