{"id":"https://openalex.org/W4411965731","doi":"https://doi.org/10.1016/j.hcc.2025.100338","title":"A novel zero-day ransomware detection approach based on CVAE and 1D-CNN","display_name":"A novel zero-day ransomware detection approach based on CVAE and 1D-CNN","publication_year":2025,"publication_date":"2025-07-02","ids":{"openalex":"https://openalex.org/W4411965731","doi":"https://doi.org/10.1016/j.hcc.2025.100338"},"language":"en","primary_location":{"id":"doi:10.1016/j.hcc.2025.100338","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.hcc.2025.100338","pdf_url":null,"source":{"id":"https://openalex.org/S4210186527","display_name":"High-Confidence Computing","issn_l":"2667-2952","issn":["2667-2952"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"High-Confidence Computing","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1016/j.hcc.2025.100338","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Bohan Cui","orcid":null},"institutions":[{"id":"https://openalex.org/I92403157","display_name":"University of Science and Technology Beijing","ror":"https://ror.org/02egmk993","country_code":"CN","type":"education","lineage":["https://openalex.org/I92403157"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Bohan Cui","raw_affiliation_strings":["School of Computer and Communication Engineering, University of Science and Technology, Beijing 100083, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computer and Communication Engineering, University of Science and Technology, Beijing 100083, China","institution_ids":["https://openalex.org/I92403157"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5031731760","display_name":"Yan Hu","orcid":"https://orcid.org/0000-0002-0048-3474"},"institutions":[{"id":"https://openalex.org/I92403157","display_name":"University of Science and Technology Beijing","ror":"https://ror.org/02egmk993","country_code":"CN","type":"education","lineage":["https://openalex.org/I92403157"]}],"countries":["CN"],"is_corresponding":true,"raw_author_name":"Yan Hu","raw_affiliation_strings":["School of Computer and Communication Engineering, University of Science and Technology, Beijing 100083, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computer and Communication Engineering, University of Science and Technology, Beijing 100083, China","institution_ids":["https://openalex.org/I92403157"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5046828055","display_name":"Tan Qu","orcid":"https://orcid.org/0000-0001-9106-7064"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Tianheng Qu","raw_affiliation_strings":["Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100085, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100085, China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5009109404","display_name":"Yunhua He","orcid":"https://orcid.org/0000-0001-8971-3936"},"institutions":[{"id":"https://openalex.org/I1456306","display_name":"North China University of Technology","ror":"https://ror.org/01nky7652","country_code":"CN","type":"education","lineage":["https://openalex.org/I1456306"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yunhua He","raw_affiliation_strings":["School of Information Science and Technology, North China University of Technology, Beijing 100144, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Information Science and Technology, North China University of Technology, Beijing 100144, China","institution_ids":["https://openalex.org/I1456306"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5101820083","display_name":"Limin Sun","orcid":"https://orcid.org/0000-0002-6578-0680"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Limin Sun","raw_affiliation_strings":["Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100085, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100085, China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5031731760"],"corresponding_institution_ids":["https://openalex.org/I92403157"],"apc_list":{"value":1500,"currency":"USD","value_usd":1500},"apc_paid":{"value":1500,"currency":"USD","value_usd":1500},"fwci":0.6439,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":{"value":0.67284593,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":"6","issue":"1","first_page":"100338","last_page":"100338"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9962000250816345,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9876000285148621,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/zero","display_name":"Zero (linguistics)","score":0.6380676627159119},{"id":"https://openalex.org/keywords/ransomware","display_name":"Ransomware","score":0.6205973625183105},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.46503323316574097},{"id":"https://openalex.org/keywords/econometrics","display_name":"Econometrics","score":0.43386268615722656},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.3928880989551544},{"id":"https://openalex.org/keywords/statistics","display_name":"Statistics","score":0.3545061945915222},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.32240620255470276},{"id":"https://openalex.org/keywords/mathematics","display_name":"Mathematics","score":0.2406213879585266},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.2157025933265686},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.16577225923538208}],"concepts":[{"id":"https://openalex.org/C2780813799","wikidata":"https://www.wikidata.org/wiki/Q3274237","display_name":"Zero (linguistics)","level":2,"score":0.6380676627159119},{"id":"https://openalex.org/C2777667771","wikidata":"https://www.wikidata.org/wiki/Q926331","display_name":"Ransomware","level":3,"score":0.6205973625183105},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.46503323316574097},{"id":"https://openalex.org/C149782125","wikidata":"https://www.wikidata.org/wiki/Q160039","display_name":"Econometrics","level":1,"score":0.43386268615722656},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3928880989551544},{"id":"https://openalex.org/C105795698","wikidata":"https://www.wikidata.org/wiki/Q12483","display_name":"Statistics","level":1,"score":0.3545061945915222},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.32240620255470276},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.2406213879585266},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.2157025933265686},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.16577225923538208},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0},{"id":"https://openalex.org/C41895202","wikidata":"https://www.wikidata.org/wiki/Q8162","display_name":"Linguistics","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1016/j.hcc.2025.100338","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.hcc.2025.100338","pdf_url":null,"source":{"id":"https://openalex.org/S4210186527","display_name":"High-Confidence Computing","issn_l":"2667-2952","issn":["2667-2952"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"High-Confidence Computing","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:9da8c80b4b8e46d4a314e5b60e4743e8","is_oa":false,"landing_page_url":"https://doaj.org/article/9da8c80b4b8e46d4a314e5b60e4743e8","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"High-Confidence Computing, Vol 6, Iss 1, Pp 100338- (2026)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1016/j.hcc.2025.100338","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.hcc.2025.100338","pdf_url":null,"source":{"id":"https://openalex.org/S4210186527","display_name":"High-Confidence Computing","issn_l":"2667-2952","issn":["2667-2952"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"High-Confidence Computing","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G4575716184","display_name":null,"funder_award_id":"62272007","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G4993645431","display_name":null,"funder_award_id":"FRF-IDRY-24-015","funder_id":"https://openalex.org/F4320335787","funder_display_name":"Fundamental Research Funds for the Central Universities"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320325365","display_name":"University of Science and Technology Beijing","ror":"https://ror.org/02egmk993"},{"id":"https://openalex.org/F4320335787","display_name":"Fundamental Research Funds for the Central