1. Bibliographic Information

1.1. Title

Towards Low-Latency and Adaptive Ransomware Detection Using Contrastive Learning

1.2. Authors

• Zhixin Pan (College of Engineering, Florida State University, Tallahassee, USA)
• Ziyu Shu (Department of Radiation Oncology, Stony Brook University, Stony Brook, USA)
• Amberbir Alemayoh (College of Engineering, Florida State University, Tallahassee, USA)

1.3. Journal/Conference

The paper is published at arXiv (https://arxiv.org/abs/2510.21957v1), which is a preprint server. This means the paper has been made publicly available but has not necessarily undergone formal peer review or been accepted by a specific journal or conference. arXiv is a reputable platform for sharing early research findings in various scientific and technical fields.

1.4. Publication Year

2025 (Published at UTC: 2025-10-24T18:33:52.000Z, implying a 2025 publication year).

1.5. Abstract

Ransomware poses a significant cybersecurity threat due to its rapid evolution, the urgent need for early detection, and increasing diversity, which overwhelms traditional detection methods. While prior AI-based approaches have been proposed, they suffer from three key limitations: reliance on ad-hoc features, delayed response times, and limited adaptability to new ransomware variants. This paper introduces a novel framework that combines self-supervised contrastive learning with neural architecture search (NAS) to address these issues. The framework contributes in three major ways: (1) it employs a contrastive learning model that utilizes hardware performance counters (HPC) for automated runtime behavior analysis of ransomware, eliminating ad-hoc feature dependencies; (2) it integrates a customized loss function to encourage early-stage detection, thereby significantly reducing detection latency; and (3) it leverages a NAS framework to automatically build adaptive model architectures capable of aligning with unseen ransomware variants. Experimental results demonstrate that the proposed method achieves substantial improvements in detection accuracy (up to 16.1%) and response time (up to 6x) compared to existing approaches, while also maintaining strong robustness against evasive attacks.

1.6. Original Source Link

Official Source Link: https://arxiv.org/abs/2510.21957v1 PDF Link: https://arxiv.org/pdf/2510.21957v1.pdf Publication Status: Preprint on arXiv.

2. Executive Summary

2.1. Background & Motivation

The core problem addressed by this paper is the escalating threat of ransomware in cybersecurity. Ransomware, which encrypts files and demands payment for decryption, has caused damages exceeding $6 trillion annually, underscoring an urgent need for effective defense mechanisms.

This problem is particularly critical due to several characteristics of ransomware:

• Stealth and Urgency: Ransomware often begins with a stealthy initialization phase that mimics benign programs, making early detection difficult. Once it enters the infection phase, encryption can occur within milliseconds, causing irreversible damage even if detected and terminated later. This necessitates extremely low-latency detection.

• Rapid Evolution and Diversity: Modern ransomware constantly evolves through obfuscation, code morphing, and logic camouflage, producing sophisticated variants that can bypass traditional signature-based detectors.

  Existing detection methods, both traditional and AI-based, face significant challenges:

• Traditional Methods (Static/Dynamic): Static analysis is efficient but vulnerable to evasive attacks. Dynamic analysis provides richer context but often suffers from detection latency, which is unacceptable for ransomware.

• AI-based Approaches: While promising, they have three major limitations:

  1. Ad-hoc feature dependencies: Many rely on manually selected features, limiting generalizability and robustness to evasion.

  2. Delayed response: Most models prioritize accuracy over early detection, leading to irreversible damage even upon successful detection.

  3. Limited adaptability: Fixed model architectures struggle to adapt to unseen ransomware variants.

     The paper's entry point and innovative idea lie in proposing a novel framework that integrates self-supervised contrastive learning with neural architecture search (NAS) to overcome these limitations, focusing on achieving low-latency and adaptive ransomware detection.

2.2. Main Contributions / Findings

The paper makes three primary contributions:

1. A Contrastive Learning Framework with Hardware Performance Counters (HPC): The authors design a contrastive learning framework that automatically extracts features by incorporating hardware performance counters (HPC) to analyze the runtime behavior of ransomware. This approach eliminates the need for ad-hoc feature engineering, making the detection more robust to evasive attacks and improving generalizability.

2. Latency-Aware Detection Loss Function: They introduce a customized loss function that explicitly encourages early-stage detection of malicious activity. This significantly reduces detection latency, which is crucial for mitigating damage from rapid ransomware encryption.

3. Neural Architecture Search (NAS) for Adaptive Models: A neural architecture search (NAS) framework is deployed to automatically construct adaptive model architectures. This allows the detector to flexibly align with unseen ransomware variants and adapt to the rapid evolution of threats with minimal retraining overhead.

   The key conclusions and findings are:

• Significant Performance Improvement: The proposed method achieved substantial improvements in both detection accuracy (up to 16.1% higher) and response time (up to 6x faster) compared to existing state-of-the-art approaches.

• Robustness to Evasive Attacks: The framework demonstrated stable accuracy and robustness against various evasive attacks like code morphing, delayed activation, and logic reordering.

• Effective Feature Extraction: The contrastive learning approach successfully produced compact and well-separated feature embeddings for different ransomware variants, indicating its effectiveness in automated and generalized feature learning.

• High Adaptability and Low Retraining Cost: The NAS-guided approach exhibited strong resilience to forgetting and required minimal retraining time (79.8 seconds) when adapting to new ransomware variants, ensuring adaptability to an evolving threat landscape.

• Acceptable Overhead: The method maintains acceptable training and inference overhead, making it suitable for real-time deployment.

  These findings directly address the limitations of prior work by offering a ransomware detection solution that is accurate, fast, resilient to evasion, and adaptable to new threats.

3. Prerequisite Knowledge & Related Work

3.1. Foundational Concepts

3.1.1. Ransomware

Ransomware is a type of malicious software that encrypts a victim's files, rendering them inaccessible, and then demands a ransom payment (usually in cryptocurrency) for their decryption. It poses a severe threat due to its potential for massive data loss and financial damage. As illustrated in Figure 1 of the paper, a typical ransomware attack has two main phases:

• Initialization Phase: The malware secretly registers itself for persistence (e.g., to run on system startup), loads necessary encryption algorithms, and identifies target files. This phase is often stealthy and can mimic benign program behavior.

• Infection Phase: Once initialized, the ransomware rapidly begins encrypting files and typically displays an extortion message to the user. This phase is characterized by fast, aggressive actions that cause immediate and irreversible damage.

  该图像是一个示意图，展示了典型勒索软件感染的工作流程。包括两个阶段：第一阶段为初始化，涉及程序注册、算法加载和文件定位；第二阶段为感染，涵盖数据加密和勒索信息显示。

Fig. 1. Illustration of a typical ransomware infection workflow. The attack begins with a stealthy initialization phase for registering for persistence and encryption algorithm loading, followed by the infection phase with data encryption and extortion message displaying.

