Interpretable Ransomware Detection Using Hybrid Large Language Models: A Comparative Analysis of BERT, RoBERTa, and DeBERTa Through LIME and SHAP

Explainability is essential for cybersecurity AI: The study demonstrates that using interpretability techniques (LIME and SHAP) to explain how AI models detect ransomware is critical in high-stakes security decisions, allowing security teams to understand why a threat was flagged rather than just accepting a "black box" prediction.

Different AI models focus on different warning signs: The three models analyzed showed distinct detection strategies—BERT prioritized file operations, RoBERTa balanced network and financial signals, and DeBERTa focused on financial and network traffic. This finding suggests that responsible AI deployment should involve understanding model-specific strengths rather than assuming all AI systems work the same way.

Creative data transformation enables broader AI application: By converting numerical cybersecurity data into text sequences, researchers successfully adapted language models (originally designed for reading and writing) to detect ransomware patterns. This demonstrates how responsible innovation can repurpose existing AI tools for new domains, though it requires careful validation that the transformation doesn't introduce bias or misinterpretation.

Model transparency reveals potential blind spots: The visualization of how different models represent information internally (embedding patterns) showed meaningful differences—some models created more balanced representations while others developed highly specialized patterns. For responsible deployment, security teams should be aware that their chosen model may be systematically better or worse at detecting certain types of threats.