{"id":"https://openalex.org/W7204175158","doi":"https://doi.org/10.1109/access.2026.3727310","title":"Deep MCRan: Hybrid Analysis-Based Ransomware Detection Using Multi-Channel Data Fusion","display_name":"Deep MCRan: Hybrid Analysis-Based Ransomware Detection Using Multi-Channel Data Fusion","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W7204175158","doi":"https://doi.org/10.1109/access.2026.3727310"},"language":"en","primary_location":{"id":"doi:10.1109/access.2026.3727310","doi":"https://doi.org/10.1109/access.2026.3727310","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2026.3727310","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["anvur-scientific","cwts-core","doaj","jufo-1","ki-jl-1","norway-1","oarl","poland-100","russia-white-list-1","vabb-shw"],"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"volume":null,"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1109/access.2026.3727310","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5037553570","display_name":"Sibel Gulmez","orcid":"https://orcid.org/0000-0003-0649-1448","observed_orcids":["https://orcid.org/0000-0003-0649-1448"]},"institutions":[{"id":"https://openalex.org/I109297418","display_name":"Gebze Technical University","ror":"https://ror.org/01sdnnq10","country_code":"TR","type":"education","lineage":["https://openalex.org/I109297418"]}],"countries":["TR"],"is_corresponding":false,"raw_author_name":"Sibel Gulmez","raw_affiliation_strings":["Gebze Technical University"],"raw_orcid":"https://orcid.org/0000-0003-0649-1448","affiliations":[{"raw_affiliation_string":"Gebze Technical University","institution_ids":["https://openalex.org/I109297418"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5086380004","display_name":"Arzu Gorgulu Kakisim","orcid":"https://orcid.org/0000-0001-6169-3486","observed_orcids":["https://orcid.org/0000-0001-6169-3486"]},"institutions":[{"id":"https://openalex.org/I4101805","display_name":"Y\u0131ld\u0131z Technical University","ror":"https://ror.org/0547yzj13","country_code":"TR","type":"education","lineage":["https://openalex.org/I4101805"]}],"countries":["TR"],"is_corresponding":false,"raw_author_name":"Arzu Gorgulu Kakisim","raw_affiliation_strings":["Y\u0131ld\u0131z Technical University"],"raw_orcid":"https://orcid.org/0000-0001-6169-3486","affiliations":[{"raw_affiliation_string":"Y\u0131ld\u0131z Technical University","institution_ids":["https://openalex.org/I4101805"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5073396133","display_name":"\u0130brahim So\u011fukp\u0131nar","orcid":"https://orcid.org/0000-0002-0408-0277","observed_orcids":["https://orcid.org/0000-0002-0408-0277"]},"institutions":[{"id":"https://openalex.org/I101840525","display_name":"Piri Reis University","ror":"https://ror.org/02eq60031","country_code":"TR","type":"education","lineage":["https://openalex.org/I101840525"]}],"countries":["TR"],"is_corresponding":false,"raw_author_name":"Ibrahim Sogukpinar","raw_affiliation_strings":["Piri Reis University"],"raw_orcid":"https://orcid.org/0000-0002-0408-0277","affiliations":[{"raw_affiliation_string":"Piri Reis University","institution_ids":["https://openalex.org/I101840525"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":2075,"currency":"USD","value_usd":2075},"apc_paid":{"value":2075,"currency":"USD","value_usd":2075},"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.63426866,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"14","issue":null,"first_page":"131574","last_page":"131594"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/ransomware-detection","display_name":"ransomware detection","score":1.0},{"id":"https://openalex.org/keywords/hybrid-static-dynamic-analysis","display_name":"hybrid static-dynamic analysis","score":0.8880000114440918},{"id":"https://openalex.org/keywords/multi-channel-data-fusion","display_name":"multi-channel data fusion","score":0.9610000252723694},{"id":"https://openalex.org/keywords/deep-learning","display_name":"deep learning","score":0.6299999952316284},{"id":"https://openalex.org/keywords/obfuscated-malware","display_name":"obfuscated malware","score":0.5730000138282776},{"id":"https://openalex.org/keywords/api-call-sequences","display_name":"API call sequences","score":0.6620000004768372},{"id":"https://openalex.org/keywords/dynamic-link-library","display_name":"dynamic