Hardware-Assisted Multi-Stage Ransomware Detection with Adaptive Machine Learning

Salma Aboelmagd; Md. Rakibul Ahasan; Zhixin Pan; Abdulrahman Takiddin; Ziyu Shu

cs.CROct 11, 2026

Hardware-Assisted Multi-Stage Ransomware Detection with Adaptive Machine Learning

Authors: Salma Aboelmagd, Md. Rakibul Ahasan, Zhixin Pan, Abdulrahman Takiddin, Ziyu Shu

Organizations: Florida State University, Tallahassee, FL, USA · Stony Brook University, Stony Brook, NY, USA

Abstract

Ransomware is a fast-escalating privacy threat causing significant financial and data losses worldwide. As attacks grow more sophisticated, traditional static signatures and dynamic behavior analysis struggle to defend. In this paper, we propose an novel framework that couples software-level scanning with hardware-level microprocessor activity monitoring to achieve efficient ransomware detection and mitigation. The contributions are threefold: (1) we employ adversarial training to harden static analysis against obfuscation and leverage hardware-assisted monitoring for real-time detection; (2) we integrate neural architecture search (NAS) to automatically tailor models for stronger generalizability; and (3) We validate the proposed approach through extensive experiments, demonstrating substantially improved detection accuracy and reduced latency compared with existing methods. Moreover, it provides trace-level interpretability that explains the underlying decision process.

Figures & tables

Fig. 1: Typical ransomware infection workflow consisting of two major phases.

Fig. 2: Detection accuracy of various methods against four ransomware variants.

Fig. 3: State transitions of proposed framework.

Fig. 4: Workflow of adversarial‐training–enhanced static analysis. We synthesize adversarial Samples to emulate evasive/poisoned conditions. The adversarial set is combined with the clean dataset for adversarial Training, yielding augmented models . A lightweight boosting step integrates all models together, thereby improving the overall robustness.

Fig. 5: Comparison of HPC events between the benign program and WannaCry. a) branch misses, b) cache misses.

Fig. 6: Adaptive monitoring workflow combining HPC and ETB. An LSTM model is applied to classify the sequential hardware traces.

Fig. 7: The proposed NAS process: Starting from an over-parameterized supernet, candidate sub-architectures are sampled and evaluated with the composite loss. Then the components (cells) associated with higher loss contributions are pruned (shown faded), the process continues until a compact final model is obtained.

Category	Example Families
Crypto-Ransomware	WannaCry, Locky, Ryuk, Maze, Petya
Locker Ransomware	Reveton, WinLock
Scareware/FakeAV	FakeAV, Rogue AV variants
Misc./Hybrid	DoppelPaymer, BlackCat, Phobos

TABLE I: Ransomware categories and representative families.

Category	DRL				Ratafia				Rwarmor				Proposed
	Acc	Prec	Rec	F-1	Acc	Prec	Rec	F-1	Acc	Prec	Rec	F-1	Acc	Prec	Rec	F-1	Improv(%)
Crypto	85.2	82.1	86.4	0.87	88.9	87.5	89.2	0.92	81.3	78.6	82.5	0.88	93.8	94.5	93.2	0.96	8.7
Locker	76.5	74.2	77.8	0.82	80.2	81.0	79.6	0.88	74.9	73.4	75.5	0.84	91.7	92.1	91.4	0.95	11.5
Scareware	72.1	70.8	73.2	0.80	79.4	80.2	78.6	0.86	70.8	71.0	70.6	0.82	89.9	90.3	89.6	0.94	12.3
Hybrid/Misc	79.6	77.1	80.5	0.84	84.3	85.0	83.7	0.90	77.5	76.9	77.8	0.86	92.3	92.9	91.8	0.95	10.9
Average	78.4	76.0	79.5	0.83	83.2	83.4	82.8	0.89	76.1	75.0	76.6	0.85	91.9	92.5	91.5	0.95	10.8

TABLE II: Detection performance across ransomware categories.

Category	DRL		Ratafia		Rwarmor		Proposed		Improvement (Proposed $-$ Baseline)
	Clean	Adv	Clean	Adv	Clean	Adv	Clean	Adv	vs DRL	vs Ratafia	vs Rwarmor
Crypto	85.2	65.3	88.9	74.2	81.3	70.5	93.8	89.6	+24.3	+15.4	+19.1
Locker	76.5	58.4	80.2	68.7	74.9	63.8	91.7	87.9	+29.5	+19.2	+24.1
Scareware/FAV	72.1	52.0	79.4	66.5	70.8	59.7	89.9	85.7	+33.7	+19.2	+26.0
Hybrid/Misc	79.6	62.7	84.3	73.1	77.5	66.9	92.3	88.1	+25.4	+15.0	+21.2
Average	78.4	59.6	83.2	70.6	76.1	65.2	91.9	87.8	+28.2	+17.2	+22.6

TABLE III: Robustness to adversarial obfuscation, with improvements of the proposed method over baselines.

Fig. 8: The detection accuracy against adversarial strategies.

Fig. 9: Detection latency of six ransomware samples under sliding-window dynamic analysis with HPC and ETB.

Methods	DRL	Ratafia	Rwarmor	Proposed	Improv
Delay(ms)	49984	13480	29670	2784	4.8x

TABLE IV: The comparison of detection latency.

Panel of Figure 14 — Fig. 10: Risk and uncertainty traces aligned with the six detection processes in Fig. 9 .

