Flexible functional data smoothing and optimization using beta spline

1.   Introduction

In recent times, the Internet of Things (IoTs) has exponentially increased with the usage of smart devices. IoT devices allow us to access from anywhere such as homes, vehicles, and offices to make day-to-day tasks simple ^[1] and are utilized in smart cities, care services, health, smart homes, smart grids, vehicular networks, and other industries. Also, they have special features, namely lower energy consumption, lighter protocols, and compact size which adapt them better ^[2]. Extended transportation of smart devices in advertising along with declined trust in identifying devices has made the web of things more and more versatile ^[3]. Malicious attacks or applications, like ransomware and malware families, constantly pose crucial security problems to cybersecurity and can result in catastrophic losses to the web, data centers, mobile applications, and computer systems across several businesses and industries ^[4]. Ransomware is mainly developed to prevent and block victims from accessing system databases by using a robust encrypting method that can be decrypted by attackers ^[5].

Removing the ransomware will lead the targeted victim to permanently lose data, therefore, targeted victims are compelled to comply with the attacker's demand ^[6]. Attackers transform traditional ransomware into new ransomware families through modern technology, which makes it more challenging to reverse the ransomware infection ^[7]. Ransomware is a variant and sophisticated threat affecting users around the world that limits users from accessing the data or system by encrypting or locking the system screen and the user files unless a ransom is paid ^[8]. Locker ransomware and crypto-ransomware are the two different types of ransomware based on attack strategies. Crypto ransomware prevents access to data or files and the access is denied to the device or computer in locker ransomware ^[9].

Conventional ransomware detection methods, like data-centric-based, event-based, and statistical-based approaches, are not suitable to combat the attacks. Thus, the high level of security and protection implemented by adopting innovative technology against these malware attacks has gained immense attention from researchers ^[10]. Due to their fixed architecture, classical machine learning (ML) techniques are unable to distinguish complicated cyberattacks from ever-growing cyber threats and adversaries' or attacker's resources and capabilities. The objective is to provide security on the device from different attacks by using the latest and advanced technologies that are capable of detecting the attacks with recognition accuracy in less time ^[11]. In this context, deep learning (DL) shows the real face of cyber data, either attack or legitimate, by identifying the slight changes or differences. Therefore, DL may quickly identify the anomalies and facilitate an in-depth analysis of network data ^[12]. Therefore, a DL-driven detection technique becomes cost-effective, adaptive, and highly scalable without exhausting the primitive devices, which is a breakthrough invention in cyber-security ^[13].

Alohali et al. ^[14] developed a sine cosine algorithm with a DL-based ransomware detection and classification (SCADL-RWDC) algorithm in the IoT platform. This algorithm employs the SCA-feature selection (SCA-FS) system to increase the recognition accuracy. Also, the proposed method implements the Hybrid Grey Wolf Optimizer GWO (HGWO) with the GRU technique to classify ransomware. The author in ^[15], introduced a new method to avoid crypto-ransomware by identifying block cipher techniques for IoT environment. This method has extracted the features in the opcode of binary documents for the microcontroller named 8-bit Alf and Vegard's RISC (AVR) processor.

In ^[16], developed a static analysis model based on N-gram opcodes with DL algorithm. At first, the proposed method splits the N-gram sequence into numerous patches as well as provides every patch to self-attention-based CNN (Conventual Neural Network) (SA-CNN). Next, the efficiency of SA-CNNs must be combined and implemented in a bi-directional SA network to achieve the outcome of ransomware classification. In ^[17], an IoT-based IDS and classification system based-CNN (IoT-IDCS-CNN) method was presented. The performance assessment utilizes parallel processing to use strong compute unified device architectures (CUDA) based Nvidia graphical processing unit (GPU) and high speed I9-core-based Intel CPU.

In ^[18], an optimum graph-CNN-enabled ransomware detection (OGCNN-RWD) method was developed for cyber-security in the IoT infrastructure. This study presents learnable enthusiasm to teach learning-based optimizer (LETLBO) techniques for the subcategory of the FS method. The GCNN architecture has been employed to classify ransomware, and hyperparameters should be effectively preferred by the harmony search algorithm (HSA). In ^[19], the main objective is to examine a lightweight DL method that increases the detection rate with a decreased computation rate for confirming the real-time application of malware monitoring in limited IoT devices. The architecture has been employed for RNN, LSTM, and the bi-directional-LSTM-DL method under a vanilla configuration trained with conventional malware databases.

