arXiv cs.AI· Salma Aboelmagd, Md. Rakibul Ahasan, Zhixin Pan, Abdulrahman Takiddin, Ziyu Shu·· 3 天前AI 评分22
硬件辅助多阶段勒索软件检测：结合自适应机器学习
Hardware-Assisted Multi-Stage Ransomware Detection with Adaptive Machine Learning
AI 导读
研究者提出一种将软件层扫描与硬件层微处理器活动监控相结合的多阶段勒索软件检测框架，通过对抗训练强化静态分析抗混淆能力，并借助硬件辅助监控实现实时检测。该框架还引入神经架构搜索（NAS）自动定制模型以提升泛化性，实验显示检测精度显著提升、延迟降低，并提供可解释决策过程的追踪级可解释性。
正文 · 原文
Abstract:Ransomware is a fast-escalating privacy threat causing significant financial and data losses worldwide. As attacks grow more sophisticated, traditional static signatures and dynamic behavior analysis struggle to defend. In this paper, we propose an novel framework that couples software-level scanning with hardware-level microprocessor activity monitoring to achieve efficient ransomware detection and mitigation. The contributions are threefold: (1) we employ adversarial training to harden static analysis against obfuscation and leverage hardware-assisted monitoring for real-time detection; (2) we integrate neural architecture search (NAS) to automatically tailor models for stronger generalizability; and (3) We validate the proposed approach through extensive experiments, demonstrating substantially improved detection accuracy and reduced latency compared with existing methods. Moreover, it provides trace-level interpretability that explains the underlying decision process.
| Comments: | 12 pages, 14 figures |
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Machine Learning (cs.LG) |
| Cite as: | arXiv:2610.15951 [cs.CR] |
| (or arXiv:2610.15951v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2610.15951 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Zhixin Pan [view email]
[v1]
Sun, 11 Oct 2026 22:17:25 UTC (2,677 KB)
来源：arXiv cs.AI · arxiv.org