Open Access

ARTICLE

A Ransomware Detection Approach Based on LLM Embedding and Ensemble Learning

Abdallah Ghourabi^1,*, Hassen Chouaib²

1 Department of Computer Science, College of Computer and Information Sciences, Jouf University, Sakaka, Saudi Arabia
2 College of Science, Jouf University, Sakaka, Saudi Arabia

* Corresponding Author: Abdallah Ghourabi. Email:

Computers, Materials & Continua 2026, 87(1), 98 https://doi.org/10.32604/cmc.2026.074505

Received 13 October 2025; Accepted 05 January 2026; Issue published 10 February 2026

Abstract

In recent years, ransomware attacks have become one of the most common and destructive types of cyberattacks. Their impact is significant on the operations, finances and reputation of affected companies. Despite the efforts of researchers and security experts to protect information systems from these attacks, the threat persists and the proposed solutions are not able to significantly stop the spread of ransomware attacks. The latest remarkable achievements of large language models (LLMs) in NLP tasks have caught the attention of cybersecurity researchers to integrate these models into security threat detection. These models offer high embedding capabilities, able to extract rich semantic representations and paving the way for more accurate and adaptive solutions. In this context, we propose a new approach for ransomware detection based on an ensemble method that leverages three distinct LLM embedding models. This ensemble strategy takes advantage of the variety of embedding methods and the strengths of each model. In the proposed solution, each embedding model is associated with an independently trained MLP classifier. The predictions obtained are then merged using a weighted voting technique, assigning each model an influence proportional to its performance. This approach makes it possible to exploit the complementarity of representations, improve detection accuracy and robustness, and offer a more reliable solution in the face of the growing diversity and complexity of modern ransomware.

---

Keywords

---