3.1.2. Static vs. Dynamic Analysis

These are two fundamental categories of malware analysis:

• Static Analysis: Involves examining program files (executables, source code) without actually running them. It looks for signatures (unique byte sequences), indicators of compromise (IOCs), file headers, or structural patterns.
  • Pros: Computationally efficient, can detect malware before execution.
  • Cons: Vulnerable to obfuscation, code morphing (changing code without altering its function), polymorphism (code changing its appearance with each infection), and metamorphism (code rewriting itself). It cannot observe runtime behavior.
• Dynamic Analysis: Involves observing the program's behavior during its execution in a controlled environment (e.g., a sandbox). It monitors API calls, file system modifications, registry changes, network activity, memory usage, and CPU activity.
  • Pros: Provides richer behavioral context, more resilient to obfuscation, can detect zero-day threats.
  • Cons: Can be computationally intensive, may suffer from detection latency, requires a safe execution environment, and time-based evasion techniques can bypass it.

3.1.3. Machine Learning (ML) in Cybersecurity

ML techniques are increasingly applied in cybersecurity to detect sophisticated threats that are difficult to identify with rule-based or signature-based methods. ML models can learn complex patterns from large datasets of both benign and malicious activities. In ransomware detection, ML is used to classify programs as benign or malicious based on extracted features.

3.1.4. Contrastive Learning

Contrastive learning is a specialized type of self-supervised learning (SSL). In SSL, a model learns useful representations from unlabeled data by solving a pretext task, where the labels are automatically generated from the data itself. Contrastive learning achieves this by training an encoder to extract meaningful representations such that similar data samples are pulled closer together in a feature space, while dissimilar samples are pushed farther apart.

• Anchor: The reference input data point.

• Positive Sample: A data sample that is considered similar to the anchor (e.g., an augmented version of the anchor, or another sample from the same class).

• Negative Sample: A data sample that is considered dissimilar to the anchor (e.g., a sample from a different class).

• Encoder: A neural network (e.g., a recurrent neural network in this paper) that transforms the raw input data into a lower-dimensional feature embedding or representation.

• Feature Space: A multi-dimensional vector space where the encoded representations reside. The goal is for semantically similar items to be close in this space and dissimilar items to be far apart.

• Distance Function: A metric (e.g., Euclidean distance, cosine similarity, or Dynamic Time Warping in this paper) used to quantify the similarity or dissimilarity between two feature embeddings in the feature space.

  Figure 2 illustrates the basic concept:

  该图像是一个示意图，展示了对比学习的基本框架。给定锚点输入$x^{a}$，通过数据增强生成正样本$x^{+}$，并从不同类别选择负样本$x^{-}$。模型学习特征表示，使得距离$\delta(y^{+}, y^{a})$最小化，距离$\delta(y^{-}, y^{a})$最大化。

Fig. 2. Illustration of contrastive learning. Given an anchor input $x ^ { a }$ , a positive example $x ^ { + }$ is generated through data augmentation, while a negative example $x ^ { - }$ is selected from a different class. The model learns a feature representation such that the distance $\delta ( x ^ { a } , x ^ { + } )$ is minimized, while the distance $\delta ( x ^ { a } , x ^ { - } )$ is maximized.

3.1.5. Neural Architecture Search (NAS)

Neural Architecture Search (NAS) is an automated machine learning technique for designing optimal neural network architectures. Instead of manually designing a network (which is time-consuming and often requires expert knowledge), NAS algorithms explore a predefined search space of possible architectures to find the one that performs best on a given task.

• Supernet: A large, overarching neural network that encompasses all possible architectures within the search space. It contains all candidate operations and connections.
• One-shot NAS: A common NAS paradigm where a single Supernet is trained, and then various sub-networks (architectures) can be "sampled" or "pruned" from it without retraining from scratch, significantly speeding up the search process.
• Pruning: The process of removing less important connections, nodes, or layers from a neural network to make it more compact and efficient, often guided by metrics like weight magnitude or gradient importance.

3.1.6. Hardware Performance Counters (HPC) / Embedded Trace Buffers (ETBs)

• Hardware Performance Counters (HPC): Special-purpose registers built into modern CPU architectures that can count hardware-related events, such as cache misses, branch mispredictions, instruction cycles, memory accesses, and floating-point operations. They provide a low-level, fine-grained view of a program's execution behavior without requiring software instrumentation.
• Embedded Trace Buffers (ETBs): Dedicated on-chip hardware components (often found in embedded systems or debugging interfaces like ARM's CoreSight) that record execution traces (e.g., instruction fetches, data accesses, control flow changes) directly from the processor. They offer a non-intrusive way to monitor real-time program execution with minimal overhead, which is crucial for dynamic analysis in security contexts.
  • In this paper, ETB logs are captured via UART (Universal Asynchronous Receiver-Transmitter), a common serial communication interface, at specified intervals (e.g., 50ms).

3.1.7. Recurrent Neural Networks (RNNs) / Gated Recurrent Units (GRUs)

• Recurrent Neural Networks (RNNs): A class of neural networks designed to process sequential data (e.g., time series, natural language). Unlike feedforward networks, RNNs have loops that allow information to persist from one step to the next, enabling them to capture temporal dependencies.
• Gated Recurrent Units (GRUs): A type of RNN that, like Long Short-Term Memory (LSTM) networks, addresses the vanishing gradient problem and is capable of learning long-term dependencies. GRUs are generally simpler than LSTMs, having fewer gates (specifically, an update gate and a reset gate) and thus fewer parameters, making them a more lightweight option. They are well-suited for processing time-sequential data and extracting meaningful representations.

3.1.8. Dynamic Time Warping (DTW)

Dynamic Time Warping (DTW) is an algorithm for measuring similarity between two temporal sequences which may vary in speed or duration. For instance, if one person speaks slowly and another speaks quickly, DTW can align the similar parts of their speech even though their timings are different.

• Optimal Alignment: DTW finds the optimal "warping path" that aligns corresponding points between two sequences, minimizing the cumulative distance (cost) between them.

• Robustness to Temporal Distortions: This makes DTW robust to variations in temporal speed or local shifts in patterns, which is critical for ransomware detection where obfuscation might introduce delays or reorder operations.

• Incremental Computation: As a dynamic programming (DP) based algorithm, DTW can incrementally update its cost matrix, making it suitable for online computation or streaming data analysis.

  Figure 5 shows an illustration of DTW:

  该图像是一个示意图，展示了动态时间规整（DTW）算法的工作原理。左侧通过红色箭头表示两个序列元素之间的局部对应关系，右侧展示了累计代价矩阵及其最优路径。

Fig. 5. Illustration of the DTW algorithm (Image Credit: [12]). The optimal path with minimum cumulative distance is shown in the right panel of the figure, illustrating how the result was obtained through the DP recurrence. Accordingly, each of the red bidirectional arrows in the left panel encodes the local correspondence between elements guided by the optimal path.

