Towards Low-Latency and Adaptive Ransomware Detection Using Contrastive Learning

TL;DR

The paper tackles the need for fast, robust ransomware detection amid evolving threats. It presents a framework that fuses hardware-assisted runtime traces, self-supervised contrastive learning, and neural architecture search to achieve low latency and high adaptability, including a latency-aware training objective and a rollback mechanism for real-time mitigation. Key contributions include hardware-assisted data collection with ETBs, a contrastive upstream encoder trained with L_pair, L_cluster, and L_latency losses, and a NAS-guided downstream classifier, all operating in a real-time loop. Experimental results show substantial gains in detection accuracy and latency reduction, with strong robustness to evasive techniques and manageable overhead, enabling practical endpoint deployment.

Abstract

Ransomware has become a critical threat to cybersecurity due to its rapid evolution, the necessity for early detection, and growing diversity, posing significant challenges to traditional detection methods. While AI-based approaches had been proposed by prior works to assist ransomware detection, existing methods suffer from three major limitations, ad-hoc feature dependencies, delayed response, and limited adaptability to unseen variants. In this paper, we propose a framework that integrates self-supervised contrastive learning with neural architecture search (NAS) to address these challenges. Specifically, this paper offers three important contributions. (1) We design a contrastive learning framework that incorporates hardware performance counters (HPC) to analyze the runtime behavior of target ransomware. (2) We introduce a customized loss function that encourages early-stage detection of malicious activity, and significantly reduces the detection latency. (3) We deploy a neural architecture search (NAS) framework to automatically construct adaptive model architectures, allowing the detector to flexibly align with unseen ransomware variants. Experimental results show that our proposed method achieves significant improvements in both detection accuracy (up to 16.1%) and response time (up to 6x) compared to existing approaches while maintaining robustness under evasive attacks.

Figures (9)

• Figure 1: Illustration of a typical ransomware infection workflow. The attack begins with a stealthy initialization phase for registering for persistence and encryption algorithm loading, followed by the infection phase with data encryption and extortion message displaying.
• Figure 2: Illustration of contrastive learning. Given an anchor input $x^a$, a positive example $x^+$ is generated through data augmentation, while a negative example $x^-$ is selected from a different class. The model learns a feature representation such that the distance $\delta(x^a, x^+)$ is minimized, while the distance $\delta(x^a, x^-)$ is maximized.
• Figure 3: Overview of the proposed ransomware detection framework. The system consists of four major components: (1) Hardware-assisted data collection uses Embedded Trace Buffers (ETBs) to capture fine-grained, real-time execution traces; (2) Contrastive learning-based upstream encoder processes windowed trace sequences to extract hidden features, followed by a distance measuring step. The learning process adopts a latency-aware loss promoting early detection; (3) The NAS-guided downstream classifier dynamically adapts architecture for improved generalizability, and (4) The detection and rollback module monitors runtime behavior and performs data recovery upon detection.
• Figure 4: Illustration of the hardware-assisted trace windowing process. Execution traces collected via Embedded Trace Buffers (ETBs) are organized as a matrix, where rows correspond to different buffer slots and columns represent clock cycles. The trace stream is segmented into fixed-size sliding windows, each representing a short temporal sequence $x_i$. These windows are then fed sequentially into a recurrent neural network (RNN), which encodes each input window into a corresponding hidden representation $h_i$.
• Figure 5: Illustration of the DTW algorithm (Image Credit: muller2021fundamentals). The optimal path with minimum cumulative distance is shown in the right panel of the figure, illustrating how the result was obtained through the DP recurrence. Accordingly, each of the red bidirectional arrows in the left panel encodes the local correspondence between elements guided by the optimal path.