Early Detection of Ransomware via Multi-Source Fusion with Hardware Performance Counters

In recent years, ransomware detection based on hardware performance counters (HPCs) has shown promise. However, existing HPC-based approaches are constrained by limited feature modeling and insufficient behavioral context, leading to high false positive rates and detection delays from data accumulation. To address these issues, we propose an early detection approach that combines HPCs, disk input/output (I/O) statistics, and ransom note analysis. The approach introduces an attention-enhanced temporal convolutional network to extract multi-scale features from HPC data, thus improving the extraction of temporal characteristics in HPC sequences. Furthermore, disk I/O patterns are analyzed through machine learning to provide additional behavioral context beyond HPCs, significantly reducing false positives. We also design a Minifilter-based ransom note detector to identify ransom notes dropped by ransomware, further reducing detection latency. Extensive experiments demonstrate that our approach achieves a Matthews Correlation Coefficient (MCC) of 95.95%, a false positive rate of only 0.48% on unknown ransomware, and reduces average detection latency by 0.8 seconds across 14 ransomware families. It outperforms representative approaches and exhibits strong potential for detecting unknown ransomware.