SA-DRL Security-Aware Deep Reinforcement Learning for Ransomware Detection with Asymmetric Reward Design

Jul 16, 2026

Upload by Sage

Ransomware encrypts victim data in seconds, yet many machine learning detectors use symmetric losses that penalize false negatives (missed detections) and false positives (benign alarms) equally. In operations, a false negative can cause irreversible data loss and major recovery cost, while a false positive is typically reversible. To align optimization with this asymmetric risk, the study proposes SA-DRL, embedding FN–FP cost asymmetry into reinforcement learning rewards and using security-optimal model selection plus adaptive sample weighting. Experiments across DRL agents and validation protocols show markedly lower false-negative rates.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages22

Reading Time55 min

Introduction

Security-asymmetric costs in ransomware detection

Proposed SA-DRL approach

SA-DRL: Security-Aware Deep Reinforcement Learning for Ransomware Detection with Asymmetric Reward Design Jannatul Ferdousa , Rafiqul Islamb and Md Zahidul Islamc,d a School of Computing, Mathematics and Engineering, Charles Sturt University, Wagga Wagga, NSW, 2650, Australia b School of Computing, Mathematics and Engineering, Charles Sturt University, Albury, NSW, 2640, Australia c School of Computing, Mathematics and Engineering, Charles Sturt University, Bathurst, NSW, 2795, Australia dAI and Cyber Futures Center, Charles Sturt University, Panorama Avenue, Bathurst, NSW, 2795, Australia arXiv :2607 .06880v 1 [ cs .CR] 8 Jul 2026 ARTICLE INFO Keywords: Ransomware detection Deep reinforcement learning Asymmetric reward design False-negative minimization Behavioral ransomware analysis DDQN AB STRACT Ransomware encrypts victim data in seconds; however, current machine learning detectors use symmetric loss functions that equally penalize missed detections, known as false negatives (FN), and benign false alarms, known as false positives (FP) . This assumption is misaligned with operational reality, where an FN causes irreversible data loss and high recovery costs, while an FP is reversible. Detection is further complicated by ransomware variants with diverse behaviors, reducing the effectiveness of fixed supervised weighting strategies. To address these challenges, this study proposesa Security-Aware Deep Reinforcement Learning (SA-DRL) framework that embeds FN–FP costasymmetry into the reinforcement learning reward signal, optimizing detection policies to minimize missed detections. The framework also introduces a Security-Optimal Model Selection (SOMS) criterion and an adaptive sample-weighting mechanism through episode-level random permutation. Four DRL agents, DQN, DDQN, PPO, and A2C, were trained using a symmetric baseline reward (􀁒1) and a security-aware asymmetric reward (􀁒2) that penalizes FNs more heavily. Each configuration was evaluated with four discount factors, five-fold cross-validation, and three random seeds, resulting in 480 training runs on a balanced dataset. The SOMS criterion prioritizes minimizing the false-negative rate (FNR), maximizing the F1-score, and minimizing training time. Results show that asymmetric reward shaping improves detection performance. The SOMS-selected configuration, DDQN with 􀁒2 and 􀀍 = 0 . 1, achieved an FNR of 0.0080, an F1-score of 0.9915, and an AUC of 0.998, reducing missed detections by 67.6% compared with the best baseline model, MLP with FNR = 0.0247. 􀁒2 reduced the mean FNR by 43% relative to 􀁒1 across all configurations. These findings highlight the importance of reward-function design in security-sensitive detection systems. SA-DRL is the first framework to combine runtime features, asymmetric reward design, and a security-first model-selection criterion with statistical validation for ransomware detection. 1. Introduction Ransomware has emerged as one of the most operationally destructive and economically consequential categories of malware in the modern threat landscape. Unlike conventional malware that silently exfiltrates data, ransomware weaponizes cryptographic extortion by encrypting victim files and demanding payment, typically in cryptocurrency, to restore access. The impact extends well beyond ransom payment alone. In 2025, the global average cost of ransomware recovery reached $1.53 million, including downtime, investigation, regulatory exposure, and reputational damage [4] . Ransomware was involved in 44% of all data breaches analyzed in the Verizon 2025 Data Breach Investigations Report, representing a 12-percentage-point increase over the previous year [47] . Furthermore, global ransomware damage costs are projected to exceed $57 billion annually in 2025 and surpass $275 billion by 2031, with attacks occurring approximately every two seconds [32] . Modern ransomware campaigns are increasingly operated through ransomware-as-a-service (RaaS)

FAQs

How were the proposed methods evaluated in the study?

Four DRL agents (DQN, DDQN, PPO, A2C) were trained using both a symmetric baseline reward and a security-aware asymmetric reward, then evaluated with multiple discount factors, five-fold cross-validation, three random seeds, and 480 training runs on a balanced dataset.

Jul 16, 2026

Upload by Sage