{"id":"https://openalex.org/W7117301536","doi":"https://doi.org/10.1145/3786772","title":"Sequence Learning over Behavioral Attack Patterns for Early Detection of Human-Operated Ransomware","display_name":"Sequence Learning over Behavioral Attack Patterns for Early Detection of Human-Operated Ransomware","publication_year":2025,"publication_date":"2025-12-26","ids":{"openalex":"https://openalex.org/W7117301536","doi":"https://doi.org/10.1145/3786772"},"language":"en","primary_location":{"id":"doi:10.1145/3786772","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3786772","pdf_url":null,"source":{"id":"https://openalex.org/S4210235901","display_name":"Digital Threats Research and Practice","issn_l":"2576-5337","issn":["2576-5337","2692-1626"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Digital Threats: Research and Practice","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://doi.org/10.1145/3786772","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100756566","display_name":"Mohammed Rauf Ali Khan","orcid":"https://orcid.org/0000-0003-2658-1969"},"institutions":[{"id":"https://openalex.org/I134085113","display_name":"King Fahd University of Petroleum and Minerals","ror":"https://ror.org/03yez3163","country_code":"SA","type":"education","lineage":["https://openalex.org/I134085113"]}],"countries":["SA"],"is_corresponding":false,"raw_author_name":"Mohammed Rauf Ali Khan","raw_affiliation_strings":["Department of Computer Engineering, College of Computing and Mathematics, King Fahd University of Petroleum and Minerals, Dhahran, Saudi Arabia"],"raw_orcid":"https://orcid.org/0000-0003-2658-1969","affiliations":[{"raw_affiliation_string":"Department of Computer Engineering, College of Computing and Mathematics, King Fahd University of Petroleum and Minerals, Dhahran, Saudi Arabia","institution_ids":["https://openalex.org/I134085113"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5106737363","display_name":"Akram Q. Algaolahi","orcid":null},"institutions":[{"id":"https://openalex.org/I134085113","display_name":"King Fahd University of Petroleum and Minerals","ror":"https://ror.org/03yez3163","country_code":"SA","type":"education","lineage":["https://openalex.org/I134085113"]}],"countries":["SA"],"is_corresponding":false,"raw_author_name":"Akram Algaolahi","raw_affiliation_strings":["Department of Computer Engineering, College of Computing and Mathematics, King Fahd University of Petroleum and Minerals, Dhahran, Saudi Arabia"],"raw_orcid":"https://orcid.org/0009-0002-1546-2737","affiliations":[{"raw_affiliation_string":"Department of Computer Engineering, College of Computing and Mathematics, King Fahd University of Petroleum and Minerals, Dhahran, Saudi Arabia","institution_ids":["https://openalex.org/I134085113"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5042308198","display_name":"Farid Binbeshr","orcid":"https://orcid.org/0000-0001-8630-1784"},"institutions":[{"id":"https://openalex.org/I134085113","display_name":"King Fahd University of Petroleum and Minerals","ror":"https://ror.org/03yez3163","country_code":"SA","type":"education","lineage":["https://openalex.org/I134085113"]}],"countries":["SA"],"is_corresponding":false,"raw_author_name":"Farid Binbeshr","raw_affiliation_strings":["Interdisciplinary Research Center for Intelligent Secure Systems, King Fahd University of Petroleum and Minerals, Dhahran, Saudi Arabia"],"raw_orcid":"https://orcid.org/0000-0001-8630-1784","affiliations":[{"raw_affiliation_string":"Interdisciplinary Research Center for Intelligent Secure Systems, King Fahd University of Petroleum and Minerals, Dhahran, Saudi Arabia","institution_ids":["https://openalex.org/I134085113"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5103345725","display_name":"M. Mudasar Imam","orcid":null},"institutions":[{"id":"https://openalex.org/I134085113","display_name":"King Fahd University of Petroleum and Minerals","ror":"https://ror.org/03yez3163","country_code":"SA","type":"education","lineage":["https://openalex.org/I134085113"]}],"countries":["SA"],"is_corresponding":false,"raw_author_name":"Muhammad Imam","raw_affiliation_strings":["Computer Engineering Department and Interdisciplinary Research Center for Intelligent Secure Systems, King Fahd University of Petroleum and Minerals, Dharan, Saudi Arabia"],"raw_orcid":"https://orcid.org/0000-0001-9131-6964","affiliations":[{"raw_affiliation_string":"Computer Engineering Department and Interdisciplinary Research Center for Intelligent Secure Systems, King Fahd University of Petroleum and Minerals, Dharan, Saudi Arabia","institution_ids":["https://openalex.org/I134085113"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I134085113"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.53806668,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"7","issue":"1","first_page":"1","last_page":"21"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9635999798774719,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9635999798774719,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.007400000002235174,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.00419999985024333,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/ransomware","display_name":"Ransomware","score":0.951200008392334},{"id":"https://openalex.org/keywords/construct","display_name":"Construct (python