3.2. Previous Works

The paper categorizes previous works into traditional static/dynamic methods and ML-based approaches, highlighting their limitations:

• Traditional Static Analysis:

  • Relies on rule-based identification or signature matching.
  • Limitation: Computationally efficient but vulnerable to evasive attacks like code morphing or insertion of non-functional blocks (e.g., SIA [16]).

• Traditional Dynamic Analysis:

  • Monitors runtime behaviors such as unusual file access, memory activity, or register values.
  • Limitation: Provides richer behavioral context but often suffers from detection latency, which is critical for ransomware (e.g., Ratafia [17]).

• ML-based Ransomware Detection:

  • Static ML methods: Inspect executable files or source code before runtime.
    • Examples: MLP-based methods for file headers [2], KNN [4], DNN [5], and Reinforcement Learning [6].
    • Limitations: High false positive rates (benign programs can mimic ransomware behavior), vulnerable to obfuscation techniques.
  • Dynamic ML methods: Monitor program behavior during execution.
    • Examples: Random forests on manually selected features [7], explainable deep learning (XRan) for temporal patterns [8].
    • Limitations: Most methods don't consider detection latency, leading to irreversible damage. Heavy reliance on manually engineered features, limiting adaptability to new variants. Often use fixed architectures, hindering adaptivity.
  • Contrastive Learning in Ransomware Detection: A prior study [9] applied contrastive learning for Android malware detection.
    • Limitation: Design was tightly coupled with Android-specific features (system call patterns, mobile app behaviors), limiting generalizability to other platforms.

3.3. Technological Evolution

The evolution of ransomware detection methods has progressed through several stages:

1. Early Signature-Based Detection (Static Analysis): Initially, defenses relied on identifying known malware signatures in executable files. This was fast but easily bypassed by code changes.

2. Rule-Based Behavioral Detection (Dynamic Analysis): As ransomware evolved, dynamic analysis emerged, monitoring runtime behaviors in sandboxes. This offered better detection for unknown variants but introduced latency.

3. Basic Machine Learning (Static/Dynamic): ML models (e.g., MLP, KNN, DNN, Random Forests) were introduced to learn patterns from static features or simple dynamic behaviors. While improving accuracy, these still faced issues with manual feature engineering, latency, and adaptability.

4. Deep Learning for Temporal Patterns: Advanced deep learning models like LSTMs and other RNNs began to analyze temporal sequences of dynamic behavior, as seen in Ratafia [17] and XRan [8]. This improved pattern recognition but often neglected real-time response and adaptability.

5. Contrastive Learning for Feature Extraction: More recently, self-supervised contrastive learning has been explored (e.g., SCL [18], and Android-specific work [9]) to automate feature engineering, reducing reliance on manual efforts and improving robustness.

   This paper's work represents a significant step in this evolution by integrating cutting-edge ML techniques (contrastive learning for automated, robust feature extraction and NAS for adaptive model architectures) with hardware-assisted dynamic analysis to specifically address the critical issues of low-latency and adaptability that prior methods failed to resolve simultaneously.

3.4. Differentiation Analysis

Compared to the main methods in related work, this paper's approach introduces several core differences and innovations:

1. Automated and Robust Feature Engineering:

   • Prior Work (e.g., Ratafia [17], Herrera et al. [7]): Heavily rely on manually engineered features (e.g., specific API calls, file activities), which are ad-hoc, vulnerable to evasion attacks like obfuscation, and lack generalizability to new variants.
   • Proposed Method: Employs self-supervised contrastive learning with raw hardware performance counter (HPC) traces. This automates feature engineering, making the system inherently less sensitive to surface-level obfuscations and more robust to evasion techniques. The use of Dynamic Time Warping (DTW) further enhances robustness to temporal distortions caused by logic reordering or delays.

2. Explicit Low-Latency Detection:

   • Prior Dynamic ML Methods (e.g., Ratafia [17], XRan [8], SCL [18]): Primarily optimized for accuracy, often neglecting detection latency. Even if accurate, a delayed detection of ransomware can still lead to irreversible damage.
   • Proposed Method: Introduces a customized latency-aware loss function into the training objective. This explicitly penalizes delayed responses and encourages earlier divergence in feature space, leading to significantly reduced detection latency (up to 6x faster). It also leverages hardware-assisted data collection (ETBs) for unobtrusive, low-latency monitoring.

3. Adaptive Model Architecture:

   • Prior ML Methods: Typically use fixed model architectures (e.g., LSTM, MLP, DNN), which can overfit to specific ransomware types and struggle to adapt to the rapidly evolving threat landscape and unseen variants.

   • Proposed Method: Integrates Neural Architecture Search (NAS) to automatically discover expressive and adaptive model structures for the downstream classifier. This allows the detector to flexibly align with new ransomware variants with minimal retraining overhead and strong resilience to catastrophic forgetting, enabling faster and more efficient adaptation.

     In essence, this paper differentiates itself by addressing the three intertwined critical challenges of feature dependency, detection latency, and model adaptability simultaneously through a cohesive framework that combines advanced self-supervised learning, a novel loss function, and architecture search, all powered by hardware-assisted monitoring.

4. Methodology

4.1. Principles

The core idea behind the proposed method is to create a robust, low-latency, and adaptive ransomware detection system by combining the strengths of self-supervised contrastive learning, hardware-assisted runtime monitoring, and neural architecture search (NAS). The theoretical basis is that by learning generalized representations from raw hardware traces through contrastive learning, penalizing detection delays directly in the loss function, and dynamically adapting the model architecture, the system can overcome the limitations of manual feature engineering, slow response times, and static models that plague existing approaches.

The framework processes dynamic hardware performance counter (HPC) traces as sequential data, learns discriminative embeddings, and then classifies them as benign or malicious, with a focus on early detection and adaptability.

4.2. Core Methodology In-depth (Layer by Layer)

The proposed framework is a fully automated learning system composed of an upstream encoder and a downstream classifier. Its workflow can be broken down into four major tasks, as illustrated in Figure 4 (referred to as Figure 3 in the paper's text):

该图像是一个示意图，展示了论文中用于低延迟且自适应勒索软件检测的对比学习框架。图中依次展示了数据收集、上游编码器的对比学习过程（包括RNNs、激活与距离测量），以及利用神经结构搜索（NAS）的下游分类器，最后用于缓解和恢复的任务流程。

Fig. 3. (Fig. 4 in original paper) Illustration of the contrastive learning framework for low-latency and adaptive ransomware detection presented in the paper. It sequentially shows data collection, the contrastive learning process of the upstream encoder (including RNNs, activation, and distance measuring), the downstream classifier using neural architecture search (NAS), and the final mitigation and restoration task flow.

4.2.1. Hardware-Assisted Data Collection

To obtain rich runtime behavior without software instrumentation overhead, the framework leverages hardware-assisted data collection.

