{"id":"https://openalex.org/W2793829161","doi":"https://doi.org/10.1145/3180465.3180467","title":"Machine Learning-Based Detection of Ransomware Using SDN","display_name":"Machine Learning-Based Detection of Ransomware Using SDN","publication_year":2018,"publication_date":"2018-03-14","ids":{"openalex":"https://openalex.org/W2793829161","doi":"https://doi.org/10.1145/3180465.3180467","mag":"2793829161"},"language":"en","primary_location":{"id":"doi:10.1145/3180465.3180467","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3180465.3180467","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2018 ACM International Workshop on Security in Software Defined Networks & Network Function Virtualization","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5020434662","display_name":"Greg Cusack","orcid":null},"institutions":[{"id":"https://openalex.org/I188538660","display_name":"University of Colorado Boulder","ror":"https://ror.org/02ttsq026","country_code":"US","type":"education","lineage":["https://openalex.org/I188538660"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Greg Cusack","raw_affiliation_strings":["University of Colorado Boulder, Boulder, CO, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Colorado Boulder, Boulder, CO, USA","institution_ids":["https://openalex.org/I188538660"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5023656258","display_name":"Oliver Michel","orcid":"https://orcid.org/0000-0002-4256-2365"},"institutions":[{"id":"https://openalex.org/I188538660","display_name":"University of Colorado Boulder","ror":"https://ror.org/02ttsq026","country_code":"US","type":"education","lineage":["https://openalex.org/I188538660"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Oliver Michel","raw_affiliation_strings":["University of Colorado Boulder, Boulder, CO, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Colorado Boulder, Boulder, CO, USA","institution_ids":["https://openalex.org/I188538660"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5025861504","display_name":"Eric Keller","orcid":"https://orcid.org/0000-0003-2556-9394"},"institutions":[{"id":"https://openalex.org/I188538660","display_name":"University of Colorado Boulder","ror":"https://ror.org/02ttsq026","country_code":"US","type":"education","lineage":["https://openalex.org/I188538660"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Eric Keller","raw_affiliation_strings":["University of Colorado Boulder, Boulder, CO, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Colorado Boulder, Boulder, CO, USA","institution_ids":["https://openalex.org/I188538660"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I188538660"],"apc_list":null,"apc_paid":null,"fwci":8.3684,"has_fulltext":false,"cited_by_count":123,"citation_normalized_percentile":{"value":0.98662717,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":94,"max":100},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"6"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/ransomware","display_name":"Ransomware","score":0.8954241275787354},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.8857872486114502},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8174101114273071},{"id":"https://openalex.org/keywords/deep-packet-inspection","display_name":"Deep packet inspection","score":0.5516687631607056},{"id":"https://openalex.org/keywords/payload","display_name":"Payload (computing)","score":0.5464696288108826},{"id":"https://openalex.org/keywords/random-forest","display_name":"Random forest","score":0.5296891331672668},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.4804632067680359},{"id":"https://openalex.org/keywords/network-packet","display_name":"Network packet","score":0.4787808656692505},{"id":"https://openalex.org/keywords/encryption","display_name":"Encryption","score":0.46594417095184326},{"id":"https://openalex.org/keywords/identification","display_name":"Identification (biology)","score":0.4218955636024475},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.3752773106098175},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.33775538206100464},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.33326923847198486},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.32680392265319824},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.23142331838607788}],"concepts":[{"id":"https://openalex.org/C2777667771","wikidata":"https://www.wikidata.org/wiki/Q926331","display_name":"Ransomware","level":3,"score":0.8954241275787354},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.8857872486114502},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8174101114273071},{"id":"https://openalex.org/C204679922","wikidata":"https://www.wikidata.org/wiki/Q734252","display_name":"Deep packet inspection","level":3,"score":0.5516687631607056},{"id":"https://openalex.org/C134066672","wikidata":"https://www.wikidata.org/wiki/Q1424639","display_name":"Payload (computing)","level":3,"score":0.5464696288108826},{"id":"https://openalex.org/C169258074","wikidata":"https://www.wikidata.org/wiki/Q245748","display_name":"Random