link library","score":0.9169999957084656},{"id":"https://openalex.org/keywords/mutual-exclusion","display_name":"mutual exclusion","score":0.765999972820282},{"id":"https://openalex.org/keywords/real-time-malware-detection","display_name":"real-time malware detection","score":0.7179999947547913}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7613000273704529},{"id":"https://openalex.org/C2777667771","wikidata":"https://www.wikidata.org/wiki/Q926331","display_name":"Ransomware","level":3,"score":0.5719000101089478},{"id":"https://openalex.org/C33954974","wikidata":"https://www.wikidata.org/wiki/Q486494","display_name":"Sensor fusion","level":2,"score":0.43849998712539673},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.39480000734329224},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3407999873161316},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3384999930858612},{"id":"https://openalex.org/C158525013","wikidata":"https://www.wikidata.org/wiki/Q2593739","display_name":"Fusion","level":2,"score":0.3156999945640564},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.288100004196167},{"id":"https://openalex.org/C152745839","wikidata":"https://www.wikidata.org/wiki/Q5438153","display_name":"Fault detection and isolation","level":3,"score":0.2858999967575073},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.2653000056743622},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.2578999996185303},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.2572999894618988},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.2572000026702881}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1109/access.2026.3727310","doi":"https://doi.org/10.1109/access.2026.3727310","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2026.3727310","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["anvur-scientific","cwts-core","doaj","jufo-1","ki-jl-1","norway-1","oarl","poland-100","russia-white-list-1","vabb-shw"],"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},{"id":"pmh:52225558-8844-404e-afda-d3b31f06eb38","doi":null,"is_oa":false,"landing_page_url":"https://avesis.yildiz.edu.tr/publication/details/52225558-8844-404e-afda-d3b31f06eb38/oai","pdf_url":null,"source":{"id":"https://openalex.org/S7407055331","display_name":"Yildiz Technical University - AVESIS","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"info:eu-repo/semantics/article"},{"id":"pmh:oai:doaj.org/article:9c7cc0750d8544b98c4aa756db057e5c","doi":null,"is_oa":false,"landing_page_url":"https://doaj.org/article/9c7cc0750d8544b98c4aa756db057e5c","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Access, Vol 14, Pp 131574-131594 (2026)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1109/access.2026.3727310","doi":"https://doi.org/10.1109/access.2026.3727310","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2026.3727310","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["anvur-scientific","cwts-core","doaj","jufo-1","ki-jl-1","norway-1","oarl","poland-100","russia-white-list-1","vabb-shw"],"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320322626","display_name":"T\u00fcrkiye Bilimsel ve Teknolojik Ara\u015ft\u0131rma Kurumu","ror":"https://ror.org/04w9kkr77"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":44,"referenced_works":["https://openalex.org/W1832693441","https://openalex.org/W2021963610","https://openalex.org/W2062429610","https://openalex.org/W2347098755","https://openalex.org/W2747715470","https://openalex.org/W2756675797","https://openalex.org/W2785743295","https://openalex.org/W2794482868","https://openalex.org/W2802988977","https://openalex.org/W2885747980","https://openalex.org/W2898664598","https://openalex.org/W2925226405","https://openalex.org/W2971086125","https://openalex.org/W2989588798","https://openalex.org/W2990927456","https://openalex.org/W3000953536","https://openalex.org/W3015605314","https://openalex.org/W3021147902","https://openalex.org/W3024417278","https://openalex.org/W3091730061","https://openalex.org/W3092353577","https://openalex.org/W3099702369","https://openalex.org/W3119994573","https://openalex.org/W3133336665","https://openalex.org/W3138173041","https://openalex.org/W3161733511","https://openalex.org/W3175671845","