{"id":"https://openalex.org/W2911731407","doi":"https://doi.org/10.1109/ssci.2018.8628743","title":"A Framework for Analyzing Ransomware using Machine Learning","display_name":"A Framework for Analyzing Ransomware using Machine Learning","publication_year":2018,"publication_date":"2018-11-01","ids":{"openalex":"https://openalex.org/W2911731407","doi":"https://doi.org/10.1109/ssci.2018.8628743","mag":"2911731407"},"language":"en","primary_location":{"id":"doi:10.1109/ssci.2018.8628743","is_oa":false,"landing_page_url":"https://doi.org/10.1109/ssci.2018.8628743","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2018 IEEE Symposium Series on Computational Intelligence (SSCI)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5036646007","display_name":"Subash Poudyal","orcid":"https://orcid.org/0000-0002-9068-229X"},"institutions":[{"id":"https://openalex.org/I94658018","display_name":"University of Memphis","ror":"https://ror.org/01cq23130","country_code":"US","type":"education","lineage":["https://openalex.org/I94658018"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Subash Poudyal","raw_affiliation_strings":["Department of Computer Science, The University of Memphis, Memphis, TN, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, The University of Memphis, Memphis, TN, USA","institution_ids":["https://openalex.org/I94658018"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5063143212","display_name":"Kul Prasad Subedi","orcid":null},"institutions":[{"id":"https://openalex.org/I94658018","display_name":"University of Memphis","ror":"https://ror.org/01cq23130","country_code":"US","type":"education","lineage":["https://openalex.org/I94658018"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Kul Prasad Subedi","raw_affiliation_strings":["Department of Computer Science, The University of Memphis, Memphis, TN, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, The University of Memphis, Memphis, TN, USA","institution_ids":["https://openalex.org/I94658018"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5048167872","display_name":"Dipankar Dasgupta","orcid":"https://orcid.org/0000-0002-3097-061X"},"institutions":[{"id":"https://openalex.org/I94658018","display_name":"University of Memphis","ror":"https://ror.org/01cq23130","country_code":"US","type":"education","lineage":["https://openalex.org/I94658018"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Dipankar Dasgupta","raw_affiliation_strings":["Department of Computer Science, The University of Memphis, Memphis, TN, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, The University of Memphis, Memphis, TN, USA","institution_ids":["https://openalex.org/I94658018"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I94658018"],"apc_list":null,"apc_paid":null,"fwci":5.2412,"has_fulltext":false,"cited_by_count":99,"citation_normalized_percentile":{"value":0.96781639,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":94,"max":100},"biblio":{"volume":null,"issue":null,"first_page":"1692","last_page":"1699"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9900000095367432,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9815999865531921,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/ransomware","display_name":"Ransomware","score":0.9384276270866394},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.8742280602455139},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8129625916481018},{"id":"https://openalex.org/keywords/executable","display_name":"Executable","score":0.773699939250946},{"id":"https://openalex.org/keywords/reverse-engineering","display_name":"Reverse engineering","score":0.6391074061393738},{"id":"https://openalex.org/keywords/leverage","display_name":"Leverage (statistics)","score":0.6132526397705078},{"id":"https://openalex.org/keywords/static-analysis","display_name":"Static analysis","score":0.5621401071548462},{"id":"https://openalex.org/keywords/malware-analysis","display_name":"Malware analysis","score":0.5363380312919617},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.4317482113838196},{"id":"https://openalex.org/keywords/source-code","display_name":"Source code","score":0.4121802747249603},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.40044230222702026},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.3228013515472412},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.18647292256355286}],"concepts":[{"id":"https://openalex.org/C2777667771","wikidata":"https://www.wikidata.org/wiki/Q926331","display_name":"Ransomware","level":3,"score":0.9384276270866394},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.8742280602455139},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8129625916481018},{"id":"https://openalex.org/C160145156","wikidata":"https://www.wikidata.org/wiki/Q778586","display_name":"Executable","level":2,"score":0.773699939250946},{"id":"https://openalex.org/C207850805","wikidata":"https://www.wikidata.org/wiki/Q269608","display_name":"Reverse engineering","level":2,"score":0.6391074061393738},{"id":"https://openalex.org/C153083717","wikidata":"https://www.wikidata.org/wiki/Q6535263","display_name":"Leverage (statistics)","level":2,"score":0.6132526397705078},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.5621401071548462},{"id":"https://openalex.org/C2779395397","wikidata":"https://www.wikidata.org/wiki/Q15731404","display_name":"Malware analysis","level":3,"score":0.5363380312919617},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4317482113838196},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.4121802747249603},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.40044230222702026},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3228013515472412},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.18647292256355286}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/ssci.2018.8628743","is_oa":false,"landing_page_url":"https://doi.org/10.1109/ssci.2018.8628743","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2018 IEEE Symposium Series on Computational Intelligence (SSCI)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":25,"referenced_works":["https://openalex.org/W215336119","https://openalex.org/W1504694836","https://openalex.org/W2008906462","https://openalex.org/W2112076978","https://openalex.org/W2119359024","https://openalex.org/W2125055259","https://openalex.org/W2153635508","https://openalex.org/W2461373307","https://openalex.org/W2487770199","https://openalex.org/W2550109527","https://openalex.org/W2789145328","https://openalex.org/W2792599578","https://openalex.org/W2793829161","https://openalex.org/W2794784953","https://openalex.org/W2800509541","https://openalex.org/W2887670066","https://openalex.org/W2887954984","https://openalex.org/W4236354166","https://openalex.org/W4255874453","https://openalex.org/W4285719527","https://openalex.org/W4293742266","https://openalex.org/W6676769703","https://openalex.org/W6718890697","https://openalex.org/W6729193369","https://openalex.org/W6754313517"],"related_works":["https://openalex.org/W4312434251","https://openalex.org/W2887670066","https://openalex.org/W1965138165","https://openalex.org/W2964256930","https://openalex.org/W4220705483","https://openalex.org/W2968289825","https://openalex.org/W4293503453","https://openalex.org/W3003302059","https://openalex.org/W2911731407","https://openalex.org/W3134609580"],"abstract_inverted_index":{"Ransomware":[0],"attacks":[1],"increased":[2],"in":[3,72],"recent":[4],"years":[5],"causing":[6],"significant":[7],"damages":[8],"and":[9,46,69,77,92,104,111,127,197],"disruptions":[10],"to":[11,50,58,74,97,100,116,124,135,155],"businesses.":[12],"Forensic":[13],"analysis":[14,61,193],"such":[15,30],"as":[16,63],"reverse":[17,39],"engineering":[18,40],"of":[19,28,81,148,172,179,190],"executables":[20],"(or":[21],"binary":[22],"files)":[23],"is":[24,56],"the":[25,79,87,142,145,159,166,188,195],"common":[26],"practice":[27],"examining":[29],"malware":[31,82],"characteristics.":[32],"In":[33,163],"this":[34],"work,":[35],"we":[36],"developed":[37],"a":[38],"framework":[41,55],"incorporating":[42],"feature":[43],"generation":[44],"engines":[45],"machine":[47],"learning":[48],"(ML)":[49],"efficiently":[51],"detect":[52],"ransomware.":[53],"This":[54,183],"used":[57],"perform":[59],"multi-level":[60],"(such":[62],"raw":[64],"binaries,":[65],"assembly":[66,101],"codes,":[67],"libraries,":[68],"function":[70],"calls)":[71],"order":[73],"better":[75,200],"examine":[76],"interpret":[78],"purpose":[80],"code":[83],"segments.":[84],"We":[85],"leverage":[86],"object-code":[88],"dump":[89],"tool":[90],"(Linux)":[91],"portable":[93],"executable":[94],"(PE)":[95],"parser":[96],"decode":[98],"binaries":[99,113],"level":[102,192],"instructions":[103],"dynamic":[105],"link":[106],"libraries":[107],"(DLLs).":[108],"Both":[109],"ransomware":[110,149,202],"normal":[112,204],"are":[114,121,133],"considered":[115],"conduct":[117],"experiments":[118],"where":[119],"samples":[120,150],"first":[122],"pre-processed":[123],"extract":[125],"features":[126],"then":[128],"different":[129],"(supervised)":[130],"ML":[131,160,168],"techniques":[132],"applied":[134],"classify":[136],"these":[137,173],"samples.":[138],"Experimental":[139],"results":[140],"reported":[141],"performance":[143],"i.e.,":[144],"detection":[146,177],"accuracy":[147],"which":[151],"varied":[152],"from":[153,203],"76%":[154],"97%":[156],"based":[157],"on":[158],"technique":[161],"used.":[162],"particular,":[164],"among":[165],"eight":[167],"classifiers":[169],"tested,":[170],"seven":[171],"performed":[174],"well":[175],"with":[176],"rate":[178],"at":[180,194],"least":[181],"90%.":[182],"study":[184],"also":[185],"demonstrated":[186],"that":[187],"combination":[189],"static":[191],"ASM-level":[196],"DLL-level":[198],"can":[199],"distinguish":[201],"binaries.":[205]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":8},{"year":2024,"cited_by_count":13},{"year":2023,"cited_by_count":34},{"year":2022,"cited_by_count":14},{"year":2021,"cited_by_count":12},{"year":2020,"cited_by_count":12},{"year":2019,"cited_by_count":5}],"updated_date":"2026-08-11T07:18:39.950985","created_date":"2025-10-10T00:00:00"}