• Mechanism: Embedded Trace Buffers (ETBs) are used to unobtrusively monitor real-time program execution. This provides fine-grained signals reflecting control flow transitions, memory access patterns, and low-level instruction behavior. These raw traces are crucial as they capture intrinsic behavioral properties rather than manually engineered features, making the approach resilient to code morphing.

• Data Format: The raw ETB traces are continuous streams of sequential buffer values.

• Windowing: To make these continuous traces compatible with sequential learning models and enable real-time processing, the stream is segmented into fixed-size sliding windows. Each window, denoted as $x_i$, represents a short activity segment (e.g., 500ms in experiments) while preserving its temporal structure.

  The synergy between ETBs and the subsequent RNN processing is shown in Figure 3 (referred to as Figure 4 in the paper's text):

  该图像是一个示意图，展示了循环神经网络（RNN）展开过程与嵌入式跟踪缓冲区（ETBs）采集执行轨迹的矩阵表示。ETBs轨迹被分割为固定大小的滑动窗口，输入RNN后产生隐藏状态 $h_t$。

Fig. 4. (Fig. 3 in original paper) Illustration of the hardware-assisted trace windowing process. Execution traces collected via Embedded Trace Buffers (ETBs) are organized as a matrix, where rows correspond to different buffer slots and columns represent clock cycles. The trace stream is segmented into fixed-size sliding windows, each representing a short temporal sequence x _ { i } . These windows are then fed sequentially into a recurrent neural network (RNN), which encodes each input window into a corresponding hidden representation h _ { i } .

4.2.2. Contrastive Learning-Based Upstream Encoder

This component is responsible for automatically extracting meaningful feature representations from the time-sequential trace data.

• Architecture: A recurrent neural network (RNN) is employed, specifically a three-layer Gated Recurrent Unit (GRU) [11], chosen for its efficiency in processing sequential data.

  • Each input trace window x _ { i } is defined as a sequence of feature vectors over time: $x _ { i } = \{ x _ { i } ^ { 1 } , x _ { i } ^ { 2 } , . . . , x _ { i } ^ { T } \}$ where $T$ is the total sequence length (number of time steps) within a window.
  • The GRU processes $x_i$ sequentially, producing a corresponding sequence of hidden states (embeddings): $h _ { i } = \{ h _ { i } ^ { 1 } , h _ { i } ^ { 2 } , . . . , h _ { i } ^ { T } \}$. These hidden states capture the temporal evolution of the program's behavior and serve as the latent representation for the input trace.

• Distance Function (Dynamic Time Warping - DTW): To measure similarity between these variable-length sequential traces and account for temporal distortions, Dynamic Time Warping (DTW) is used as the core distance metric.

  • Given two hidden sequences (embeddings) $h _ { i } = \{ h _ { i } ^ { 1 } , . . . , h _ { i } ^ { T _ { i } } \}$ and $h _ { j } = \{ h _ { j } ^ { 1 } , . . . , h _ { j } ^ { T _ { j } } \}$, where $T_i$ and $T_j$ are their respective lengths.
  • Cost Matrix: DTW first computes a cost matrix $\boldsymbol { D } ~ \in ~ \mathbb { R } ^ { T _ { i } \times T _ { j } }$. Each element D(p,q) in this matrix represents the squared Euclidean distance between the $p$-th element of $h_i$ and the $q$-th element of $h_j$: $D(p,q) = \|h_i^p - h_j^q\|^2$
    • $h_i^p$: The $p$-th hidden state (vector) in sequence $h_i$.
    • $h_j^q$: The $q$-th hidden state (vector) in sequence $h_j$.
    • $\|\cdot\|^2$: Squared Euclidean distance between two vectors.
  • Cumulative Cost Matrix: A cumulative cost matrix $C \in \mathbb { R } ^ { T _ { i } \times T _ { j } }$ is then computed using the following recurrence relation: $$\begin{array} { l } { \displaystyle \overrightarrow { C } ( p , q ) = D ( p , q ) + \operatorname* { m i n } \left\{ \begin{array} { l l } { C ( p - 1 , q ) , } \\ { C ( p , q - 1 ) , } \\ { C ( p - 1 , q - 1 ) } \end{array} \right. } \end{array}$$
    • C(p,q): The cumulative minimum cost to align the subsequence $h_i^1 \dots h_i^p$ with $h_j^1 \dots h_j^q$.
    • D(p,q): The local cost of aligning $h_i^p$ with $h_j^q$.
    • $\min\{\dots\}$: Takes the minimum of the three possible paths from previous states: aligning $h_i^p$ with $h_j^q$ by extending from $(p-1, q)$, $(p, q-1)$, or $(p-1, q-1)$.
    • Base cases: $C(0,0)=0$, and $C(p,0) = \infty$ for $p>0$, $C(0,q) = \infty$ for $q>0$.
  • Final DTW Distance: The distance between $h_i$ and $h_j$ is given by the cumulative cost along the optimal path, which ends at $C(T_i, T_j)$. The paper defines this distance as: $$d ( h _ { i } , h _ { j } ) = \frac { 1 } { 2 } C ^ { 2 } ( T _ { i } , T _ { j } )$$
    • $C(T_i, T_j)$: The minimum cumulative cost to align the entire sequence $h_i$ with $h_j$.
    • The division by 2 and squaring of $C(T_i, T_j)$ are specific choices for this framework's distance metric.

• Training Loss Function: A hybrid loss function is defined to train the contrastive learning framework. It consists of three components:

  1. Contrastive Loss ($\mathcal{L}_{pair}$): This component encourages positive pairs to be close and negative pairs to be far apart in the feature space.

     • An anchor program trace $x^a$ is chosen.
     • A positive sample $x^+$ is generated from another program of the same class or as a temporally modified version of $x^a$.
     • A negative sample $x^-$ is drawn from a program of the opposite class.
     • Let $h^a, h^+, h^-$ be the hidden sequences encoded by the GRU for $x^a, x^+, x^-$ respectively. The pairwise contrastive loss is: $${ \mathcal { L } } _ { \mathrm { p a i r } } = d ( h ^ { a } , h ^ { + } ) - d ( h ^ { a } , h ^ { - } )$$
       • $d(h^a, h^+)$: DTW distance between the anchor and positive embeddings.
       • $d(h^a, h^-)$: DTW distance between the anchor and negative embeddings.
       • The goal is to minimize this loss, meaning $d(h^a, h^+)$ should be smaller than $d(h^a, h^-)$.

  2. Intra-Class Clustering Loss ($\mathcal{L}_{cluster}$): This loss aims to reduce the behavioral diversity within the same class (benign or ransomware) by pulling samples towards their class centroid in the feature space.

