Learning the Language of NVMe Streams for Ransomware Detection

Barak Bringoltz, Elisha Halperin, Ran Feraru, Evgeny Blaichman, Amit Berman
2/7/2025
cs.LGcs.CR

No official code found. Best implementation: johndoenvme/rwdetection (0 stars, last commit 2025-01-30).

Abstract

We apply language modeling techniques to detect ransomware activity in NVMe command sequences. We design and train two types of transformer-based models: the Command-Level Transformer (CLT) performs in-context token classification to determine whether individual commands are initiated by ransomware, and the Patch-Level Transformer (PLT) predicts the volume of data accessed by ransomware within a patch of commands. We present both model designs and the corresponding tokenization and embedding schemes and show that they improve over state-of-the-art tabular methods by up to 24% in missed-detection rate, 66% in data loss prevention, and 84% in identifying data accessed by ransomware.

View on arXivView PDF

Code Implementations(1)

johndoenvme/rwdetectionCommunity69%

Repository based on the paper: "Learning the Language of NVMe Streams for Ransomware Detection"

00PythonJan 27, 20251 years agoNOASSERTION

Similar Papers

WannaLaugh: A Configurable Ransomware Emulator -- Learning to Mimic Malicious Storage Traces

83% match2024

Trojan Detection Through Pattern Recognition for Large Language Models

82% match2025

Ransomware threat mitigation through network traffic analysis and machine learning techniques

82% match2024

A Lean Transformer Model for Dynamic Malware Analysis and Detection

82% match2024

Command-line Obfuscation Detection using Small Language Models

81% match2024

MLRan: A Behavioural Dataset for Ransomware Analysis and Detection

81% match1 repo582025

Cite this paper

@article{bringoltz2025learning,
  title  = {Learning the Language of NVMe Streams for Ransomware Detection},
  author = {Barak Bringoltz and Elisha Halperin and Ran Feraru and Evgeny Blaichman and Amit Berman},
  year   = {2025},
  eprint = {2502.05011},
  archivePrefix = {arXiv},
  url    = {http://arxiv.org/abs/2502.05011v1}
}

Add a badge to your README

Shows whether official code is linked for this paper.

Code of Paper badge
[![Code of Paper](https://codeofpaper.com/badge/2502.05011.svg)](https://codeofpaper.com/paper/2502.05011)

Discussion