Hierarchical Ransomware Agents Escalate to Dynamic and Memory Analysis Only on Specialist Disagreement

arXiv 2609.04820·low signalXBlueskyLinkedInCopy link

arXiv 2609.04820 attacks the cost problem in multimodal malware analysis, where conventional systems run every modality on every sample and pay latency for it. Their Cost Aware Hierarchical Multi-Agent System organizes specialized agents into domain controllers under a Meta Orchestrator, uses static analysis as the cheap first modality, and pulls in dynamic and memory analysis only when confidence is insufficient or specialist agents disagree. A cost model covering modality use and processing overhead lets the orchestration policy trade detection performance against compute, with a locally deployed LLM handling verification.