| 摘要: |
| 勒索软件是当前网络安全领域最为严峻的威胁之一。静态检测技术易于被加密、混淆等手段规避，动态检测技术存在系统开销大及检测环境易被识别等问题。基于硬件性能计数器（HPC）的底层检测是近年来的研究热点，但现有研究存在数据集规模匮乏、采样间隔过短导致开销大、事件选择缺乏系统性、缺乏跨平台验证等局限。针对上述问题，该文构建了涵盖42个家族、1929个样本的大规模勒索软件数据集，通过递归特征消除法筛选出4个跨平台通用HPC事件，系统评估7种候选采样间隔并确定200ms为最优。在Windows 7与Windows 10双平台上对比XGBoost与LightGBM模型，设计差异化剪枝优化策略。单平台Win7上使用5个事件（含instructions）实现97.83%的检测准确率，未知变体召回率达99.52%；双平台统一特征集（不含instructions）下，XGBoost在Win7和Win10上的准确率分别为96.96%和99.53%，未知变体召回率分别为87.98%和96.63%。实验结果表明，该文方法在数据集规模、事件数量、轻量化程度和跨平台验证上均优于现有研究。 |
| 关键词: 勒索软件，硬件性能计数器，特征选择，轻量级，集成学习，跨平台验证 |
| DOI： |
| 投稿时间：2025-03-08修订日期：2026-07-07 |
| 基金项目: |
|
| Lightweight Ransomware Detection Technology Based on Hardware Performance Counters |
|
zhaoerliang, zhuziyuan
|
| (Institute of Information Engineering, Chinese Academy of Sciences) |
| Abstract: |
| Ransomware has become one of the most critical cybersecurity threats. Static detection methods are vulnerable to encryption and obfuscation techniques, while dynamic detection suffers from high system overhead and the risk of being recognized by malware. Hardware-level detection based on Hardware Performance Counters (HPC) has emerged as a promising research direction in recent years. However, existing studies suffer from limitations such as insufficient dataset scale, excessive sampling intervals leading to high overhead, lack of systematic feature selection, and the absence of cross-platform validation.To address these issues, this paper constructs a large-scale ransomware dataset comprising 1,929 samples across 42 families. Four cross-platform HPC events are selected via Recursive Feature Elimination (RFE). Seven candidate sampling intervals are systematically evaluated, and 200ms is identified as the optimal interval. A comparative analysis of XGBoost and LightGBM models is conducted on both Windows 7 and Windows 10 platforms, with a platform-adaptive differentiated pruning strategy designed. On the single Windows 7 platform, using five events (four RFE-selected events plus instructions), the method achieves 97.83% detection accuracy and 99.52% unknown variant recall. Under the unified cross-platform feature set (excluding instructions), XGBoost achieves accuracies of 96.96% and 99.53% on Windows 7 and Windows 10, respectively, with unknown variant recall rates of 87.98% and 96.63%. Experimental results demonstrate that the proposed method outperforms existing studies in dataset scale, event count, lightweight efficiency, and cross-platform validation. |
| Key words: ransomware, HPC,feature selection,lightweight,ensemble learning techniques |
