FlagThis

Abstract

Ransomware has evolved into a complex, adaptive, and fastmoving adversary category in which static signatures and monolithic classifiers fail to generalise under concept drift, evasion, and behavioural polymorphism. In this paper we present Agentic SABRE (SemanticBehavioural Arbitration for Ransomware Evaluation) : an uncertainty-aware, neurosymbolic, multiagent framework for adaptive ransomware detection. SABRE fuses semantic (representation-based) and behavioural (timewindow forensic telemetry) evidence, and employs Monte Carlo Dropout inference to quantify epistemic uncertainty for each agent. We introduce a decision-layer orchestrator that performs risk and uncertainty-aware triage via two interpretable thresholds: a risk score and an uncertainty budget. High-confidence, high-risk samples are automatically contained, while uncertain or borderline cases are escalated to human analysts, establishing a flexible computational contract between autonomous response and analyst oversight. To support auditability and trust, SABRE integrates posthoc explainability mechanisms including gradient saliency, permutation importance, and counterfactual analysis, enabling both local and global interpretation of agent decisions. Extensive evaluation on RDset and RanSMAP demonstrates that Agentic SABRE preserves perfect discrimination on saturated semantic datasets (AUC = 1.0) while improving robustness under weak behavioural signals, achieving up to a 4.9% relative reduction in false escalations at equal recall and maintaining calibrated predictive uncertainty. Counterfactual analysis further shows that semantic and behavioural decisions can be flipped with bounded perturbation cost, indicating stable and interpretable decision boundaries. Overall, Agentic SABRE is not merely a higher-accuracy detector but an agentic cyber-defence system that combines uncertainty-aware automation, explainable reasoning, and adaptive triage under evolving ransomware threats.