Agentic SABRE: An Uncertainty-Aware Neuro-Symbolic Multi-Agent Framework for Adaptive Ransomware Detection

Jul 16, 2026

Upload by Ivy

Adaptive ransomware detection requires uncertainty-aware systems because static signatures and monolithic classifiers fail under concept drift, evasion, and behavioural polymorphism. Agentic SABRE (Semantic–Behavioural Arbitration for Ransomware Evaluation) combines semantic evidence and time-window forensic telemetry, using Monte Carlo Dropout to estimate epistemic uncertainty per agent. A decision-layer orchestrator performs risk/uncertainty triage with interpretable thresholds and escalates uncertain cases to analysts. Post-hoc explainability enables local and global auditing, while evaluations on RDset and RanSMAP show strong discrimination and improved robustness under weak signals.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages34

Reading Time1 h 26 min

Abstract

1. Introduction

Background: Evolution and limitations of ransomware detection

Motivation: Uncertainty and human–AI interaction

Proposed approach: Agentic SABRE framework

arXiv :2607 .04292v 1 [ cs .AI ] 5 Jul 2026 Agentic SABRE: An Uncertainty-Aware Neuro-Symbolic Multi-Agent Framework for Adaptive Ransomware Detection Henry Kabuyea , Biju Issaca,∗, Jeyamohan Neeraa a School of Computer Science, Northumbria University, Newcastle Upon Tyne, UK Abstract Ransomware has evolved into a complex, adaptive, and fast–moving adversary category in which static signatures and monolithic classifiers fail to generalise under concept drift, evasion, and behavioural polymorphism. In this paper we present Agentic SABRE (Semantic–Behavioural Arbitration for Ransomware Evaluation): an uncertainty–aware, neuro–symbolic, multi–agent framework for adaptive ransomware detection. SABRE fuses semantic (representation–based) and behavioural (time–window forensic telemetry) evidence, and employs Monte Carlo Dropout inference to quantify epistemic uncertainty for each agent. We introduce a decision–layer orchestrator that performs risk– and uncertainty–aware triage via two interpretable thresholds: a risk score τ and an uncertainty budget κ . High–confidence, high–risk samples are automatically contained, while uncertain or borderline cases are escalated to human analysts, establishing a flexible computational contract between autonomous response and analyst oversight. To support auditability and trust, SABRE integrates post–hoc explainability mechanisms including gradient saliency, permutation importance, and counterfactual analysis, enabling both local and global interpretation of agent decisions. Extensive evaluation on RDset and RanSMAP demonstrates that Agentic SABRE preserves perfect discrimination on saturated semantic datasets (AUC = 1 .0) while improving robustness under weak behavioural signals, achieving up to a 4.9% relative reduction in false escalations at equal recall and maintaining calibrated predictive uncertainty. Counterfactual analysis further shows that semantic and behavioural decisions can be flipped with bounded perturbation cost, indicating stable and interpretable decision boundaries. Overall, Agentic SABRE is not merely a higher–accuracy detector but an agentic cyber–defence system that combines uncertainty–aware automation, explainable reasoning, and adaptive triage under evolving ransomware threats. Keywords: Ransomware Detection, Explainable Artificial Intelligence, Uncertainty Estimation, Multi-Agent Systems, Semantic Embeddings, Data Augmentation 1. Introduction Ransomware has become one of the most disruptive forms of cybercrime, with modern families exhibiting rapid mutation, behavioural polymorphism, and highly adaptive strategies designed to evade both traditional signature-based defences and contemporary machine learning detectors [1, 2] . These strains frequently employ advanced obfuscation, polymorphism, and metamorphism to alter operational behaviour and code signatures, undermining static detection techniques and forcing dependence on behavioural and AI-based methods [1, 3] . Enterprise environments now operate under continuous concept drift, where benign and malicious behaviours evolve over time and trained models degrade in performance unless retrained or adapted [4] . Static classifiers that assume fixed data distributions consequently suffer rapid decay in effectiveness as attacker strategies evolve [5, 2] . These trends expose the limitations of monolithic ransomware classifiers that ∗ Corresponding author Email address: [bissac@ieee.org](bissac@ieee.org) (Biju Issac) lack explicit representations of uncertainty, fail to adapt to temporal distributional changes without costly retraining, and provide no mechanism for calibrated human–AI interaction, a gap increasingly recognised in both malware analytics and adaptive learning research. Machine learning has been increasingly applied to ransomware detection, ranging from classical featurebased models to deep learning approaches that operate on system call traces, filesystem activity, API semantics, a

FAQs

What problem does Agentic SABRE address in ransomware detection?

It addresses the failure of static signatures and monolithic classifiers to generalize under concept drift, evasion, and behavioural polymorphism, especially due to the lack of calibrated uncertainty for safe autonomous containment.

How does Agentic SABRE quantify uncertainty?

Each agent uses Monte Carlo Dropout inference to produce calibrated estimates of epistemic uncertainty, allowing the system to identify high-confidence versus ambiguous predictions.

How are decisions made and communicated to analysts?

A decision-layer orchestrator fuses agent scores and applies interpretable thresholds: a risk score (τ) and an uncertainty budget (κ). High-risk, low-uncertainty samples are contained automatically, while uncertain or borderline cases are escalated for human review.

Jul 16, 2026

Upload by Ivy