{"id":"https://openalex.org/W4415974904","doi":"https://doi.org/10.1016/j.procs.2025.09.207","title":"Resilience without AI: Assessing the Viability of Deception-Based Ransomware Detection","display_name":"Resilience without AI: Assessing the Viability of Deception-Based Ransomware Detection","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W4415974904","doi":"https://doi.org/10.1016/j.procs.2025.09.207"},"language":"en","primary_location":{"id":"doi:10.1016/j.procs.2025.09.207","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.procs.2025.09.207","pdf_url":null,"source":{"id":"https://openalex.org/S120348307","display_name":"Procedia Computer Science","issn_l":"1877-0509","issn":["1877-0509"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Procedia Computer Science","raw_type":"journal-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://doi.org/10.1016/j.procs.2025.09.207","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Liam Goddard","orcid":null},"institutions":[{"id":"https://openalex.org/I251738","display_name":"Edinburgh Napier University","ror":"https://ror.org/03zjvnn91","country_code":"GB","type":"education","lineage":["https://openalex.org/I251738"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Liam Goddard","raw_affiliation_strings":["School of Computing, Engineering and the Built Environment, Edinburgh Napier University, Edinburgh, EH10 5DT, UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computing, Engineering and the Built Environment, Edinburgh Napier University, Edinburgh, EH10 5DT, UK","institution_ids":["https://openalex.org/I251738"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5005946268","display_name":"Muhammad Shahbaz Khan","orcid":"https://orcid.org/0000-0002-7166-6681"},"institutions":[{"id":"https://openalex.org/I251738","display_name":"Edinburgh Napier University","ror":"https://ror.org/03zjvnn91","country_code":"GB","type":"education","lineage":["https://openalex.org/I251738"]}],"countries":["GB"],"is_corresponding":true,"raw_author_name":"Muhammad Shahbaz Khan","raw_affiliation_strings":["School of Computing, Engineering and the Built Environment, Edinburgh Napier University, Edinburgh, EH10 5DT, UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computing, Engineering and the Built Environment, Edinburgh Napier University, Edinburgh, EH10 5DT, UK","institution_ids":["https://openalex.org/I251738"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5074460563","display_name":"Maha Driss","orcid":"https://orcid.org/0000-0001-8236-8746"},"institutions":[{"id":"https://openalex.org/I142024983","display_name":"Prince Sultan University","ror":"https://ror.org/053mqrf26","country_code":"SA","type":"education","lineage":["https://openalex.org/I142024983"]},{"id":"https://openalex.org/I83259278","display_name":"Manouba University","ror":"https://ror.org/0503ejf32","country_code":"TN","type":"education","lineage":["https://openalex.org/I83259278"]}],"countries":["SA","TN"],"is_corresponding":false,"raw_author_name":"Maha Driss","raw_affiliation_strings":["RIADI Laboratory, University of Manouba, Manouba 2010, Tunisia","Robotics and Internet-of-Things Laboratory, Prince Sultan University, Riyadh 12435, Saudi Arabia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"RIADI Laboratory, University of Manouba, Manouba 2010, Tunisia","institution_ids":["https://openalex.org/I83259278"]},{"raw_affiliation_string":"Robotics and Internet-of-Things Laboratory, Prince Sultan University, Riyadh 12435, Saudi Arabia","institution_ids":["https://openalex.org/I142024983"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5002269681","display_name":"Baraq Ghaleb","orcid":"https://orcid.org/0000-0002-8361-0634"},"institutions":[{"id":"https://openalex.org/I251738","display_name":"Edinburgh Napier University","ror":"https://ror.org/03zjvnn91","country_code":"GB","type":"education","lineage":["https://openalex.org/I251738"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Baraq Ghaleb","raw_affiliation_strings":["School of Computing, Engineering and the Built Environment, Edinburgh Napier University, Edinburgh, EH10 5DT, UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computing, Engineering and the Built Environment, Edinburgh Napier University, Edinburgh, EH10 5DT, UK","institution_ids":["https://openalex.org/I251738"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5047556499","display_name":"Mouad Lemoudden","orcid":"https://orcid.org/0000-0002-0114-1054"},"institutions":[{"id":"https://openalex.org/I251738","display_name":"Edinburgh Napier University","ror":"https://ror.org/03zjvnn91","country_code":"GB","type":"education","lineage":["https://openalex.org/I251738"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Mouad