Basnet et al. ^[20] projected the DL-based ransomware identification technique in SCADA-controlled electric vehicle charging stations (EVCS) with evaluation studies of 3 DL techniques such as LSTM-RNN, 1D-CNN, and DNN. Ransomware was determined the Distributed Denial-of-Service DDoS (distributed denial-of-service) attack prefers to change the state of charge (SOC) configuration by surpassing the control threshold of SOC. In ^[21], various assessment of malware evaluation of sample was determined. The 3 malware identification algorithms based on visualization methods (i.e., clustering technique, probabilistic method, and DL algorithm) were developed. Afterwards, a developed measure depends on the risk of instances that could be utilized for evaluation.

In the domain of IoT cybersecurity, researchers like Alohali et al. (^[14]) have proposed innovative approaches, such as the SCADL-RWDC algorithm integrating sine cosine slgorithm and deep learning, while Basnet et al. (^[20]) focused on DL-based ransomware identification in SCADA-controlled electric vehicle charging stations. These studies collectively offer a variety of methodologies, from SCA-FS to OGCNN-RWD, contributing to the advancement of ransomware detection and overall cybersecurity in IoT environments.

The presented article develops an EBSAEDL-RD approach in IoT security. In order to achieve this, the EBSAEDL-RD approach utilizes min-max normalization to scale input data effectively and incorporates the EBSA method for optimal feature selection. Ransomware classification is performed using the bidirectional gated recurrent unit (BiGRU) method, with the sparrow search algorithm (SSA) employed for fine-tuning hyperparameters. Extensive experiments employing the EBSAEDL-RD approach are conducted on a benchmark dataset.

2.   The proposed model

In this study, we design a new EBSAEDL-RD algorithm in IoT security. The purpose of the EBSAEDL-RD technique is to recognize and classify the ransomware to achieve security in the IoT platform. To achieve this, the EBSAEDL-RD technique contains different types of processes, namely min-max normalization, EBSA-based feature selection, BiGRU classification, and SSA-based hyperparameter tuning. Figure 1 illustrates the working flow of the EBSAEDL-RD technique.

2.1.   Min-Max normalization

Initially, the EBSAEDL-RD method exploits min-max normalization. In the context of ransomware detection, min-max normalization is a preprocessing stage for IoT security ^[22]. This method is used to standardize and scale mathematical features within a certain range, between 0 and 1. In the field of IoT security, where the recognition of ransomware threats is of great significance, normalizing input data ensures that dissimilar feature sizes do not excessively impact the performance of ML algorithms. The min-max normalization facilitates the effective utilization of diverse features in detecting patterns indicative of ransomware attacks by transforming the data into a consistent scale. This normalization method improves the accuracy and robustness of prediction techniques, contributing to the general efficiency of ransomware detection systems in protecting the IoT environment from possible security attacks.

2.2.   Feature selection

The EBSAEDL-RD technique makes use of the EBSA technique to select an optimum set of features. Ebola optimization search algorithm (EOSA), a recent meta-heuristic technique, draws inspiration from the propagation model of Ebola virus disease introduced by Oyelade and Ezugwu ^[23]. The explanation of the EOSA technique is discussed below:

1) Set each scalar and vector quantity which are parameters and individuals. Individuals in the set: Infected (I), Susceptible (S), Vaccinated (V), Dead (D), Recovered (R), Hospitalized (H), and Quarantine (Q) with the initial value.

2) The index case (I) is randomly generated from inclined individuals.

3) The index case is set as global and local optimum and the fitness values.

4) When the iteration count is not exhausted infected individuals exist,

a. Generate and update their location depending on their movement for every susceptible individual. Note that the infected state is further moved, then there exists more infection, hence short displacement defines exploitation or else exploration.

i. Generate diseased individual $\left(nI\right)$ depend on (a).

ii. Add that case to the I

b. Calculate the individual number and add it to H, D, R, B, V, and Q through the corresponding rate based on the dimension of I

c. Update S and I based on I$.$

d. Pick the present finest from I and compute it with global finest.

e. If the terminating criteria are not met, then return to step 6.

5) Return global best and each solution.

The mathematical modelling is given as follows: update of Funeral (F), Exposed (E), S, I, H, V, R, Q, and D are directed by a method of difference equation derived. The differential calculus aims to get the rates of change of quantities in terms of time $t$:

In the EBSA approach, the fitness function (FF) is intended to have a balance between the number of features chosen in every solution (minimum) and the classifier outcome (maximum) attained, Eq (8) shows the FF to calculate the solution.

