EVENT DOSSIER
The researchers proposed an adaptive ransomware detection scheme called “HMAS” (HMAS). This system organizes specialized agents into hierarchical domain controllers, which are coordinated by a meta-architect. Its core mechanism involves using static analysis as the initial low-cost mode; dynamic and memory modes are only selectively used for verification when confidence is insufficient or when there are disagreements among expert agents. Experimental comparisons showed that HMAS achieved an accuracy of 96.57%, an F1 score of 0.96, and an ROC-AUC of 0.99 in binary classification detection, with a macro F1 score of 0.90 for family attribution. Compared with exhaustive analysis strategies, HMAS reduced the average analysis cost by 43.97% and significantly decreased the average delay. Routing analysis indicated that 56.05% of cases could be resolved with only static evidence, while only 4.33% required a complete evidence pipeline.
研究者提出了一种用于自适应勒索软件检测的“成本感知分层多智能体系统（HMAS）”。该系统将专用智能体组织为层级化领域控制器，由元编排器协调；利用静态分析作为初始低成本模态，仅在置信度不足或专家智能体分歧时选择性调用动态和内存模态。实验对比了自适应 HMAS 与仅静态、静态加动态及穷举分析策略，结果显示 HMAS 在二分类检测中达到 96.57% 准确率、0.96 F1 分数和 0.99 ROC-AUC，家族归属宏观 F1 分数为 0.90。相比穷举分析，HMAS 平均分析成本降低 43.97%，显著降低了平均延迟（LLM 验证案例除外）。路由分析表明，56.05% 的案例仅凭静态证据解决，仅 4.33% 需要完整证据管道。