Facing the challenge of increasingly sophisticated malware, it is imperative to develop an effective and adaptable malware detection framework. Hardware-level information has been shown to be very effective in detecting malware in the system through dynamic behavioral analysis at runtime. However, previous approaches suffer from the overhead of complex neural network models, as well as difficulty in scaling toward new attacks. In this work, we introduce a novel approach that leverages the Light Gradient-Boosting Machine (LightGBM) model, known for its efficiency and support for fast transfer learning method, to create a scalable and highly accurate malware detection system. Our framework achieves an exceptional detection accuracy of more than 99.90% for multiclass classification. Through transfer learning, the model can quickly adapt to new malware data and environments, significantly reducing the time and resources needed for retraining. Our results highlight the potential of using the LightGBM model to improve the malware detection framework.

Recent years have witnessed a surge in ransomware attacks. Especially, many new variants of ransomware have continued to emerge, employing more advanced techniques to distribute the payload while avoiding detection. This renders the traditional static ransomware detection mechanism ineffective. In this paper, we present our Hardware Anomaly Realtime Detection-Lightweight (HARD-Lite) framework that employs a semi-supervised machine learning method to detect ransomware using low-level hardware information. By using an LSTM network with a weighted majority voting ensemble and exponential moving average, we are able to take into consideration the temporal aspect of hardware-level information formed as time series in order to detect deviation in system behavior, thereby increasing the detection accuracy whilst reducing the number of false positives. Testing against various ransomware families across multiple hardware platforms, HARD-Lite has demonstrated remarkable effectiveness, detecting all cases tested successfully. What’s more, by having a separate machine for the classifier while the user machine is under monitoring, it allows the classifier machine to enforce strict protection and offload the heavy-weight classification work, without impeding the functionality of the user machine. This hierarchical design enables good scalability for the proposed framework.