     • Let $\mu_k$ represent the centroid of class $k \in \{0, 1\}$, where 0 is benign and 1 is ransomware.
     • The loss is defined as: $$\mathcal { L } _ { \mathrm { c l u s t e r } } = \sum _ { h _ { i } \in \mathcal { D } } \| h _ { i } - \mu _ { y _ { i } } \| ^ { 2 } , \quad \mathrm { w h e r e } ~ \mu _ { k } = \frac { 1 } { | \mathcal { D } _ { k } | } \sum _ { h _ { j } \in \mathcal { D } _ { k } } h _ { j }$$
       • $\mathcal{D}$: The set of all encoded embeddings.
       • $h_i$: An individual encoded embedding.
       • $y_i$: The true class label for embedding $h_i$.
       • $\mu_{y_i}$: The centroid of the class to which $h_i$ belongs.
       • $\|\cdot\|^2$: Squared Euclidean distance.
       • $\mathcal{D}_k$: The subset of $\mathcal{D}$ containing all embeddings belonging to class $k$.
       • $|\mathcal{D}_k|$: The number of embeddings in class $k$.
       • $\sum_{h_j \in \mathcal{D}_k} h_j$: Sum of all embeddings belonging to class $k$.

  3. Latency-Aware Loss ($\mathcal{L}_{latency}$): This component explicitly penalizes delayed detection, encouraging the model to identify malicious activity as early as possible.

     • For each sample pair $(x^a, x^-)$, the earliest timestep $t_{div}$ is computed, at which the DTW cost between $h^a$ and $h^-$ exceeds a predefined threshold $\delta$.
     • The latency loss is then defined as: $$\mathcal { L } _ { \mathrm { l a t e n c y } } = \frac { t _ { \mathrm { d i v } } } { T }$$
       • $t_{div}$: The earliest timestep where the DTW cost (or distance) between the anchor and negative sample diverges beyond a threshold. This represents the effective detection time.
       • $T$: The total sequence length of the trace.
       • Minimizing this loss pushes $t_{div}$ to be as small as possible, encouraging early detection.

  4. Total Objective Loss ($\mathcal{L}_{total}$): The three loss components are combined into a unified objective function: $$\mathcal { L } _ { \mathrm { t o t a l } } = \lambda _ { 1 } \mathcal { L } _ { \mathrm { p a i r } } + \lambda _ { 2 } \mathcal { L } _ { \mathrm { c l u s t e r } } + \lambda _ { 3 } \mathcal { L } _ { \mathrm { l a t e n c y } }$$

     • $\lambda_1, \lambda_2, \lambda_3$: Hyperparameters that control the weighting and balance of each loss component.

4.2.3. NAS-Guided Downstream Classifier

The embeddings produced by the upstream encoder are then fed into a downstream classifier to make the final ransomware prediction. To ensure adaptability to unseen ransomware variants, a Neural Architecture Search (NAS) strategy [13] is employed.

• One-Shot Search Paradigm: The NAS process follows a one-shot search approach.

  1. Supernet Construction: A multi-layer Supernet is first built. This Supernet incorporates a wide range of candidate operations at each layer, such as different types of GRUs, fully connected layers, and nonlinear activations. This Supernet represents the entire search space of potential classifier architectures.
  2. Pruning: After the Supernet is trained (often by having all candidate paths active), gradient-based pruning [14] is applied. This process removes redundant or underperforming components (paths/operations) from the Supernet, resulting in a compact and high-performing classifier architecture tailored to the specific detection task.

• Fast Adaptation: Once an initial architecture is found and pruned, the framework supports fast adaptation to new or emerging ransomware variants. Instead of restarting the entire NAS process or retraining from scratch, lightweight retraining is performed. This involves fine-tuning the selected components within the already pre-trained Supernet, significantly reducing the time and computational resources required for adaptation.

  Figure 6 illustrates the one-shot NAS workflow:

  该图像是一幅示意图，展示了图6中的一键式神经架构搜索（NAS）流程。图中从一个大型Supernet开始，通过基于梯度的剪枝逐步移除不重要的路径，最终形成轻量化的下游分类器架构。

Fig. 6. One-shot NAS workflow for downstream classifier construction. Starting from a large Supernet, gradient-based pruning removes less important paths to form a lightweight streamlined architecture.

4.2.4. Real-Time Detection and Rollback

The integrated framework operates in a real-time detection loop:

• Continuous Monitoring: Runtime trace segments are continuously extracted in a window-based manner (as described in Section 4.2.1).
• Feature Extraction: These segments are processed by the upstream encoder to generate temporal embeddings.
• Classification: The embeddings are then passed to the NAS-optimized downstream classifier.
• Alert Generation: Upon detecting ransomware, the classifier raises an alert.
• Mitigation (Rollback): To minimize damage from partial encryption before detection, a lightweight, system-level rollback mechanism is incorporated:
  • During each sliding window, the system monitors accessed files.
  • Temporary backups of these files are created using system built-in commands (e.g., rsync).
  • If no threat is detected, these backups are deleted to manage memory usage.
  • If malicious activity is confirmed, the ransomware process is immediately terminated, and the affected files are restored using the most recent backup, providing just-in-time mitigation.

5. Experimental Setup

5.1. Datasets

The experiments were conducted on a Linux workstation.

• Ransomware Variants: Six distinct ransomware variants were selected to ensure a comprehensive evaluation: WannaCry, Locky, Cerber, Vipasana, Petya, and Ryuk. These variants represent a diverse set of ransomware behaviors.
• Benign Samples: Collected from SPEC CPU benchmark suite [15] (a set of standardized CPU-intensive applications), various system utilities, and common user applications. This provides a realistic distribution of benign program behaviors.
• Data Collection:
  • ETB logs were captured via UART (Universal Asynchronous Receiver-Transmitter), a serial communication interface.
  • The capture interval was 50ms.
  • A window size of 500ms was used to segment the continuous traces. This duration was chosen to balance responsiveness (lower latency) and system overhead.
• Dataset Size: A total of 2100 program traces were collected, evenly split between benign and malicious classes.
• Data Sample Example: The paper describes the raw traces as "sequential buffer values that log control flow transitions, memory access patterns, and low-level instruction behavior." It does not provide a concrete example of a raw data sample (e.g., specific byte sequences or HPC register values).
• Rationale for Dataset Choice: The choice of diverse ransomware variants and common benign programs, combined with hardware-level dynamic tracing, aims to validate the method's ability to distinguish malicious from benign behavior effectively, robustly, and adaptively under realistic conditions.

5.2. Evaluation Metrics

The following metrics were used to evaluate the performance of the proposed method and baselines:

5.2.1. Accuracy (Acc)

• Conceptual Definition: Accuracy measures the proportion of total predictions that were correct. It indicates the overall effectiveness of the model in making correct classifications (both positive and negative).
• Mathematical Formula: $$\mathrm{Acc} = \frac{\mathrm{TP} + \mathrm{TN}}{\mathrm{TP} + \mathrm{TN} + \mathrm{FP} + \mathrm{FN}}$$
• Symbol Explanation:
  • $\mathrm{TP}$ (True Positives): Number of malicious samples correctly identified as malicious.
  • $\mathrm{TN}$ (True Negatives): Number of benign samples correctly identified as benign.
  • $\mathrm{FP}$ (False Positives): Number of benign samples incorrectly identified as malicious.
  • $\mathrm{FN}$ (False Negatives): Number of malicious samples incorrectly identified as benign.

