arXiv：cs.AI· Salma Aboelmagd, Md. Rakibul Ahasan, Zhixin Pan, Abdulrahman Takiddin, Ziyu Shu·· 18 小时前
硬件辅助多阶段勒索软件检测：自适应机器学习框架结合 NAS 与对抗训练
Hardware-Assisted Multi-Stage Ransomware Detection with Adaptive Machine Learning
AI 导读
研究人员提出一种将软件层扫描与硬件级微处理器活动监控相耦合的勒索软件检测与缓解框架，利用对抗训练增强静态分析抗混淆能力，并借助硬件辅助监控实现实时检测。该框架还引入神经架构搜索（NAS）自动定制模型以提升泛化能力，实验显示其检测准确率显著提升、延迟降低，并提供可解释决策过程的 trace 级可解释性。
正文
Abstract:Ransomware is a fast-escalating privacy threat causing significant financial and data losses worldwide. As attacks grow more sophisticated, traditional static signatures and dynamic behavior analysis struggle to defend. In this paper, we propose an novel framework that couples software-level scanning with hardware-level microprocessor activity monitoring to achieve efficient ransomware detection and mitigation. The contributions are threefold: (1) we employ adversarial training to harden static analysis against obfuscation and leverage hardware-assisted monitoring for real-time detection; (2) we integrate neural architecture search (NAS) to automatically tailor models for stronger generalizability; and (3) We validate the proposed approach through extensive experiments, demonstrating substantially improved detection accuracy and reduced latency compared with existing methods. Moreover, it provides trace-level interpretability that explains the underlying decision process.
| Comments: | 12 pages, 14 figures |
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Machine Learning (cs.LG) |
| Cite as: | arXiv:2610.15951 [cs.CR] |
| (or arXiv:2610.15951v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2610.15951 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Zhixin Pan [view email]
[v1]
Sun, 11 Oct 2026 22:17:25 UTC (2,677 KB)
来源：arXiv：cs.AI · arxiv.org