Universities","ror":null}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":39,"referenced_works":["https://openalex.org/W2266293701","https://openalex.org/W2756675797","https://openalex.org/W2762151798","https://openalex.org/W2802988977","https://openalex.org/W2885747980","https://openalex.org/W2913409763","https://openalex.org/W2947802941","https://openalex.org/W2998010923","https://openalex.org/W3000953536","https://openalex.org/W3095782565","https://openalex.org/W3174684718","https://openalex.org/W3201224956","https://openalex.org/W3208935820","https://openalex.org/W3214926740","https://openalex.org/W3215200159","https://openalex.org/W4205839607","https://openalex.org/W4214733430","https://openalex.org/W4281945774","https://openalex.org/W4293742266","https://openalex.org/W4312075150","https://openalex.org/W4322487670","https://openalex.org/W4364382428","https://openalex.org/W4366265333","https://openalex.org/W4380990032","https://openalex.org/W4383646076","https://openalex.org/W4390673835","https://openalex.org/W4394893882","https://openalex.org/W4397007959","https://openalex.org/W4399412863","https://openalex.org/W4402675096","https://openalex.org/W4403819839","https://openalex.org/W4408771655","https://openalex.org/W6769495366","https://openalex.org/W6785329633","https://openalex.org/W6850034149","https://openalex.org/W6851769057","https://openalex.org/W6866694130","https://openalex.org/W6872634348","https://openalex.org/W6950146200"],"related_works":["https://openalex.org/W3201228709","https://openalex.org/W2922354075","https://openalex.org/W4389157351","https://openalex.org/W4232561318","https://openalex.org/W3202245533","https://openalex.org/W4253977752","https://openalex.org/W2942879794","https://openalex.org/W2964829536","https://openalex.org/W2904586340","https://openalex.org/W3120595989"],"abstract_inverted_index":{"Ransomware":[0],"has":[1],"emerged":[2],"as":[3],"one":[4],"of":[5,68,72,106,128,207],"the":[6,66,107,122,151,164,204,208,222],"most":[7],"prevalent":[8],"and":[9,24,39,114,183,195],"destructive":[10],"cyber":[11,61],"attacks":[12,31,75],"confronting":[13],"global":[14],"organizations.":[15],"By":[16],"locking":[17],"critical":[18],"devices":[19],"or":[20],"encrypting":[21],"essential":[22],"data":[23],"then":[25],"demanding":[26],"payment":[27],"for":[28,180],"restoration,":[29],"ransomware":[30,46,74,86,229],"disrupt":[32],"operations,":[33],"result":[34],"in":[35,211],"significant":[36,78],"financial":[37],"losses,":[38],"damage":[40],"organizational":[41],"reputations.":[42],"In":[43],"particular,":[44],"zero-day":[45,73,85,213,228],"attacks,":[47],"which":[48],"attempt":[49],"to":[50,59,65],"exploit":[51],"previously":[52],"unknown":[53,196],"vulnerabilities,":[54],"pose":[55],"a":[56,77,83,91,98,111,115,135,140,146],"severe":[57],"threat":[58],"existing":[60],"security":[62],"solutions.":[63],"Due":[64],"lack":[67],"training":[69],"data,":[70],"detection":[71,87],"remains":[76],"challenge.":[79],"This":[80,172],"paper":[81],"proposes":[82],"novel":[84],"framework":[88],"that":[89,221],"integrates":[90],"refined":[92],"Conditional":[93],"Variational":[94],"Autoencoder":[95],"(CVAE)":[96],"with":[97,145,163],"1D":[99],"Convolutional":[100],"Neural":[101],"Network":[102],"(1D-CNN).":[103],"The":[104,198,215],"encoder":[105],"CVAE":[108],"model":[109],"comprises":[110],"posterior":[112,123,165],"network":[113,124,153,166],"parallel":[116],"prior":[117,152],"network.":[118],"Using":[119],"variational":[120],"coding,":[121],"maps":[125],"behavioral":[126],"features":[127],"software":[129,191],"samples":[130,192],"from":[131,193],"known":[132,194],"families":[133],"into":[134],"latent":[136,177,200],"space,":[137],"represented":[138],"by":[139],"fixed":[141],"multivariate":[142],"Gaussian":[143],"distribution":[144],"diagonal":[147],"covariance":[148],"matrix.":[149],"Simultaneously,":[150],"eliminates":[154],"dependency":[155],"on":[156],"class":[157],"labels":[158],"while":[159],"maintaining":[160],"distributional":[161,188],"consistency":[162],"via":[167],"Kullback\u2013Leibler":[168],"(KL)":[169],"divergence":[170],"minimization.":[171],"dual-network":[173],"structure":[174],"enables":[175],"unified":[176],"space":[178],"mapping":[179],"both":[181],"labeled":[182],"unlabeled":[184],"samples,":[185],"effectively":[186,226],"narrowing":[187],"discrepancies":[189],"between":[190],"families.":[197],"harmonized":[199],"representations":[201],"subsequently":[202],"enhance":[203],"discriminative":[205],"capability":[206],"1D-CNN":[209],"classifier":[210],"detecting":[212],"ransomware.":[214],"comprehensive":[216],"experimental":[217],"results":[218],"have":[219],"verified":[220],"proposed":[223],"method":[224],"can":[225],"detect":[227],"attacks.":[230]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-07-22T07:51:19.307946","created_date":"2025-10-10T00:00:00"}