5.2.2. Precision (Pre)

• Conceptual Definition: Precision measures the proportion of positive identifications that were actually correct. In ransomware detection, it indicates how many of the detected ransomware instances were truly ransomware, minimizing false alarms.
• Mathematical Formula: $$\mathrm{Pre} = \frac{\mathrm{TP}}{\mathrm{TP} + \mathrm{FP}}$$
• Symbol Explanation:
  • $\mathrm{TP}$ (True Positives): Number of malicious samples correctly identified as malicious.
  • $\mathrm{FP}$ (False Positives): Number of benign samples incorrectly identified as malicious.

5.2.3. Recall (Rec)

• Conceptual Definition: Recall measures the proportion of actual positives that were correctly identified. In ransomware detection, it indicates how many of the actual ransomware instances present were successfully detected, minimizing missed threats.
• Mathematical Formula: $$\mathrm{Rec} = \frac{\mathrm{TP}}{\mathrm{TP} + \mathrm{FN}}$$
• Symbol Explanation:
  • $\mathrm{TP}$ (True Positives): Number of malicious samples correctly identified as malicious.
  • $\mathrm{FN}$ (False Negatives): Number of malicious samples incorrectly identified as benign.

5.2.4. F1-score (F1)

• Conceptual Definition: The F1-score is the harmonic mean of Precision and Recall. It provides a single metric that balances both precision and recall, being particularly useful when there is an uneven class distribution or when both false positives and false negatives are costly.
• Mathematical Formula: $$\mathrm{F1} = 2 \times \frac{\mathrm{Pre} \times \mathrm{Rec}}{\mathrm{Pre} + \mathrm{Rec}}$$
• Symbol Explanation:
  • $\mathrm{Pre}$ (Precision): As defined above.
  • $\mathrm{Rec}$ (Recall): As defined above.

5.2.5. Detection Latency

• Conceptual Definition: The time elapsed from the start of a malicious activity until the system successfully identifies and raises an alert about it. For ransomware, lower latency is critical to prevent or minimize data encryption. Measured in milliseconds (ms).

5.2.6. Retraining Time

• Conceptual Definition: The duration required to retrain or fine-tune the model to adapt to new, unseen ransomware variants until it converges to an acceptable performance level. Measured in seconds (s). Lower retraining time indicates better adaptability.

5.2.7. Model Size

• Conceptual Definition: The number of trainable parameters in the model. Measured in Millions of parameters (M parameters). This indicates the complexity and potential memory footprint of the model.

5.2.8. Memory Footprint

• Conceptual Definition: The amount of memory consumed by the model during inference or operation. Measured in Megabytes (MB). This is important for deployment on resource-constrained devices.

5.3. Baselines

The proposed method was compared against four baseline approaches:

• SIA [16]: Stands for "Static-Informed Analysis". This approach represents a static analysis method. It relies on handcrafted signatures and entropy-based heuristics to detect ransomware. It inspects executable files before runtime.

• Ratafia [17]: "Ransomware Analysis using Time and Frequency Informed Autoencoders". This is a dynamic analysis method that uses LSTM-based autoencoders for anomaly detection. It processes runtime behavior but often relies on manually selected features.

• SCL [18]: "Dynamic Malware Detection Based on Supervised Contrastive Learning". This is a more recent approach that employs a supervised contrastive learning framework for ransomware detection. While using contrastive learning, its "supervised" nature may imply a greater dependency on explicit labels for positive/negative pair construction, potentially differing from the self-supervised approach in this paper.

• Proposed: The method developed in this paper, integrating self-supervised contrastive learning with Neural Architecture Search (NAS).

  Additionally, for the detection latency case study, an ablated version of the proposed model (Proposed - Latency Loss) was included. This ablated version is identical to the full proposed model but without the latency-aware loss function component during training, allowing for a direct assessment of this component's contribution to reducing latency.

6. Results & Analysis

6.1. Core Results Analysis

6.1.1. Detection Accuracy

The following are the results from Table I of the original paper:

The table presents the detection performance of the proposed method against three baselines (SIA, Ratafia, SCL) across six different ransomware variants. The evaluation metrics are Accuracy (Acc), Precision (Prec), Recall (Rec), and F1-score (F1).

• SIA [16]: This static analysis method performed the worst, with an average accuracy of 79.8% and the lowest average precision of 70.2%. Its reliance on static signatures makes it prone to high false positive rates, as benign programs can sometimes share similar static characteristics with ransomware.
• Ratafia [17]: As a dynamic analysis method using autoencoders, Ratafia showed an improvement over SIA, achieving an average accuracy of 86.3%. However, its dependence on manually crafted features limited its ability to capture subtle behavioral transitions and long-range dependencies, leading to suboptimal recall and F1-scores.
• SCL [18]: This supervised contrastive learning framework generally performed better than SIA and Ratafia, with an average accuracy of 88.4%. However, it exhibited significant variability across different ransomware variants. For instance, its accuracy dropped to 77.2% for Vipasana, a variant known for offline encryption that deviates from typical dynamic behaviors. This shows its limitations in handling diverse or atypical ransomware.
• Proposed Method: The proposed framework consistently outperformed all baselines across all metrics and ransomware variants. It achieved an impressive average accuracy of 95.9% and an F1-score of 0.96. The performance was particularly strong on variants like Vipasana, where SCL struggled, demonstrating its superior ability to generalize. This significant outperformance, especially the 16.1% accuracy improvement over SCL on Vipasana, is attributed to the combination of contrastive self-supervised learning for automated feature engineering and NAS-guided architecture optimization.

6.1.2. Robustness

The robustness of the methods against evasive attacks was evaluated using three strategies: code morphing (injecting redundant instructions), delayed activation (shifting encryption routines), and logic reordering (interleaving benign and malicious logic).

该图像是图7，展示了针对逃避型勒索软件攻击的不同方法在20次试验中的检测准确率。可以看出，所提出的方法在准确率上明显优于其他对比方法，保持在90%以上，体现了其较强的鲁棒性。

Fig. 7. Accuracies across 20 trials on evasive Ransomware attacks.

Figure 7 shows the accuracy of each method under these evasive attacks over 20 trials.

• Baseline Degradation: All three baseline approaches (SIA, Ratafia, SCL) showed notable performance degradation.
  • SIA failed significantly due to its reliance on static signatures, which are easily disrupted by morphed or delayed variants.
  • Ratafia also experienced a sharp decline, indicating its vulnerability to timing manipulations.
  • SCL, despite its feature learning capabilities, suffered from inconsistent performance, particularly under logic reordering attacks.
• Proposed Method's Resilience: In contrast, the proposed method maintained stable accuracy across all evasive variants. This resilience is attributed to:
  • Automated Feature Learning: Avoiding handcrafted features makes it less sensitive to surface-level obfuscations.
  • Hardware-Assisted Monitoring: Ensures that the core malicious behavior is still observed despite evasion attempts.
  • Dynamic Time Warping (DTW): Its ability to align temporally displaced behavior patterns effectively mitigates reordering and delay strategies.