forest","level":2,"score":0.5296891331672668},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.4804632067680359},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.4787808656692505},{"id":"https://openalex.org/C148730421","wikidata":"https://www.wikidata.org/wiki/Q141090","display_name":"Encryption","level":2,"score":0.46594417095184326},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.4218955636024475},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3752773106098175},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.33775538206100464},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.33326923847198486},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.32680392265319824},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.23142331838607788},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C59822182","wikidata":"https://www.wikidata.org/wiki/Q441","display_name":"Botany","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3180465.3180467","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3180465.3180467","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2018 ACM International Workshop on Security in Software Defined Networks & Network Function Virtualization","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1057439930","display_name":"SDI-CSCS: Collaborative Research: S2OS: Enabling Infrastructure-Wide Programmable Security with SDI","funder_award_id":"1700527","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"},{"id":"https://openalex.org/F4320316785","display_name":"VMware","ror":null}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":13,"referenced_works":["https://openalex.org/W92469554","https://openalex.org/W1775772884","https://openalex.org/W1994926493","https://openalex.org/W2104209065","https://openalex.org/W2134519279","https://openalex.org/W2305788608","https://openalex.org/W2498672755","https://openalex.org/W2511701350","https://openalex.org/W2538779768","https://openalex.org/W2550109527","https://openalex.org/W2558619741","https://openalex.org/W2743093301","https://openalex.org/W2798627392"],"related_works":["https://openalex.org/W3201228709","https://openalex.org/W2922354075","https://openalex.org/W4285067014","https://openalex.org/W1971040605","https://openalex.org/W4293863310","https://openalex.org/W1523103140","https://openalex.org/W3160314615","https://openalex.org/W3089657757","https://openalex.org/W3212729580","https://openalex.org/W2593889512"],"abstract_inverted_index":{"The":[0],"growth":[1],"of":[2,18,22,50,101,170,183],"malware":[3,45,76],"poses":[4],"a":[5,26,40,83,86,146,151,178,187,197],"major":[6,20],"threat":[7],"to":[8,36,55,57,72,113,156,206],"internet":[9],"users,":[10],"governments,":[11],"and":[12,30,122,125,137,149,203],"businesses":[13],"around":[14],"the":[15,19,33,37,48,115,123,168],"world.":[16],"One":[17],"types":[21],"malware,":[23],"ransomware,":[24],"encrypts":[25],"user's":[27],"sensitive":[28],"information":[29],"only":[31],"returns":[32],"original":[34],"files":[35],"user":[38],"after":[39],"ransom":[41],"is":[42,93,201],"paid.":[43],"As":[44],"developers":[46],"shift":[47],"delivery":[49],"their":[51],"product":[52],"from":[53,60,134],"HTTP":[54],"HTTPS":[56],"protect":[58],"themselves":[59],"payload":[61],"inspection,":[62],"we":[63,81],"can":[64],"no":[65],"longer":[66],"rely":[67],"on":[68],"deep":[69,171],"packet":[70,172],"inspection":[71],"extract":[73,130],"features":[74,133],"for":[75,141],"identification.":[77],"Toward":[78],"this":[79,111,135,139],"goal,":[80],"propose":[82],"solution":[84],"leveraging":[85],"recent":[87],"trend":[88],"in":[89,162,181],"networking":[90],"hardware,":[91],"that":[92,196],"programmable":[94],"forwarding":[95],"engines":[96],"(PFEs).":[97],"PFEs":[98],"allow":[99],"collection":[100],"per-packet,":[102],"network":[103,116,165],"monitoring":[104],"data":[105,112,140],"at":[106],"high":[107],"rates.":[108],"We":[109,129,144],"use":[110,138,150],"monitor":[114],"traffic":[117,136],"between":[118],"an":[119],"infected":[120],"computer":[121],"command":[124],"control":[126],"(C&C)":[127],"server.":[128],"high-level":[131],"flow":[132,160],"ransomware":[142,208],"classification.":[143],"write":[145],"stream":[147],"processor":[148],"random":[152],"forest,":[153],"binary":[154],"classifier":[155],"utilizes":[157],"these":[158],"rich":[159],"records":[161],"fingerprinting":[163,199],"malicious,":[164],"activity":[166],"without":[167],"requirement":[169],"inspection.":[173],"Our":[174,193],"classification":[175],"model":[176],"achieves":[177],"detection":[179],"rate":[180,190],"excess":[182],"0.86,":[184],"while":[185],"maintaining":[186],"false":[188],"negative":[189],"under":[191],"0.11.":[192],"results":[194],"suggest":[195],"flow-based":[198],"method":[200],"feasible":[202],"accurate":[204],"enough":[205],"catch":[207],"before":[209],"encryption.":[210]},"counts_by_year":[{"year":2026,"cited_by_count":8},{"year":2025,"cited_by_count":11},{"year":2024,"cited_by_count":22},{"year":2023,"cited_by_count":24},{"year":2022,"cited_by_count":21},{"year":2021,"cited_by_count":17},{"year":2020,"cited_by_count":12},{"year":2019,"cited_by_count":6},{"year":2018,"cited_by_count":2}],"updated_date":"2026-08-11T07:18:39.950985","created_date":"2025-10-10T00:00:00"}