{"id":"https://openalex.org/W7164749218","doi":"https://doi.org/10.1016/j.jisa.2026.104547","title":"Rethinking ransomware defense in the age of generative AI","display_name":"Rethinking ransomware defense in the age of generative AI","publication_year":2026,"publication_date":"2026-06-14","ids":{"openalex":"https://openalex.org/W7164749218","doi":"https://doi.org/10.1016/j.jisa.2026.104547"},"language":"en","primary_location":{"id":"doi:10.1016/j.jisa.2026.104547","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.jisa.2026.104547","pdf_url":null,"source":{"id":"https://openalex.org/S4210191536","display_name":"Journal of Information Security and Applications","issn_l":"2214-2126","issn":["2214-2126","2214-2134"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Information Security and Applications","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1016/j.jisa.2026.104547","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5138602019","display_name":"Nelly Elsayed","orcid":null},"institutions":[{"id":"https://openalex.org/I63135867","display_name":"University of Cincinnati","ror":"https://ror.org/01e3m7079","country_code":"US","type":"education","lineage":["https://openalex.org/I63135867"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Nelly Elsayed","raw_affiliation_strings":["School of Information Technology, University of Cincinnati, Cincinnati, OH, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Information Technology, University of Cincinnati, Cincinnati, OH, USA","institution_ids":["https://openalex.org/I63135867"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5138602019"],"corresponding_institution_ids":["https://openalex.org/I63135867"],"apc_list":{"value":2860,"currency":"USD","value_usd":2860},"apc_paid":{"value":2860,"currency":"USD","value_usd":2860},"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.74571873,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"101","issue":null,"first_page":"104547","last_page":"104547"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.7595999836921692,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.7595999836921692,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.13500000536441803,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.012799999676644802,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/operationalization","display_name":"Operationalization","score":0.6700000166893005},{"id":"https://openalex.org/keywords/generative-grammar","display_name":"Generative grammar","score":0.5960999727249146},{"id":"https://openalex.org/keywords/discriminative-model","display_name":"Discriminative model","score":0.4205000102519989},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.3968000113964081},{"id":"https://openalex.org/keywords/generative-model","display_name":"Generative model","score":0.3837999999523163},{"id":"https://openalex.org/keywords/big-data","display_name":"Big data","score":0.3763999938964844},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.3732999861240387}],"concepts":[{"id":"https://openalex.org/C9354725","wikidata":"https://www.wikidata.org/wiki/Q286017","display_name":"Operationalization","level":2,"score":0.6700000166893005},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.657800018787384},{"id":"https://openalex.org/C39890363","wikidata":"https://www.wikidata.org/wiki/Q36108","display_name":"Generative grammar","level":2,"score":0.5960999727249146},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5095999836921692},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.44209998846054077},{"id":"https://openalex.org/C97931131","wikidata":"https://www.wikidata.org/wiki/Q5282087","display_name":"Discriminative model","level":2,"score":0.4205000102519989},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.41179999709129333},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.3968000113964081},{"id":"https://openalex.org/C167966045","wikidata":"https://www.wikidata.org/wiki/Q5532625","display_name":"Generative model","level":3,"score":0.3837999999523163},{"id":"https://openalex.org/C75684735","wikidata":"https://www.wikidata.org/wiki/Q858810","display_name":"Big data","level":2,"score":0.3763999938964844},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.3732999861240387},{"id":"https://openalex.org/C2777667771","wikidata":"https://www.wikidata.org/wiki/Q926331","display_name":"Ransomware","level":3,"score":0.3506999909877777},{"id":"https://openalex.org/C2779585090","wikidata":"https://www.wikidata.org/wiki/Q3457762","display_name":"Resilience (materials science)","level":2,"score":0.3400000035762787},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.337799996137619},{"id":"https://openalex.org/C79158427","wikidata":"https://www.wikidata.org/wiki/Q485396","display_name":"Analytics","level":2,"score":0.3337000012397766},{"id":"https://openalex.org/C139807058","wikidata":"https://www.wikidata.org/wiki/Q352374","display_name":"Adaptation (eye)","level":2,"score":0.32910001277923584},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.3140000104904175},{"id":"https://openalex.org/C2777381055","wikidata":"https://www.wikidata.org/wiki/Q308922","display_name":"Damages","level":2,"score":0.30300000309944153},{"id":"https://openalex.org/C2776576444","wikidata":"https://www.wikidata.org/wiki/Q303569","display_name":"Attack surface","level":2,"score":0.2777000069618225},{"id":"https://openalex.org/C62230096","wikidata":"https://www.wikidata.org/wiki/Q275969","display_name":"Crowdsourcing","level":2,"score":0.26589998602867126}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1016/j.jisa.2026.104547","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.jisa.2026.104547","pdf_url":null,"source":{"id":"https://openalex.org/S4210191536","display_name":"Journal