6.1.3. Feature Extraction

To validate the automated feature engineering capability of the contrastive learning encoder, the learned feature representations were visualized using Principal Component Analysis (PCA).

该图像是图表，展示了图8中使用Ratafia方法（左图）和本文提出的对比学习方法（右图）对不同勒索软件变体的潜在特征嵌入的三维可视化。右图显示新方法在特征分布上的更好聚类效果。

Fig. 8. Visualization of latent feature embeddings across ransomware variants using Ratafia (left) and the proposed contrastive learning method (right).

Figure 8 presents a 3D visualization of latent feature embeddings for the six ransomware variants:

• Ratafia (Left): The embeddings generated by Ratafia (which uses RNNs but relies on manually defined feature types) are loosely distributed and scattered, especially for variants like Ryuk and Vipasana. This wide spread makes it difficult for a classifier to group these variants into distinct, compact categories, explaining Ratafia's unstable classification performance.
• Proposed Contrastive Learning (Right): The embeddings produced by the proposed contrastive learning approach form a compact and well-separated cluster for all six ransomware variants. This demonstrates that the method effectively maps diverse ransomware traces close together in the feature space, regardless of their specific characteristics or variants. This well-structured representation directly contributes to the improved accuracy and robustness observed in earlier experiments.

6.1.4. Detection Latency

Detection latency is crucial for effective ransomware mitigation. The comparison excluded SIA, as it is a static analysis method that operates pre-execution. An ablated version of the proposed model (without the latency-aware loss) was included to highlight its contribution.

该图像是图表，展示了不同勒索软件变体的检测延迟对比（图9）。横轴为勒索软件变体，纵轴为检测延迟（毫秒）。图中显示提出的方法在所有变体中检测延迟均显著低于其他比较方法，特别是加入延迟损失函数后的性能提升明显。

Fig. 9. Detection latency for different ransomware variants.

Figure 9 illustrates the average detection latency of different methods across the six ransomware variants:

• Baselines: Ratafia and SCL exhibit significantly higher latencies, often ranging from 400ms to 600ms. This confirms that models primarily optimized for accuracy often overlook the critical aspect of early detection.
• Proposed Method (without Latency Loss): Even without the latency-aware loss, the proposed method (due to its efficient hardware-assisted monitoring and GRU-based encoder) shows improved latency compared to Ratafia and SCL, typically between 400ms and 500ms.
• Proposed Method (with Latency Loss): With the inclusion of the latency-aware loss during training, the proposed approach consistently achieves the lowest latency, with detection occurring under 100 milliseconds on average. This represents a 6x improvement in response time compared to some baselines. This drastic reduction is directly attributed to the explicit latency penalty in the loss function, which forces the model to learn earlier predictive signals. This enables timely alerts and reduces the overhead for file backup operations in the mitigation phase.

6.1.5. Adaptivity

The adaptability of the methods was evaluated in a transfer-learning scenario, where models were trained on three randomly selected ransomware families and tested on the remaining unseen ones, then retrained and re-evaluated.

The following are the results from Table II of the original paper:

The table evaluates accuracy on seen and unseen variants both pre-retraining and post-retraining, as well as the retraining time.

• Performance Drop on Unseen Variants: All methods experienced performance drops on unseen variants before retraining, as expected. The proposed method still showed the best pre-retraining accuracy on unseen variants (81.0%).
• Catastrophic Forgetting: After retraining to adapt to the new variants, the first three baselines (SIA, Ratafia, SCL) suffered from catastrophic forgetting. Their accuracy on previously seen variants degraded (e.g., SCL dropped from 91.2% to 89.7% on seen variants). This indicates that adapting to new threats often comes at the cost of forgetting old ones for these methods.
• Proposed Method's Adaptability: In contrast, the proposed method maintained high accuracy on both seen (94.8%) and unseen (94.1%) variants after retraining. This demonstrates strong resilience to forgetting.
• Retraining Overhead: The proposed method also achieved the shortest retraining time of 79.8 seconds. This efficiency is attributed to two factors:
  1. The contrastive learning encoder learns generalized representations from limited data, reducing the epochs to convergence.
  2. The downstream classifier is instantiated from a pre-trained Supernet via NAS, requiring only lightweight parameter-tuning rather than a full architectural redesign.

6.1.6. Overhead Analysis

The overhead associated with the proposed method was broken down into training and inference components.

The following are the results from Table III of the original paper:

The table provides a breakdown of training and inference overhead for the encoder and classifier components.

• Training Overhead:
  • Contrastive Pretraining Time: The upstream encoder takes 0.3 hours for pretraining.
  • NAS Search Time: The Neural Architecture Search for the classifier takes 1.2 hours. This is a one-time cost incurred during the initial design phase and does not impact runtime or subsequent adaptive updates.
  • Retraining Time: The total time for retraining (for adaptivity) is 79.8 seconds, which is very low, making fast adaptation feasible.
  • Model Size: The total model size is 3.5 Million parameters, indicating a relatively compact model.
• Inference Overhead:

  • Latency (ms/sample): The total inference latency per sample is 20.3ms (13.1ms for encoder, 7.2ms for classifier). This is very efficient and supports real-time deployment.

  • Memory Footprint: The total memory footprint is 19.0 MB (11.9MB for encoder, 7.1MB for classifier). This is also modest, allowing deployment on resource-constrained or endpoint devices.

    These metrics confirm that despite its advanced features, the proposed system maintains acceptable overhead for practical deployment in real-time environments.

6.2. Ablation Studies / Parameter Analysis

The paper implicitly conducts an ablation study on the latency-aware loss component.

• Ablated Component: The effect of the latency-aware loss function ($\mathcal{L}_{latency}$) within the total loss objective ($\mathcal{L}_{total}$) is analyzed.

• Methodology: In the Detection Latency case study (Section IV-E and Figure 9), the performance of the full proposed model is compared against an ablated version where the latency-aware loss component is removed from the training process.

• Results: As shown in Figure 9, removing the latency-aware loss leads to a noticeable increase in detection latency, typically ranging from 400ms to 500ms. In contrast, the full proposed method (with latency-aware loss) achieves detection under 100ms on average.

• Conclusion: This direct comparison demonstrates the essential role of the latency-aware loss in significantly reducing detection delay, confirming its effectiveness and necessity for the framework's low-latency objective.