In Eq (8), $\alpha$ and $\beta$ are the significance of classifier quality and subset length, ∈ [1,0] and $\beta = 1-\alpha.{\gamma }_{R}\left(D\right)$ indicates the classifier error rate, $\left|R\right|$ stands for the cardinality of the selected subset, and $\left|C\right|$ refers to the overall amount of features in the dataset (parameters).

2.3.   BiGRU based classification

In this phase, the classification of ransomware takes place using the BiGRU model. BiGRU is an RNN that has been effectively utilized for solving time‐series sequence data challenges due to its bi-directional learning system that improves the learning of temporal designs from the time‐sequence data ^[24]. All the BiGRU blocks comprise a cell that stores data. All the blocks are composed of update and reset gates and the cells assist in addressing the disappearing gradient problems. BiGRU contains 2 GRU units: reset and update gates. The reset gate integrates novel input with preceding memory and the update gate determines the preceding memory to recollect. The input dataset is fed into feedback and feedforward networks in terms of time, and these two are linked to one resultant layer. The BiGRU gates are planned to store data extensively in either backward or forward ways if the optimum solution than feedforward networks. The bi-directional method offers the ability to employ either past or future contexts from the sequences. BGRU has been formulated as:

where $\overrightarrow{{h}_{t}}$ and $\overleftarrow{{h}_{t}}$ are the feedforward and the backward blocks, respectively.

The last resultant layer at time $t$ is:

where $\sigma$ stands for the activation function, ${W}_{y}$ denotes the weighted, and ${b}_{y}$ represents the bias vector.

Every GRU block is composed of 4 modules: reset gate ${r}_{I}$ with equivalent weights and biases ${W}_{r}, {U}_{r}, {b}_{r}$, input vector ${x}_{l}$ with equivalent weights and biases, output vector ${h}_{t}$ with its weights and biases ${W}_{h}, {U}_{h}, {b}_{h}$, and update gate ${z}_{I}$ with equivalent weights and biases ${W}_{z}, {U}_{z}, \; {b}_{z}$. The gating units are defined as follows:

Primarily, for $t = 0$, the resultant vector is ${h}_{0} = 0$

where $W, U, and\;b$ denote the parameter matrices and vectors, ${\sigma }_{g}$ defines the sigmoid function, $\otimes$ indicates the Hadamard product, ${\sigma }_{g}$ and $\varnothing h$ imply the activation functions, and $\varnothing h$ signifies the hyperbolic tangent. Figure 2 defines the infrastructure of the BiGRU model.

Initially, the BGRU cells have been generated for the outcome of feedforward has been calculated $\left({F}_{t}\right)$ and the feedback propagation $\left({B}_{t}\right)$ is combined. These 4 approaches combine the solution, multiplication, concatenation (default), average, and summation. In this case, it is related to the solution of the entire combining model. The combining is defined as:

Such that

and

Then, the FC layer has been utilized to increase the BiGRU solution with its bias and weight. Afterwards, a Softmax regression layer generates a predictive utilization in the FC layer. The weighted classification layer has been utilized for computing the weighted cross‐entropy loss function to predict score and training target that assists in addressing the class imbalanced problems. The next loss can be utilized as:

where $\left({p}_{, t}\right)$ defines the assessed probability of all the classes, $\gamma \ge 0$ refers to the discount factor parameter that is tuned to better evaluate, and ${\theta }_{i}$ refers to the logic weight of all the classes.

2.4.   Hyperparameter tuning using SSA model

Finally, the SSA can be applied for optimal hyperparameter selection of the BiGRU model. SSA developed that pretends to antipredatory and predatory performance of sparrows ^[25]. In the SSA model, the individuals are separated into producers by huge energy assets, joiners discover food through producers and vigilantes who are highly answerable for cautionary. The uniqueness of finders and joiners is not stable. Any individual who finds a superior food source becomes a producer while others become a joiner. Since the producer's ratio to joiners is constant in a cluster, during the foraging procedure, producers are highly responsible for searching regions for plentiful food and delivering guidelines to other joiners who constantly discover producers by optimal food. As soon as vigilantes discover a hunter, they guide an alarm sign via song and the producer takes the joiner far away to a protected region once a sign attains a definite threshold. At the edge of the cluster, other sparrows rapidly moved to the security area, but the sparrows who were in the middle had to move arbitrarily in confidence of receiving nearer to other sparrows. Let us assume that the complete number of sparrows is $m, j$ signifies spatial distribution, the ratio of the producer to joiner is between 7:1 and 3:1, and ${\mathrm{W}}_{s}$ denotes protection threshold of cautionary signal, Then, ${S}_{i, j} = \left({S}_{1, j}, {S}_{2, j}, \mathrm{ }\dots, {S}_{\mathfrak{m}, j}\right)$ refers to the location of $i‐$th sparrow in flight. So, the location of producer, joiner, and vigilante upgraded affording to Eqs (16–18). ${R}_{2}\ge {W}_{s}$ in Eq. (16), signifies vigilantes discover a hunter, all sparrows must rapidly fly to harmless places, and ${R}_{2} < {W}_{s}$ then the producer continues its search in a wider region. If $\mathrm{I} > \frac{m}{2}$ in Eq (17), then ${the\;i}^{th}$ joiner with inferior fitness value is most probably a hungry sparrow. If ${f}_{i} = {f}_{b}$ shows that the sparrow is in mid of the swarm, and ${f}_{i} > {f}_{b}$ then the sparrow is at the edge of the swarm in Eq $\left(18\right).$

