Survival of~the~Stealthiest: Evolving Low-Entropy Ransomware via~Genetic Algorithms

2026-08-20

AI Summary

本文通过遗传算法优化数据加密，以减少系统活动的统计偏差，从而生成能够逃避行为监控的低熵勒索软件，解决传统勒索软件易被现代防御系统快速检测的问题。

Abstract

Traditional ransomware deployment often relies on massive encryption procedure, triggering immediate detection by modern defense systems. This work introduces a paradigm shift in cryptographic attacks by framing ransomware execution as a Search-Based Software Engineering (SBSE) optimization problem. This approach addresses the persistence gap observed in modern threats, where attacks aim to remain undercover for hours rather than minutes. Using a Genetic Algorithm (GA), we optimize data encryption under a hard constraint on the statistical deviation from baseline system activity. We demonstrate that our evolved attack patterns can evade behavioral monitors under fingerprinting techniques. Our results suggest that search-based methods provide a powerful framework for generating evasive malware, highlighting an emerging challenge for automated software defense.

Problem

• ransomware
• detection
• persistence
• encryption
• evasion

Innovation

• Genetic Algorithm
• Search-Based Software Engineering
• Low-Entropy Ransomware
• Behavioral Monitors Evasion