Lemoudden","raw_affiliation_strings":["School of Computing, Engineering and the Built Environment, Edinburgh Napier University, Edinburgh, EH10 5DT, UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computing, Engineering and the Built Environment, Edinburgh Napier University, Edinburgh, EH10 5DT, UK","institution_ids":["https://openalex.org/I251738"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5068020099","display_name":"William J. Buchanan","orcid":"https://orcid.org/0000-0003-0809-3523"},"institutions":[{"id":"https://openalex.org/I251738","display_name":"Edinburgh Napier University","ror":"https://ror.org/03zjvnn91","country_code":"GB","type":"education","lineage":["https://openalex.org/I251738"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"William J. Buchanan","raw_affiliation_strings":["School of Computing, Engineering and the Built Environment, Edinburgh Napier University, Edinburgh, EH10 5DT, UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computing, Engineering and the Built Environment, Edinburgh Napier University, Edinburgh, EH10 5DT, UK","institution_ids":["https://openalex.org/I251738"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5112134950","display_name":"Jawad Ahmad","orcid":"https://orcid.org/0009-0007-4381-7263"},"institutions":[{"id":"https://openalex.org/I138564716","display_name":"Prince Mohammad bin Fahd University","ror":"https://ror.org/03d64na34","country_code":"SA","type":"education","lineage":["https://openalex.org/I138564716"]}],"countries":["SA"],"is_corresponding":false,"raw_author_name":"Jawad Ahmad","raw_affiliation_strings":["Cybersecurity Center, Prince Mohammad Bin Fahd University, Al-Khobar, 34754, Saudi Arabia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Cybersecurity Center, Prince Mohammad Bin Fahd University, Al-Khobar, 34754, Saudi Arabia","institution_ids":["https://openalex.org/I138564716"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5005946268"],"corresponding_institution_ids":["https://openalex.org/I251738"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.40393676,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"270","issue":null,"first_page":"871","last_page":"880"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9703999757766724,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9703999757766724,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.006300000008195639,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.004000000189989805,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/ransomware","display_name":"Ransomware","score":0.9684000015258789},{"id":"https://openalex.org/keywords/resilience","display_name":"Resilience (materials science)","score":0.6972000002861023},{"id":"https://openalex.org/keywords/implementation","display_name":"Implementation","score":0.4049000144004822},{"id":"https://openalex.org/keywords/event","display_name":"Event (particle physics)","score":0.39469999074935913},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.3555000126361847},{"id":"https://openalex.org/keywords/data-breach","display_name":"Data breach","score":0.29660001397132874}],"concepts":[{"id":"https://openalex.org/C2777667771","wikidata":"https://www.wikidata.org/wiki/Q926331","display_name":"Ransomware","level":3,"score":0.9684000015258789},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8658999800682068},{"id":"https://openalex.org/C2779585090","wikidata":"https://www.wikidata.org/wiki/Q3457762","display_name":"Resilience (materials science)","level":2,"score":0.6972000002861023},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.46549999713897705},{"id":"https://openalex.org/C26713055","wikidata":"https://www.wikidata.org/wiki/Q245962","display_name":"Implementation","level":2,"score":0.4049000144004822},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.39469999074935913},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.38449999690055847},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.3555000126361847},{"id":"https://openalex.org/C165609540","wikidata":"https://www.wikidata.org/wiki/Q1172486","display_name":"Data breach","level":2,"score":0.29660001397132874},{"id":"https://openalex.org/C2780940931","wikidata":"https://www.wikidata.org/wiki/Q174989","display_name":"File system","level":2,"score":0.2924000024795532},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.2904999852180481},{"id":"https://openalex.org/C152745839","wikidata":"https://www.wikidata.org/wiki/Q5438153","display_name":"Fault detection and isolation","level":3,"score":0.2842000126838684},{"id":"https://openalex.org/C206345919","wikidata":"https://www.wikidata.org/wiki/Q20380951","display_name":"Resource (disambiguation)","level":2,"score":0.28299999237060547},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.25859999656677246},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.2515999972820282},{"id":"https://openalex.org/C193519340","wikidata":"https://www.wikidata.org/wiki/Q891179","display_name":"Data loss","level":2,"score":0.2506999969482422}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1016/j.procs.2025.09.207","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.procs.2025.09.207","pdf_url":null,"source":{"id":"https://openalex.org/S120348307","display_name":"Procedia Computer Science","issn_l":"1877-0509","issn":["1877-0509"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Procedia Computer Science","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1016/j.procs.2025.09.207","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.procs.2025.09.207","pdf_url":null,"source":{"id":"https://openalex.org/S120348307","display_name":"Procedia Computer Science","issn_l":"1877-0509","issn":["1877-0509"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Procedia Computer Science","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320327702","display_name":"Prince Sultan University","ror":"https://ror.org/053mqrf26"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":12,"referenced_works":["https://openalex.org/W2775582065","https://openalex.org/W3000953536","https://openalex.org/W3099702369","https://openalex.org/W3201124227","https://openalex.org/W4206211871","https://openalex.org/W4211262529","https://openalex.org/W4220801425","https://openalex.org/W4390347459","https://openalex.org/W4390673835","https://openalex.org/W4390974969","https://openalex.org/W4391333914","https://openalex.org/W4395049932"],"related_works":[],"abstract_inverted_index":{"From":[0],"the":[1,17,28,34,138,147,157,180,196,217,228,245,248],"first":[2],"attack":[3],"in":[4,94,169,214],"1989,":[5],"to":[6,77,84,172,207],"date,":[7],"it":[8,230],"is":[9,13,25,39,231,236],"evident":[10,232],"that":[11,233],"ransomware":[12,23,51,93,165,197],"highly":[14],"destructive.":[15],"Today":[16],"vast":[18],"majority":[19],"of":[20,30,36,62,69,109,179,216,247],"research":[21],"on":[22,27,118,130,156,244],"detection":[24,125,201,205,224],"focused":[26],"use":[29,35],"AI":[31,57,97],"techniques.":[32],"While":[33],"these":[37,162],"techniques":[38],"very":[40,242],"effective,":[41],"they":[42],"should":[43],"not":[44,100,237],"be":[45,101,208],"considered":[46],"an":[47,176],"infallible":[48],"solution":[49],"for":[50,146],"detection.":[52],"As":[53],"with":[54],"any":[55],"solution,":[56],"implementations":[58],"do":[59],"have":[60,127],"shortcomings":[61],"their":[63],"own;":[64],"compute":[65],"resource":[66],"constraints,":[67],"collation":[68],"training":[70],"data,":[71],"data":[72,75],"poisoning,":[73],"and":[74,151,184,200,241],"privacy,":[76],"name":[78],"a":[79,209,222,238,255],"few.":[80],"This":[81,115],"paper":[82,116],"aims":[83],"identify":[85],"whether":[86,251],"traditional":[87],"methods":[88],"can":[89],"still":[90],"effectively":[91],"detect":[92],"scenarios":[95],"where":[96],"solutions":[98,126,143,163,202,219],"may":[99],"viable.":[102],"Typically,":[103],"there":[104],"are":[105],"three":[106,173,218],"main":[107],"categories":[108],"detection;":[110],"signature-based,":[111],"behaviour-based,":[112],"&":[113],"deception-based.":[114],"focuses":[117],"deception-based":[119,204],"detection,":[120],"using":[121],"honey":[122],"files.":[123],"Three":[124],"been":[128],"implemented":[129],"two":[131,185,215],"isolated":[132],"VMs,":[133],"one":[134],"running":[135],"Windows":[136,153,158],"10,":[137],"other":[139],"Linux":[140,148],"Mint.":[141],"The":[142],"include":[144],"RansomwareLocker,":[145],"VM,":[149],"R-Locker":[150],"4663":[152],"event":[154],"monitoring":[155],"10":[159],"VM.":[160],"With":[161],"implemented,":[164,203],"samples":[166,198],"were":[167,192],"executed":[168],"turn,":[170],"up":[171],"times,":[174],"allowing":[175],"initial":[177],"\u2018out":[178],"box\u2019":[181],"test":[182],"run":[183],"subsequent":[186],"tests":[187],"after":[188],"necessary":[189],"configuration":[190,246],"changes":[191],"made.":[193],"Overall,":[194],"from":[195],"chosen":[199],"proves":[206],"promising":[210],"approach.":[211],"Testing":[212],"resulted":[213],"ultimately":[220],"achieving":[221],"100%":[223],"rate.":[225],"However,":[226],"throughout":[227],"experiment,":[229],"this":[234],"approach":[235,257],"silver":[239],"bullet,":[240],"dependent":[243],"solutions.":[249],"Therefore,":[250],"AI-based":[252],"or":[253],"traditional,":[254],"defence-in-depth":[256],"remains":[258],"best.":[259]},"counts_by_year":[],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-11-06T00:00:00"}