Category	HPC-only Acc	HPC-only Lat.	ETB-only Acc	ETB-only Lat.	Adaptive Acc	Adaptive Lat.	Acc gain (pp)	Latency gap
Crypto	74.6	5600	90.8	2680	89.1	3900	14.5	1220
Locker	65.8	6200	88.9	2850	87.4	4200	21.6	1350
Scareware/FAV	68.9	6400	87.2	3000	86.3	4500	17.4	1500
Hybrid/Misc	73.7	5800	91.5	2600	90.4	4000	16.7	1400
Average	70.8	6000	89.6	2784	88.3	4150	17.5	1367.5

TABLE V: Ablation of dynamic monitoring strategies: adversarial detection accuracy and detection latency (ms) by category.

Fig. 11: The scatter plot of selected HPC values for various benchmarks.

Fig. 12: A simplified demonstration of our LSTM model generated from our neural architecture search (NAS) algorithm.

Panel of Figure 18 — Fig. 13: SHAP waterfalls for two representative samples. Bars show per-feature contributions on the logit scale; the sum plus the base value gives $f(x)$ , compared against the zero boundary.

Panel of Figure 19 — Fig. 14: LIME-based local explanations on the runtime trace matrix. Panel (a) ranks time windows (when); panel (b) ranks channels (where). Coefficients are from a local linear surrogate fit to detector scores under small perturbations.

Phase	Component	Avg. time	Worst-case
Offline	Static model training (DT)	2.1 h	–
	Dynamic model training (LSTM)	12.6 h	–
	Neural architecture search (NAS)	5.2 h	–
Online	HPC monitoring	0.6 ms	0.8 ms
	ETB tracing	2.9 ms	3.5 ms
	Decision & aggregation	0.2 ms	0.3 ms

TABLE VI: Cost breakdown of the proposed framework. Offline costs are one-time expenses for training and NAS, while online overheads are measured per monitoring window.

Malware Detection

Malware detection uses static and behavioral evidence to identify malicious software and protect devices, networks, and software ecosystems.

See all 57 papers

RansomTrack: A Hybrid Behavioral Analysis Framework for Ransomware Detection
Apr 9, 2026Busra Caliskan, Ibrahim Gulatas, H. Hakan Kilinc +1Malware Detection Malware Analysis
Department of Computer Engineering, Istanbul Technical University, Istanbul, Türkiye · Department of Research and Development, Orion Innovation, Istanbul, Türkiye · Department of Research and Development, Turkish Naval Forces, Istanbul, Türkiye
Agentic SABRE: An Uncertainty-Aware Neuro-Symbolic Multi-Agent Framework for Adaptive Ransomware Detection
Jul 5, 2026Henry Kabuye, Biju Issac, Jeyamohan NeeraMalware Classification Neuro-Symbolic AI
School of Computer Science, Northumbria University, Newcastle Upon Tyne, UK
AdaFedXplain: Adaptive Federated Learning with Explainable AI for Ransomware Detection
Oct 18, 2026Md. Emran Biswas, Md. Delowar Hossain, Mst. Tanbin Yasmin Tanny +3Malware Detection Federated Learning
Department of Electronics and Communication Engineering · Department of Computer Science and Engineering, Hajee Mohammad Danesh Science & Technology University, Bangladesh · Department of Data Science and Engineering, Bangladesh University of Business and Technology, Bangladesh +1

Apr 9, 2026J/K move · Enter open · S save

RansomTrack: A Hybrid Behavioral Analysis Framework for Ransomware Detection

Busra Caliskan, Ibrahim Gulatas, H. Hakan Kilinc, A. Halim Zaim

Department of Computer Engineering, Istanbul Technical University, Istanbul, Türkiye · Department of Research and Development, Orion Innovation, Istanbul, Türkiye · Department of Research and Development, Turkish Naval Forces, Istanbul, Türkiye

Malware Detection Malware Analysis

Open paper AskPDF arXiv

Ransomware poses a serious and fast-acting threat to critical systems, often encrypting files within seconds of execution. Research indicates that ransomware is the most reported cybercrime in terms of financial damage, highlighting the urgent need for early-stage detection before encryption is complete. In this paper, we present RansomTrack, a hybrid behavioral analysis framework to eliminate the limitations of using static and dynamic detection methods separately. Static features are extracted using the Radare2 sandbox, while dynamic behaviors such as memory protection changes, mutex creation, registry access and network activity are obtained using the Frida toolkit. Our dataset of 165 different ransomware and benign software families is publicly released, offering the highest family-to-sample ratio known in the literature. Experimental evaluation using machine learning models shows that ensemble classifiers such as XGBoost and Soft Voting achieve up to 96% accuracy and a ROC-AUC score of 0.99. Each sample analyzed in 9.1 seconds includes modular behavioral logging, runtime instrumentation, and SHAP-based interpretability to highlight the most influential features. Additionally, RansomTrack framework is able to detect ransomware under 9.2 seconds. Overall, RansomTrack offers a scalable, low-latency, and explainable solution for real-time ransomware detection.

Abstract

Malware Detection

Explore similar work

RansomTrack: A Hybrid Behavioral Analysis Framework for Ransomware Detection

Agentic SABRE: An Uncertainty-Aware Neuro-Symbolic Multi-Agent Framework for Adaptive Ransomware Detection

AdaFedXplain: Adaptive Federated Learning with Explainable AI for Ransomware Detection