## 2 2 2  
The internet of things (IoT) can be described as the increasing number of physical devices connected to the internet. Embedded with sensor nodes and software that can collect and share data online, IoT gadgets are invaluable in improving productivity and enhancing a massive number of processes throughout industries [1]. Inappropriately, the nature of IoT gadgets' connectivity paves the way for malicious performers to take full advantage, especially because of the top ten vulnerabilities that make IoT gadgetsinsecure [2]. To achieve the scalability objective of the network, research workers in the past established several clustering methods. In a clustered network, every cluster can be assigned a gateway that sends packets to and from the base station (BS), considering that a cellular structure can be utilized for providing internet access to IoT nodes [3]. A node with good resources can be selected as a gateway. Compromising or capturing the gateway will affect every node in the cluster, and, thus, gateway security assaults should be protected against attacks [4]. Invaders usually encode victims' data with their keys, and they decode the data or return the key only after the victims fulfill or pay their demands [5]. Previously, ransomware would simply disrupt the services and make the data inaccessible to the victim; until now, they were safely saved only on their system [6]. Now, data can also be stolen by attackers, and they threaten the victim to pay money. Additionally, it is not certain that the data can be retrieved when the ransom is paid or if the attackers leak the stolen data. Ransomware is irreversible and tedious to stop, unlike other security issues. The approach of this malware depends on access limitations to user files via encryption and demands a ransom to attain the decryption key. An invader usually shows a ransom note after encoding the data of the victim, which generally indicates that the attack was executed; then, the invader demands money [7]. The attacker mentions the steps for making a payment with the ransom note that they offered. Ransomware attacks could cause trouble to the distributed IoT atmosphere and halt smooth work amongst heterogeneous data centers. Such mechanisms contain complicated structures of methods and corpora. Environments that are data centers have a huge magnitude of data and could pay money for avoiding damage to their reputation and exploitation of their data [8]. In the literature, three different studies are performed for ransomware detection: hybrid, static, and dynamic. Each analysis technique has pros and cons [9]. Dynamic analysis provides higher accuracy in detection through the execution of the samples. Deep learning (DL) and machine learning (ML) have effects on all aspects of life. Such technology has several applications in each domain because of its capability for decision making. Advanced assault and threat detection is easier and occurs in less time, because of the use of such effective technologies. DL is considered the optimal method for detecting the paradigms of an undergoing system [10]. ML and DL technologies have received considerable attention and are massively utilized in the advanced research of cybersecurity. ML technologies are utilized in the domain of ransomware detection, such as logistic regression (LR), random forest (RF), k-nearest neighbor (KNN), naive Bayes (NB), and neural networks (NNs). In addition, DL models, such as deep neural networks (DNNs) and the deep autoencoder (AE), are also used for ransomware detection. Though several ransomware detection models are available in the literature, there is still a need to develop automated ransomware detection tools for enhanced performance. At the same time, the trial-and-error parameter-tuning process is difficult and erroneous. Therefore, a metaheuristics-based parameter-tuning process is essential. This study presents a new model of dwarf mongoose optimization with machine-learning-driven ransomware detection (DWOML-RWD).