Learning the Language of NVMe Streams for Ransomware Detection

TL;DR

This paper introduces transformer-based language models to detect ransomware in NVMe command streams, significantly improving detection accuracy and data loss prevention over existing methods.

Contribution

It presents novel transformer models and tokenization schemes tailored for NVMe command sequences, advancing ransomware detection techniques.

Findings

Up to 24% reduction in missed detection rate

66% improvement in data loss prevention

84% accuracy in identifying accessed data

Abstract

We apply language modeling techniques to detect ransomware activity in NVMe command sequences. We design and train two types of transformer-based models: the Command-Level Transformer (CLT) performs in-context token classification to determine whether individual commands are initiated by ransomware, and the Patch-Level Transformer (PLT) predicts the volume of data accessed by ransomware within a patch of commands. We present both model designs and the corresponding tokenization and embedding schemes and show that they improve over state-of-the-art tabular methods by up to 24% in missed-detection rate, 66% in data loss prevention, and 84% in identifying data accessed by ransomware.