An optimized latent-space classifier with Banzhaf-inspired probabilistic feature selection for ransomware detection in IoT edge environments

The increasing adoption of edge computing in Internet of Things (IoT) and Cyber-Physical Systems (CPS) environments has made these systems prime targets for ransomware attacks, as sensitive data is often processed at the edge. However, resource constraints of IoT nodes make traditional ransomware detection solutions unsuitable for real-time, on-device deployment. This paper presents a novel lightweight ransomware detection framework for IoT edge devices using an Optimized Latent Space Classifier (OLSC) enhanced with a Random Forest–Preference-Weighted Probabilistic Banzhaf Power Index (RF–PBPI) feature-selection method, which retains only the most influential features through probabilistic influence estimation under distribution-aware perturbations and negligible-influence (dummy)-feature pruning. Through the integration of quantization and pruning techniques, the proposed OLSC model achieves a compressed size of 18.754 KB. The model achieves an inference time of 0.941 ms and a power consumption of 0.14883 W at inference. The model is tested across three different datasets, demonstrating its robustness across diverse network scenarios. Compared to conventional CNN and DNN approaches, the framework offers significantly faster inference and lower energy usage, making it ideal for low-power devices such as the ESP32. This work delivers an efficient, real-time, and generalisable solution for ransomware detection at the IoT edge, combining high accuracy with minimal resource usage.