of Information Security and Applications","issn_l":"2214-2126","issn":["2214-2126","2214-2134"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Information Security and Applications","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1016/j.jisa.2026.104547","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.jisa.2026.104547","pdf_url":null,"source":{"id":"https://openalex.org/S4210191536","display_name":"Journal of Information Security and Applications","issn_l":"2214-2126","issn":["2214-2126","2214-2134"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Information Security and Applications","raw_type":"journal-article"},"sustainable_development_goals":[{"score":0.5738291144371033,"display_name":"Reduced inequalities","id":"https://metadata.un.org/sdg/10"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":38,"referenced_works":["https://openalex.org/W2463535935","https://openalex.org/W2524919294","https://openalex.org/W2534101229","https://openalex.org/W2603850163","https://openalex.org/W2784113120","https://openalex.org/W2886257824","https://openalex.org/W2904130890","https://openalex.org/W2963604227","https://openalex.org/W3009492331","https://openalex.org/W3037627566","https://openalex.org/W3093033010","https://openalex.org/W3111126165","https://openalex.org/W3132588576","https://openalex.org/W3180701834","https://openalex.org/W4205235521","https://openalex.org/W4214744072","https://openalex.org/W4220970108","https://openalex.org/W4297477879","https://openalex.org/W4303022557","https://openalex.org/W4307283626","https://openalex.org/W4309719941","https://openalex.org/W4366447842","https://openalex.org/W4387351061","https://openalex.org/W4390879901","https://openalex.org/W4394893882","https://openalex.org/W4396685186","https://openalex.org/W4400135851","https://openalex.org/W4402357417","https://openalex.org/W4408359742","https://openalex.org/W4410019695","https://openalex.org/W4411300549","https://openalex.org/W4411987999","https://openalex.org/W4412830472","https://openalex.org/W4412950354","https://openalex.org/W4413133099","https://openalex.org/W4415222093","https://openalex.org/W4415872256","https://openalex.org/W7083188651"],"related_works":[],"abstract_inverted_index":{"Ransomware":[0],"remains":[1],"one":[2],"of":[3],"the":[4,129,179],"most":[5],"disruptive":[6],"cyber":[7],"threats,":[8],"with":[9,156],"global":[10],"damages":[11],"projected":[12],"to":[13,108,212,232],"exceed":[14],"USD":[15],"265":[16],"billion":[17],"annually":[18],"by":[19,80],"2031.":[20],"Modern":[21],"campaigns":[22],"increasingly":[23],"involve":[24],"human-operated":[25],"tactics,":[26],"double-extortion":[27],"techniques,":[28],"and":[29,37,63,86,96,99,112,144,175,194,202,210,229,235],"rapidly":[30],"evolving":[31],"malware":[32],"variants,":[33],"making":[34],"traditional":[35],"signature-based":[36],"purely":[38],"discriminative":[39],"detection":[40,190],"approaches":[41],"insufficient.":[42],"As":[43],"adversaries":[44],"adopt":[45],"more":[46],"sophisticated":[47],"strategies,":[48],"there":[49],"is":[50,121,151],"a":[51,71,133],"growing":[52],"need":[53],"for":[54,76,93,223],"adaptive":[55,158],"defense":[56,79,159,187],"models":[57,160],"that":[58,104,161],"can":[59,185],"anticipate":[60],"novel":[61,152],"behaviors":[62],"support":[64,109],"reliable":[65],"operational":[66],"decision-making.":[67],"This":[68,147],"paper":[69,198],"proposes":[70],"Generative":[72,172],"AI\u2013driven":[73],"conceptual":[74],"framework":[75,130,180,219],"strengthening":[77],"ransomware":[78,170],"integrating":[81],"(1)":[82],"synthetic":[83],"data":[84,205,213],"generation":[85],"behavioral":[87],"forecasting,":[88],"(2)":[89],"adversarial":[90],"behavior":[91],"simulation":[92],"stress":[94],"testing":[95],"continuous":[97],"learning,":[98],"(3)":[100],"explainable":[101,236],"AI":[102,173],"mechanisms":[103],"provide":[105],"analyst-interpretable":[106],"rationales":[107],"trust":[110],"calibration":[111],"human-AI":[113],"collaboration":[114],"in":[115,165,239],"security":[116,176],"operations":[117],"centers.":[118],"The":[119,197,218],"contribution":[120],"conceptual:":[122],"rather":[123],"than":[124],"introducing":[125],"new":[126],"standalone":[127],"algorithms,":[128],"explicitly":[131],"formalizes":[132],"closed-loop":[134],"triadic":[135],"integration":[136],"linking":[137],"generative":[138,183],"threat":[139],"modeling,":[140],"explanation-driven":[141],"decision":[142],"support,":[143],"resilience-oriented":[145],"governance.":[146],"positioning":[148],"clarifies":[149],"what":[150],"about":[153],"GenAI-RD":[154],"compared":[155],"prior":[157],"treat":[162],"these":[163],"dimensions":[164],"isolation.":[166],"By":[167],"synthesizing":[168],"current":[169],"trends,":[171],"advances,":[174],"analytics":[177],"research,":[178],"illustrates":[181],"how":[182],"techniques":[184],"shift":[186],"from":[188],"reactive":[189],"toward":[191],"proactive,":[192],"transparent,":[193],"trust-centered":[195],"resilience.":[196],"further":[199],"outlines":[200],"feasibility":[201],"risk":[203],"considerations\u2014including":[204],"quality":[206],"constraints,":[207],"computational":[208],"overhead,":[209],"exposure":[211],"poisoning\u2014to":[214],"guide":[215],"realistic":[216],"adoption.":[217],"offers":[220],"actionable":[221],"guidance":[222],"cybersecurity":[224],"practitioners,":[225],"incident":[226],"response":[227],"teams,":[228],"policymakers":[230],"seeking":[231],"operationalize":[233],"responsible":[234],"AI-based":[237],"defenses":[238],"high-risk":[240],"digital":[241],"environments.":[242]},"counts_by_year":[],"updated_date":"2026-07-23T08:03:31.855105","created_date":"2026-06-15T00:00:00"}