Abstract
Ransomware has evolved into a complex, adaptive, and fast-moving adversary category in which static signatures and monolithic classifiers fail to generalize under concept drift, evasion, and behavioral polymorphism. In this paper, we present Agentic SABRE (Semantic-Behavioral Arbitration for Ransomware Evaluation), an uncertainty-aware, neuro-symbolic, multi-agent framework for adaptive ransomware detection. SABRE fuses semantic, representation-based evidence with behavioral, time-window forensic telemetry and employs Monte Carlo Dropout inference to quantify epistemic uncertainty for each agent.
We introduce a decision-layer orchestrator that performs risk- and uncertainty-aware triage using two interpretable thresholds: a risk score and an uncertainty budget. High-confidence, high-risk samples are automatically contained, while uncertain or borderline cases are escalated to human analysts, establishing a flexible computational contract between autonomous response and analyst oversight. To support auditability and trust, SABRE integrates post-hoc explainability mechanisms, including gradient saliency, permutation importance, and counterfactual analysis, enabling both local and global interpretation of agent decisions.
Extensive evaluation on RDset and RanSMAP demonstrates that Agentic SABRE preserves perfect discrimination on saturated semantic datasets, with AUC equal to 1.0, while improving robustness under weak behavioral signals. It achieves up to a 4.9 percent relative reduction in false escalations at equal recall while maintaining calibrated predictive uncertainty. Counterfactual analysis further shows that semantic and behavioral decisions can be reversed with bounded perturbation cost, indicating stable and interpretable decision boundaries.
Blogger's Review: This research illustrates how the integration of neural networks and symbolic reasoning can enhance the flexibility and accuracy of ransomware detection, emphasizing the importance of uncertainty management. The design philosophy of Agentic SABRE offers new insights for future security systems, especially in the face of evolving threats. Its explainability mechanisms also provide strong support for trust-building, making it worthy of close attention.