用对比学习+自动模型搜索，实现快速自适应勒索软件检测
Towards Low-Latency and Adaptive Ransomware Detection Using Contrastive Learning
- 结合硬件性能计数器与对比学习，分析勒索软件运行行为
- 检测准确率提升16.1%，响应速度加快6倍，早于攻击阶段发现威胁
- 自动构建适配新变种的模型结构，适合防御快速演化的勒索软件
勒索软件因快速演化、需早期检测及多样性强，已成为网络安全重大威胁，传统方法面临特征依赖性强、响应延迟高、对未知变种适应性差三大挑战。本文提出融合自监督对比学习与神经架构搜索（NAS）的框架，解决上述问题。首先，设计基于硬件性能计数器（HPC）的对比学习机制，捕捉目标勒索软件的运行时行为；其次，引入定制化损失函数，促进恶意活动的早期识别，显著降低检测延迟；最后，部署NAS框架自动构建可适应未知勒索软件变种的模型结构。实验表明，本方法在检测准确率上最高提升16.1%，响应时间最快达6倍加速，且在逃避攻击下仍保持鲁棒性。
原文摘要 · Abstract (English)
Ransomware has become a critical threat to cybersecurity due to its rapid evolution, the necessity for early detection, and growing diversity, posing significant challenges to traditional detection methods. While AI-based approaches had been proposed by prior works to assist ransomware detection, existing methods suffer from three major limitations, ad-hoc feature dependencies, delayed response, and limited adaptability to unseen variants. In this paper, we propose a framework that integrates self-supervised contrastive learning with neural architecture search (NAS) to address these challenges. Specifically, this paper offers three important contributions. (1) We design a contrastive learning framework that incorporates hardware performance counters (HPC) to analyze the runtime behavior of target ransomware. (2) We introduce a customized loss function that encourages early-stage detection of malicious activity, and significantly reduces the detection latency. (3) We deploy a neural architecture search (NAS) framework to automatically construct adaptive model architectures, allowing the detector to flexibly align with unseen ransomware variants. Experimental results show that our proposed method achieves significant improvements in both detection accuracy (up to 16.1%) and response time (up to 6x) compared to existing approaches while maintaining robustness under evasive attacks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。