  The paper does not explicitly detail other extensive ablation studies for other components (e.g., contrastive learning vs. supervised, or NAS vs. fixed architecture) beyond the direct comparison to baselines which implicitly demonstrates their value. Nor does it present a detailed parameter analysis for hyperparameters like $\lambda_1, \lambda_2, \lambda_3$ or the DTW threshold $\delta$.

7. Conclusion & Reflections

7.1. Conclusion Summary

This paper introduces a novel and comprehensive framework for low-latency and adaptive ransomware detection by integrating self-supervised contrastive learning with neural architecture search (NAS). The core contributions address critical limitations of existing AI-based detection methods:

1. Automated Feature Engineering: By leveraging hardware performance counters (HPC) and a contrastive learning framework with Dynamic Time Warping (DTW), the system automatically extracts robust behavioral features, eliminating the need for ad-hoc feature selection and improving resilience against evasive attacks.

2. Reduced Detection Latency: The introduction of a customized latency-aware loss function during training explicitly encourages early-stage detection, resulting in significantly faster response times (up to 6x improvement).

3. Adaptive Model Architectures: A Neural Architecture Search (NAS) framework is employed to automatically generate adaptive model architectures for the downstream classifier, ensuring flexibility and efficient adaptation to unseen ransomware variants with minimal retraining overhead.

   Experimental results rigorously validate the framework's effectiveness, showing substantial improvements in detection accuracy (up to 16.1% higher) and response time, while maintaining strong robustness against sophisticated evasive attacks. The method also demonstrates excellent adaptability with low retraining cost and acceptable inference overhead, making it suitable for real-world deployment.

7.2. Limitations & Future Work

The paper does not explicitly list a dedicated "Limitations" or "Future Work" section. However, based on the problem statement, methodology, and results, some implicit limitations and potential future directions can be inferred:

• Hardware Dependency: The method heavily relies on Embedded Trace Buffers (ETBs) for data collection. While effective for unobtrusive monitoring, the availability and ease of deployment of ETBs (or similar HPC tracing mechanisms) might vary across different hardware platforms and environments (e.g., cloud environments, older systems). This could limit its universal applicability.
• Generalizability of HPC Features: While HPCs are more generalized than manual features, their representation of "intrinsic behavioral properties" might still be specific to CPU architectures. Future work could explore how well these features transfer across different CPU families or if a more abstract representation could be learned.
• Computational Cost of DTW: Although DTW is robust, it can be computationally intensive, especially for very long sequences. While the paper uses fixed-size sliding windows, the overhead could still be a factor in extremely high-throughput or highly resource-constrained scenarios, or if window sizes need to increase. Further optimization of DTW or exploration of faster sequence similarity measures might be beneficial.
• Complexity of NAS: While one-shot NAS speeds up adaptation, the initial Supernet construction and training (or its initial search) can still be complex and resource-intensive. Simplifying or further optimizing this initial phase could be a direction for future research.
• Specificity of Rollback Mechanism: The real-time rollback mechanism is mentioned as a mitigation strategy (using rsync for temporary backups). The specifics of its overhead, robustness against different file system types, or interactions with operating system features are not detailed. Further investigation into a more comprehensive and robust rollback solution, potentially integrated deeper with OS kernel functionalities, could be explored.
• Broader Evasion Techniques: While robust to several common evasion techniques, ransomware evolution is continuous. Future work could investigate robustness against more advanced, stealthy techniques like polymorphic packers, anti-analysis techniques, or living-off-the-land binaries that might not be fully captured by current HPC features.
• Scalability for Large Datasets: The dataset size used (2100 traces) is reasonable for academic evaluation, but real-world deployment would involve continuous monitoring of potentially millions of processes. The scalability of the contrastive learning and NAS training/adaptation for extremely large, continuously updated datasets could be a future research area.

7.3. Personal Insights & Critique

This paper presents a highly innovative and well-structured approach to a critical cybersecurity problem. The integration of self-supervised contrastive learning and Neural Architecture Search with hardware-assisted monitoring is a powerful combination that directly addresses the long-standing challenges in ransomware detection.

Key Strengths and Innovations:

• Holistic Solution: The framework provides a holistic solution by tackling feature engineering, detection latency, and model adaptability simultaneously, which is rare in prior research that often focuses on only one or two aspects.
• Hardware-Assisted Advantage: The use of ETBs for unobtrusive, fine-grained runtime tracing is a significant advantage. It allows the model to learn from fundamental program behaviors, making it more resilient to software-level obfuscations compared to approaches relying on software instrumentation or high-level API calls.
• Robust Feature Learning: Contrastive learning with DTW is an excellent choice for this domain. It automatically learns discriminative features from noisy, variable-length, and temporally distorted traces, which is crucial for handling diverse and evolving ransomware. The visualization in Figure 8 beautifully demonstrates this effectiveness.
• Proactive Latency Reduction: The latency-aware loss function is a clever and practical innovation. Moving beyond just optimizing for accuracy, it directly addresses the real-world impact of ransomware by minimizing the time to detection, thus enabling more effective mitigation.
• Adaptive and Efficient Model Design: NAS offers a principled way to achieve adaptability. The one-shot paradigm and lightweight retraining significantly reduce the practical overhead of updating models for new threats, a major bottleneck in traditional ML deployments.
• Rigorous Evaluation: The paper conducts a comprehensive evaluation covering accuracy, robustness, feature extraction, latency, and adaptability, with clear comparisons against relevant baselines, strengthening its claims.

Potential Areas for Improvement/Further Consideration:

• Explanation of Positive Sample Generation: While the abstract mentions "temporally modified version of $x^a$", the methodology section could provide more explicit details on how these positive samples are generated for the contrastive learning framework. Specific augmentation strategies (e.g., adding noise, time shifting, cropping) would add clarity for replication.

• Hyperparameter Sensitivity: The paper mentions $\lambda_1, \lambda_2, \lambda_3$ as hyperparameters for the total loss. An analysis of their sensitivity and how optimal values were determined would provide deeper insights into the training stability and performance.

• Details on NAS Search Space: While NAS is described, a more detailed specification of the Supernet's candidate operations and the specific gradient-based pruning strategy used would enhance reproducibility and understanding for researchers interested in the architectural search process.

• Comparative Overhead with Baselines: While Table III provides overhead for the proposed method, a comparative overhead analysis (even if estimated) for the baselines (especially Ratafia and SCL which are also dynamic ML) could provide a more complete picture of the efficiency benefits.

• Real-world Deployment Challenges: Beyond the technical performance, practical deployment in diverse organizational IT environments (e.g., compatibility with existing security tools, integration with SIEMs, handling false positives in production) presents its own set of challenges that could be discussed.

  Overall, this paper presents a compelling and well-executed research piece that pushes the boundaries of ransomware detection. Its combination of advanced ML techniques with hardware-level insights offers a robust, efficient, and adaptive solution to a rapidly evolving and critical threat. The insights derived from this work could certainly be transferred to other domains requiring low-latency anomaly detection in streaming sequential data, such as intrusion detection systems or industrial control system security.