WiP Paper: Decentralised TinyML-Based Ransomware Containment for Resource-Constrained IIoT Networks

Ransomware is emerging as a real threat to Industrial Internet of Things (IIoT) networks, where resource-constrained devices cannot run traditional endpoint protections. Such ransomware spreads silently through normal data-plane traffic before activating, and once infection reaches network scale, recovery costs become prohibitive, making containment during propagation essential. Existing intrusion response systems rely on centralised controllers whose multi-hop command latency is unable to keep pace, while decentralised execution must cope with imperfect on-device detection and purely local observations. We present Decentralised Containment System (DConS), a light-weight intrusion response system in which each IIoT node autonomously contains ransomware through on-device TinyML inference using only local and one-hop neighbour observations. Experimental results show that DConS can contain propagation, even when detector’s true-positive rate drops to 0.70, and when propagation outpaces the response cycle, while restoring up to 65% of the connectivity disrupted by containment. The entire system fits within ∼7.2 KB Flash and ∼470 B RAM, demonstrating the feasibility of our proposed solution.