where ${S}_{i, j}^{\mathrm{k}+1}$ signifies the location of ${j}^{th}$ element of ${i}^{th}$ sparrow at $(k+1)‐$th iteration, ${S}_{i, j}^{\mathrm{k}}$ represents the position of ${j}^{th}$ dimension of ${i}^{th}$ sparrow at ${k}^{th}$ iteration, ${S}_{best}^{\mathrm{k}+1}$ denotes location of best producer at $(k+1)‐$th iteration, $L$ demonstrates a medium of every element inside is $1$, ${S}_{best}^{\mathrm{k}}$ is the global optimum solution at the ${k}^{th}$ iteration, ${S}_{worst}^{\mathrm{k}}$ is the global worst place at ${thek}^{th}$ iteration, Q denotes an arbitrary amount that follows the standard distribution, ${R}_{2}$ directs the value of the alarm signal for all sparrows, ${W}_{s}$ signifies the protection threshold of the alarm signal that is equivalent to 0.8, ${f}_{i}$ and ${f}_{b}$ are said to be present and global best fitness value respectively, $ite{r}_{\mathrm{m}\mathrm{a}\mathrm{x}}$ refers to the maximal amount of iterations, $\alpha$ and $\kappa$ signify random numbers in $\left[\mathrm{0, 1}\right]$, $\epsilon$ defines the error constant, and $\beta$ denotes the control parameter.

The SSA method derives an FF to acquire higher efficiency of classification. It describes a positive integer to characterize the enhanced accuracy of candidate solutions. Here, the decline of the classifier error rate is regarded as an FF,

3.   Results, analysis, and discussion

The ransomware detection outcomes of the EBSAEDL-RD method are tested using a dataset ^[26] encompassing 840 samples as defined by Table 1.

Figure 3 defines the confusion matrices achieved by the EBSAEDL-RD algorithm under epochs from 500 to 3000. The experimental values imply that the EBSAEDL-RD algorithm has efficient recognition of the goodware and ransomware samples under two classes.

Table 2 and Figure 4 show the ransomware detection of the EBSAEDL-RD technique is investigated under distinct epochs. The outcome inferred that the EBSAEDL-RD method reaches effectual detection of the goodware and ransomware. On 500 epochs, the EBSAEDL-RD method attains an average $acc{u}_{y}$ of 98.69%, $sen{s}_{y}$ of 98.69%, $spe{c}_{y}$ of 98.69%, ${F}_{score}$ of 98.69%, and MCC of 97.39%. On 1000 epochs, the EBSAEDL-RD system achieved an average $acc{u}_{y}$ of 99.88%, $sen{s}_{y}$ of 99.88%, $spe{c}_{y}$ of 99.88%, ${F}_{score}$ of 99.88%, and MCC of 99.76%. On 2000 epochs, the EBSAEDL-RD methodology reached an average $acc{u}_{y}$ of 99.52%, $sen{s}_{y}$ of 99.52%, $spe{c}_{y}$ of 99.52%, ${F}_{score}$ of 99.52%, and MCC of 99.05%. On 2500 epochs, the EBSAEDL-RD algorithm achieved an average $acc{u}_{y}$ of 99.17%, $sen{s}_{y}$ of 99.17%, $spe{c}_{y}$ of 99.17%, ${F}_{score}$ of 99.17%, and MCC of 98.34%. Lastly, on 3000 epochs, the EBSAEDL-RD technique obtained an average $acc{u}_{y}$ of 99.05%, $sen{s}_{y}$ of 99.05%, $spe{c}_{y}$ of 99.05%, ${F}_{score}$ of 99.05%, and MCC of 98.10%.