https://openalex.org/W3202003292","https://openalex.org/W3210786851","https://openalex.org/W4205839607","https://openalex.org/W4281394465","https://openalex.org/W4366265333","https://openalex.org/W4366447842","https://openalex.org/W4378417300","https://openalex.org/W4386988695","https://openalex.org/W4390673835","https://openalex.org/W4391785438","https://openalex.org/W4402901778","https://openalex.org/W4405272362","https://openalex.org/W4405898319","https://openalex.org/W4414639221","https://openalex.org/W4416961692","https://openalex.org/W7126119465","https://openalex.org/W7154566461"],"related_works":["https://openalex.org/W4415883906","https://openalex.org/W7107945905","https://openalex.org/W4404027714","https://openalex.org/W4390673835","https://openalex.org/W7213449256","https://openalex.org/W4414943549","https://openalex.org/W7163707459","https://openalex.org/W4414398492","https://openalex.org/W4378417300","https://openalex.org/W2973070188"],"abstract_inverted_index":{"Ransomware":[0],"has":[1],"emerged":[2],"as":[3],"one":[4],"of":[5,103,109,162],"the":[6,41,100,107,246],"most":[7,74],"destructive":[8],"cybersecurity":[9],"threats,":[10],"causing":[11],"substantial":[12],"financial":[13],"losses":[14],"and":[15,22,37,66,96,106,131,152,191,214,225,244],"operational":[16],"disruptions.":[17],"Attackers":[18],"increasingly":[19,33],"employ":[20],"obfuscation":[21],"evasion":[23],"techniques":[24],"to":[25,88,99,201],"bypass":[26],"traditional":[27],"security":[28],"mechanisms,":[29],"making":[30,69],"reliable":[31],"detection":[32,71,81,94,126,248],"difficult.":[34],"Although":[35],"static":[36,130],"dynamic":[38,61,104,132],"analysis":[39,62,199,209],"remain":[40],"primary":[42],"approaches":[43,85],"for":[44],"ransomware":[45,125,163,217,242],"detection,":[46],"each":[47,158],"suffers":[48],"from":[49],"fundamental":[50],"limitations.":[51],"Static":[52],"methods":[53,229],"are":[54],"often":[55],"ineffective":[56],"against":[57],"obfuscated":[58],"code,":[59],"whereas":[60],"requires":[63],"significant":[64],"time":[65,200,210],"computational":[67,170],"resources,":[68],"real-time":[70,216],"impractical":[72],"in":[73],"cases.":[75],"These":[76],"limitations":[77],"have":[78],"motivated":[79],"hybrid":[80,124],"strategies.":[82],"However,":[83],"existing":[84],"still":[86],"struggle":[87],"achieve":[89],"an":[90],"effective":[91],"balance":[92],"between":[93],"accuracy":[95,190],"efficiency":[97],"due":[98],"high":[101],"cost":[102],"execution":[105],"difficulty":[108],"integrating":[110],"heterogeneous":[111],"behavioral":[112],"features.":[113],"To":[114],"address":[115],"these":[116],"challenges,":[117],"we":[118],"propose":[119],"Deep":[120,186,232],"MCRan,":[121],"a":[122,135,192],"multi-channel":[123,166],"framework":[127],"that":[128,185,231],"integrates":[129],"information":[133,174],"within":[134],"unified":[136],"deep":[137],"learning":[138,179],"architecture.":[139],"The":[140,207,219],"proposed":[141],"method":[142],"processes":[143],"operation":[144],"codes,":[145],"Application":[146],"Programming":[147],"Interface":[148],"calls,":[149],"dynamic-link":[150],"libraries,":[151],"mutual":[153],"exclusions":[154],"through":[155,176],"dedicated":[156],"channels,":[157],"capturing":[159],"complementary":[160,177],"aspects":[161],"execution.":[164],"This":[165],"fusion":[167],"architecture":[168],"reduces":[169],"complexity":[171],"while":[172,197],"mitigating":[173],"loss":[175],"feature":[178],"across":[180,236],"channels.":[181],"Experimental":[182],"results":[183],"demonstrate":[184,230],"MCRan":[187,233],"achieves":[188],"99.1%":[189],"98.5%":[193],"true":[194],"positive":[195],"rate,":[196],"reducing":[198],"approximately":[202],"2":[203],"seconds":[204],"per":[205],"sample.":[206],"reduced":[208],"supports":[211],"practical":[212],"deployment":[213],"near":[215],"detection.":[218],"evaluations":[220],"on":[221],"three":[222],"additional":[223],"datasets":[224],"comparisons":[226],"with":[227],"state-of-the-art":[228],"generalizes":[234],"well":[235],"datasets,":[237],"effectively":[238],"detects":[239],"previously":[240],"unseen":[241],"families,":[243],"outperforms":[245],"compared":[247],"methods.":[249]},"counts_by_year":[],"updated_date":"2026-10-08T09:06:37.294493","created_date":"2026-08-26T00:00:00"}