Detecting ransomware using deep learning and hardware performance counters

Abstract

Ransomware has emerged as a significant cybersecurity threat, inflicting severe consequences including data loss, operational paralysis, reputational damage, and financial devastation. With global ransomware damages projected to reach $265 billion annually by 2031, organisations and individuals alike face increasingly sophisticated attacks that can cripple critical infrastructure and compromise sensitive information.

Traditional detection approaches using static and dynamic analysis face limitations including ineffectiveness against zero-day attacks, high system overheads, and evasion techniques employed by modern ransomware. This project proposes an innovative approach for ransomware detection utilising Hardware Performance Counters (HPCs) and deep learning techniques.

This project first analyses the limitations of existing ransomware detection methods to establish the case for hardware-based detection. Multiple deep learning architectures including Convolutional Neural Networks (CNN), hybrid CNN-RNN, Long Short-Term Memory (LSTM) networks, and Transformers are then developed and evaluated to process temporal and sequential HPC data. Furthermore, Neural Architecture Search (NAS) is applied to optimise these architectures, significantly enhancing detection accuracy while reducing model complexity.

Extensive evaluations reveal that the NAS-optimised models achieve up to 99.14% accuracy, outperforming state-of-the-art frameworks including HiPeR (98.68%) and DeepWare (98.6%). The NAS-LSTM model emerges as the most efficient solution, achieving superior performance with only 16,769 parameters.

This approach enables effective ransomware detection during the critical pre-encryption phase while maintaining minimal system overhead. The findings demonstrate that microarchitectural events captured by HPCs when analysed through optimised deep learning models, provide an effective method for ransomware detection that overcomes many limitations of traditional approaches.