The $acc{u}_{y}$ curves for training (TR) and validation (VL) depicted in Figure 5 for the EBSAEDL-RD approach under epochs 500–3000 offer appreciated insights into its outcome. Specifically, there is a consistent development in both TR as well as TS $acc{u}_{y}$ with maximum epochs, demonstrating the model's ability to learn and distinguish designs in both TR and TS data. The rising trend in TS $acc{u}_{y}$ underlines the model's adaptability to the TR dataset and its capability to create accurate predictions on unnoticed data, emphasizing robust generalized abilities.

Figure 6 offers a widespread outline of the TR and TS loss performances for the EBSAEDL-RD system on distinct epochs 500–3000. The TR loss constantly diminishes as the model increases its weights to reduce classifier errors on both databases. The loss curves exemplify the model's alignment with the TR data, emphasizing its proficiency to capture designs successfully in both databases. The continuous refinement of parameters in the EBSAEDL-RD approach is noticeable, intended to diminish discrepancies among predictions and actual TR labels.

Concerning the PR curve existing in Figure 7, the findings affirm that the EBSAEDL-RD methodology under epoch 1000 consistently achieves improved PR values across each class. These results underscore the model's effective capacity for discriminating between various classes, highlighting its effectiveness in correctly distinguishing classes.

Additionally, in Figure 8, we existing ROC curves generated by the EBSAEDL-RD algorithm under epoch 1000, demonstrating its proficiency in distinguishing among class labels. These curves provide appreciated insights into how the tradeoff between TPR and FPR differs across dissimilar classification epochs and thresholds. The results underscore the model's correct classification solution under two class labels, highlighting its efficacy in addressing diverse classification tests.

In Table 3, the comparative results of the EBSAEDL-RD technique are portrayed ^[18]. Figure 9 investigates the comparison study of the EBSAEDL-RD technique in terms of $acc{u}_{y}$. The outcomes show that the EBSAEDL-RD method gains improved $acc{u}_{y}$ values. Based on $acc{u}_{y}$, the EBSAEDL-RD technique offers the greatest $acc{u}_{y}$ of 99.88% whereas the OGCNN-RWD, DWOML, Bagging, AdaBoostM1, ROF, DT, and RF systems offer lesser $acc{u}_{y}$ values of 99.67%, 99.12%, 98.53%, 96.19%, 95.87%, 97.71%, and 98.86%, respectively.

Figure 10 scrutinizes the comparison analysis of the EBSAEDL-RD algorithm with respect to $sen{s}_{y}$ and ${spec}_{y}$. The outcome means that the EBSAEDL-RD methodology obtains superior $sen{s}_{y}$ and ${spec}_{y}$ values. Based on $sen{s}_{y}$, the EBSAEDL-RD method offers a higher $sen{s}_{y}$ of 99.88% whereas the OGCNN-RWD, DWOML, Bagging, AdaBoostM1, ROF, DT, and RF algorithms attain lower $sen{s}_{y}$ values of 99.68%, 99.49%, 93.74%, 94.56%, 96.81%, 97.87%, and 98.82%, respectively. According to ${spec}_{y}$, the EBSAEDL-RD system offers an enhanced $sen{s}_{y}$ of 99.88% whereas the OGCNN-RWD, DWOML, Bagging, AdaBoostM1, ROF, DT, and RF systems reach reduced ${spec}_{y}$ values of 99.68%, 99.24%, 96.14%, 94.67%, 97.44%, 98.20%, and 98.32%, respectively. Accordingly, the EBSAEDL-RD system has been executed for enhanced ransomware detection.

4.   Conclusions

In this study, we design a new EBSAEDL-RD method in IoT security. The purpose of the EBSAEDL-RD technique is to recognize and classify the ransomware to achieve security in the IoT platform. To achieve this, the EBSAEDL-RD technique contains different types of processes, namely min-max normalization, EBSA-based feature selection, BiGRU classification, and SSA-based hyperparameter tuning. Initially, the EBSAEDL-RD technique employs min-max normalization to scale the input data into useful format. Then, the EBSAEDL-RD technique makes use of the EBSA method to select an optimum set of features. Meanwhile, the classification of ransomware takes place using the BiGRU model. At last, SSA can be applied for optimum hyperparameter selection of the BiGRU model. The wide-ranging experiments of the EBSAEDL-RD approach are performed on benchmark data. The obtained results highlighted that the EBSAEDL-RD method reaches better performance over other models on IoT security.

Acknowledgments

The authors extend their appreciation to the Deanship of Scientific Research at Northern Border University, Arar, KSA for funding this research work through the project number "NBU-FFR-2024-170-01".