Cost-Aware Hierarchical Multi-Agent Ransomware Detection and Family Attribution
Researchers propose a hierarchical multi-agent system that cuts ransomware analysis cost by 44% while reaching 96.57% detection accuracy.
An arXiv paper (2609.04820) presents a Cost-Aware Hierarchical Multi-Agent System (HMAS) for adaptive ransomware detection and family attribution. Specialized agents run static analysis first, with dynamic and memory modalities invoked only when confidence is insufficient or specialists disagree; a Meta Orchestrator balances accuracy against computational cost via a cost model, and a locally deployed LLM verifies difficult cases. The system achieved 96.57% accuracy, 0.96 F1-score, and 0.99 ROC-AUC for binary detection, and 0.90 macro-F1 for multiclass family attribution. Average analysis cost dropped 43.97% versus exhaustive analysis, with 56.05% of cases resolved using static evidence alone.
- 56.05% of samples resolved with static analysis only; 4.33% required the full evidence pipeline.
- Family attribution reached 0.90 macro-F1 across ransomware families.
- Locally deployed LLM verifies hard cases without replacing the deterministic pipeline.
- Adaptive modality selection trades analysis depth for lower cost and latency.
- Malware
- ransomware
From the original article
1 min read at arxiv.orgRansomware detection and family attribution require analysis of different modalities because it can use packing, obfuscation, process manipulation and runtime evasion techniques. However, conventional multimodal usually uses all available modalities for every sample resulting in unnecessary computational cost and increased latency.
By Mubashar Iqbal · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.