AdaFedXplain: Adaptive Federated Learning with Explainable AI for Ransomware Detection
Authors: Md. Emran Biswas, Md. Delowar Hossain, Mst. Tanbin Yasmin Tanny, Muhammad Aminur Rahaman, Md Al Amin, Tangina Sultana
Organizations: Department of Electronics and Communication Engineering · Department of Computer Science and Engineering, Hajee Mohammad Danesh Science & Technology University, Bangladesh · Department of Data Science and Engineering, Bangladesh University of Business and Technology, Bangladesh · Department of Computer Science, Colorado State University, Fort Collins, USA
Attacks using ransomware have developed into complex multiphase campaigns that target vital infrastructure, resulting in annual damages of billions of dollars. Conventional detection techniques are ineffective against zero-day variations, and privacy issues are raised by centralized machine learning algorithms. Federated learning allows for cooperative model training without data sharing, however current FL approaches suffer from explainability issues, high communication cost, and non-IID data heterogeneity. In this study, we present AdaFedXplain, an explainable AI-based adaptive federated learning system for ransomware detection. Our approach includes progressive XGBoost complexity to avoid overfitting, a decaying learning rate schedule for stable convergence, and dynamic client grading based on ransomware prevalence and data sufficiency. Using 62,485 real-world ransomware samples from four OS-based non-IID clients, we compare AdaFedXplain against FedAvg, FedProx, and SCAFFOLD. According to experimental data, AdaFedXplain outperforms all baselines with 99.59% detection accuracy and 99.64% F1-score while cutting energy usage by 75%, latency by 65%, and communication overhead by 75%. The ablation investigation demonstrates that every element enhances performance. Security analysts can use SHAP explainability to identify important PE header characteristics that influence detection decisions. Our system provides a collaborative ransomware detection solution that is efficient and interpretable, while reducing privacy risks through federated learnings data-local training paradigm.
Figures & tables
Figure 1: Methodology workflow for ransomware detection
FL Setting
Accuracy (%)
Precision (%)
F1-Score (%)
FedAvg [ 11 ]
99.58
99.52
99.63
FedProx [ 19 ]
99.58
99.52
99.63
SCAFFOLD [ 9 ]
99.58
99.52
99.63
AdaFedXplain (Proposed)
99.59
99.52
99.64
Table 1: Global XGBoost performance comparison
Client
OS Version
FedAvg (%)
FedProx (%)
SCAFFOLD (%)
AdaFedXplain (%)
Client 0
Windows NT/2000
99.47
99.48
98.52
99.53
Client 1
Windows XP/2003
99.37
99.46
98.41
99.50
Client 2
Windows Vista/7
99.46
99.47
98.31
99.56
Client 3
Windows 10/11
99.48
99.49
98.31
99.52
Table 2: Per-client XGBoost F1-score comparison
FL Setting
Accuracy (%)
F1-Score (%)
p-value (vs Proposed)
FedAvg
99.58 ± 0.02
99.63 ± 0.02
0.00018
FedProx
99.58 ± 0.02
99.63 ± 0.02
0.00018
SCAFFOLD
99.58 ± 0.03
99.63 ± 0.03
0.00018
AdaFedXplain (Proposed)
99.60 ± 0.01
99.65 ± 0.01
–
Table 3: Statistical significance test results (mean ± std over 5 independent runs, 20 communication rounds).
FL Setting
Comm (MB)
Latency (s)
Energy (J)
FedAvg [ 11 ]
80.00
4.00
40.00
FedProx [ 19 ]
80.00
4.40
40.00
SCAFFOLD [ 9 ]
80.00
4.80
40.00
AdaFedXplain
20.00
1.40
10.00
Reduction
75%
65-71%
75%
Table 4: FL efficiency metrics comparison
Figure 6
Figure 6: SHAP summary plot showing feature importance and directional impact on model predictions.
Figure 7: Confusion matrix - XGBoost
Variant
Acc (%)
Prec (%)
Rec (%)
F1 (%)
Improvement
Full AdaFedXplain
99.60
99.56
99.73
99.65
–
Without Adaptive Selection
99.55
99.53
99.67
99.60
+0.05%
Without Decaying LR
99.55
99.53
99.67
99.60
+0.05%
Without Progressive Complexity
99.55
99.53
99.67
99.60
+0.05%
Table 5: Ablation study results for AdaFedXplain components
With recent developments in Artificial Intelligence (AI), the adoption of distributed learning paradigms such as Federated Learning (FL) has emerged. In simple terms, FL enables multiple entities to collaboratively train AI models without sharing local data. The FL paradigm is particularly valuable in privacy-sensitive settings, such as financial services, because it enables institutions to collaboratively improve fraud-detection models while keeping sensitive transaction data local. However, FL schemes are prone to security vulnerabilities, where malicious clients can poison local data or model updates and degrade the global model, and hence the performance of the resulting model might be affected. Therefore, in this work, we propose Enhanced Detective, a dual-stage robust aggregation strategy that combines Median Absolute Deviation (MAD), distance-based update filtering, and FedMedian aggregation. Experiments on an imbalanced credit card dataset evaluate targeted label-flipping and weight-scaling attacks over 50 communication rounds. With 40% malicious clients, Enhanced Detective achieves an AUPRC of 0.796 and a Recall of 0.847.
Maria-Ioana-Andrea Ivan, Orhan Ermis, Ruxandra F. Olimid
Department of Computer Science, University of Bucharest · Luxembourg Institute of Science and Technology (LIST), Luxembourg · Research Institute of the University of Bucharest (ICUB), Bucharest, Romania
Financial fraud detection relies heavily on centralized machine learning models. This creates serious data privacy risks. Federated Learning (FL) decentralizes data processing, but financial regulations still require models to be transparent. This means using Explainable AI (XAI) tools such as TreeSHAP. Recent cybersecurity research shows a problem with this approach. Sharing high-fidelity SHAP explanations exposes the federated network to Membership Inference Attacks (MIAs). This dissertation proposes and evaluates DP-FedSHAP. It is a new architecture that applies client-level differential privacy only to post-hoc TreeSHAP vectors. It is compared against a Weight-Level DP baseline, which perturbs the trained model directly instead. Using the highly imbalanced IEEE-CIS Fraud Detection dataset, this study measures the trade-off between explanation fidelity, privacy preservation, and the model's Area Under the Precision-Recall Curve (AUPRC).
Muhammad Waleed Gul, Elaheh Homayounvala
MSc Artificial Intelligence London Metropolitan University London, United Kingdom · School of Computing and Digital Media London Metropolitan University London, United Kingdom
Ransomware is a fast-escalating privacy threat causing significant financial and data losses worldwide. As attacks grow more sophisticated, traditional static signatures and dynamic behavior analysis struggle to defend. In this paper, we propose an novel framework that couples software-level scanning with hardware-level microprocessor activity monitoring to achieve efficient ransomware detection and mitigation. The contributions are threefold: (1) we employ adversarial training to harden static analysis against obfuscation and leverage hardware-assisted monitoring for real-time detection; (2) we integrate neural architecture search (NAS) to automatically tailor models for stronger generalizability; and (3) We validate the proposed approach through extensive experiments, demonstrating substantially improved detection accuracy and reduced latency compared with existing methods. Moreover, it provides trace-level interpretability that explains the underlying decision process.
Salma Aboelmagd, Md. Rakibul Ahasan, Zhixin Pan +2
Florida State University, Tallahassee, FL, USA · Stony Brook University, Stony Brook, NY, USA