AI-Powered Federated Learning Framework for Ransomware Detection in IoT Edge Environments

The rapid proliferation of Internet of Things (IoT) devices in edge environments has heightened the risk of ransomware attacks targeting resource-constrained systems. Centralized detection approaches often compromise privacy and suffer from scalability and latency issues. This study proposes a decentralized, privacy-preserving ransomware detection framework that leverages federated learning (FL) to enable collaborative model training across distributed IoT devices without exposing raw data. The architecture integrates differential privacy and homomorphic encryption to enhance confidentiality and uses continual learning to support adaptation to evolving threats. Evaluation was conducted using the Edge-IIoTset dataset, supplemented with synthetic ransomware samples to simulate obfuscation tactics. The proposed Federated DNN model achieved a detection accuracy of 91.62\% and demonstrated resilience against adversarial attacks, with an FGSM-based adversarial accuracy of 86.32\%. Quantization reduced the model's resource footprint, allowing deployment on constrained edge devices with minimal loss in performance. The model also maintained fairness across heterogeneous clients and improved communication efficiency through FFT-based compression. These results demonstrate the practicality and robustness of federated learning for ransomware detection in real-world IoT edge environments.