Transformer-Based Ransomware Detection Framework: A Lightweight Approach

The increasing number of ransomware attacks, with their complex, multi-stage covert operations, creates significant challenges for traditional cybersecurity systems. Conventional detection methods, relying on static signatures and rule-based techniques, become less effective in identifying new ransomware variants that evolve dynamically. Transformer-based models' significant computational requirements pose major challenges for real-world deployment, particularly when operating in resourceconstrained environments, despite their excellent capabilities in sequential pattern recognition. This research presents a lightweight Transformer Encoder-based detection framework that specialises in identifying ransomware behaviour. The proposed model enhances computational efficiency by streamlining the Transformer Encoder, eliminating the Decoder module and simplifying internal components-such as downsizing hidden layers and minimizing multi-head attention complexitywhile preserving effective detection capabilities. Experimental findings indicate that the optimized Transformer model attains a detection accuracy of $\mathbf{9 1 \%}$, a recall of $\mathbf{9 2 \%}$, and an F1 score of $\mathbf{0. 8 9}$. Moreover, the inference latency has been decreased to 9.2 ms per sample, signifying a 60 % enhancement in speed relative to the fullscale Transformer. Comparative trials validate the framework's superiority over Support Vector Machine (SVM), Long ShortTerm Memory (LSTM), and other conventional baselines in efficiently recognizing ransomware behaviors.