library)","score":0.5698000192642212},{"id":"https://openalex.org/keywords/sequence","display_name":"Sequence (biology)","score":0.5022000074386597},{"id":"https://openalex.org/keywords/hidden-markov-model","display_name":"Hidden Markov model","score":0.40880000591278076},{"id":"https://openalex.org/keywords/class","display_name":"Class (philosophy)","score":0.3955000042915344},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.367000013589859},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.3082999885082245}],"concepts":[{"id":"https://openalex.org/C2777667771","wikidata":"https://www.wikidata.org/wiki/Q926331","display_name":"Ransomware","level":3,"score":0.951200008392334},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7060999870300293},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.593500018119812},{"id":"https://openalex.org/C2780801425","wikidata":"https://www.wikidata.org/wiki/Q5164392","display_name":"Construct (python library)","level":2,"score":0.5698000192642212},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5407999753952026},{"id":"https://openalex.org/C2778112365","wikidata":"https://www.wikidata.org/wiki/Q3511065","display_name":"Sequence (biology)","level":2,"score":0.5022000074386597},{"id":"https://openalex.org/C23224414","wikidata":"https://www.wikidata.org/wiki/Q176769","display_name":"Hidden Markov model","level":2,"score":0.40880000591278076},{"id":"https://openalex.org/C2777212361","wikidata":"https://www.wikidata.org/wiki/Q5127848","display_name":"Class (philosophy)","level":2,"score":0.3955000042915344},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.39010000228881836},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.367000013589859},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.3082999885082245},{"id":"https://openalex.org/C204323151","wikidata":"https://www.wikidata.org/wiki/Q905424","display_name":"Range (aeronautics)","level":2,"score":0.29809999465942383},{"id":"https://openalex.org/C95922358","wikidata":"https://www.wikidata.org/wiki/Q5432725","display_name":"False positive rate","level":2,"score":0.2890999913215637},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.2847999930381775},{"id":"https://openalex.org/C98763669","wikidata":"https://www.wikidata.org/wiki/Q176645","display_name":"Markov chain","level":2,"score":0.2847000062465668},{"id":"https://openalex.org/C2778579508","wikidata":"https://www.wikidata.org/wiki/Q722192","display_name":"System call","level":2,"score":0.2667999863624573},{"id":"https://openalex.org/C159886148","wikidata":"https://www.wikidata.org/wiki/Q176645","display_name":"Markov process","level":2,"score":0.2630999982357025},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.257999986410141},{"id":"https://openalex.org/C163836022","wikidata":"https://www.wikidata.org/wiki/Q6771326","display_name":"Markov model","level":3,"score":0.2547999918460846}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3786772","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3786772","pdf_url":null,"source":{"id":"https://openalex.org/S4210235901","display_name":"Digital Threats Research and Practice","issn_l":"2576-5337","issn":["2576-5337","2692-1626"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Digital Threats: Research and Practice","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1145/3786772","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3786772","pdf_url":null,"source":{"id":"https://openalex.org/S4210235901","display_name":"Digital Threats Research and Practice","issn_l":"2576-5337","issn":["2576-5337","2692-1626"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Digital Threats: Research and Practice","raw_type":"journal-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions","score":0.4935043156147003}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":24,"referenced_works":["https://openalex.org/W1109422923","https://openalex.org/W2021436318","https://openalex.org/W2745390745","https://openalex.org/W2794482868","https://openalex.org/W2890196927","https://openalex.org/W2918753059","https://openalex.org/W3099702369","https://openalex.org/W3110432551","https://openalex.org/W3132588576","https://openalex.org/W3193582808","https://openalex.org/W3203444100","https://openalex.org/W3211746486","https://openalex.org/W4322154771","https://openalex.org/W4385872253","https://openalex.org/W4387415286","https://openalex.org/W4388141203","https://openalex.org/W4391953607","https://openalex.org/W4401054291","https://openalex.org/W4402040282","https://openalex.org/W4406214267","https://openalex.org/W4408693876","https://openalex.org/W4410600579","https://openalex.org/W4413239969","https://openalex.org/W4413398133"],"related_works":[],"abstract_inverted_index":{"Human-Operated":[0],"Ransomware":[1],"(HoR)":[2],"is":[3],"one":[4],"of":[5,29,40,43,55,79,100,110,115,162],"the":[6,38,71,98,107],"most":[7],"persistent":[8],"and":[9,20,31,66,90,112,128],"evolving":[10],"threats":[11],"in":[12,64,168],"cybersecurity,":[13],"as":[14],"attackers":[15],"use":[16],"changing":[17],"Tactics,":[18],"Techniques,":[19],"Procedures":[21],"(TTPs)":[22],"to":[23,70,92,136,147],"evade":[24],"traditional":[25],"detection.":[26],"The":[27,103],"lack":[28],"structured":[30,68],"publicly":[32],"available":[33],"TTP-level":[34],"datasets":[35],"has":[36],"limited":[37],"development":[39],"models":[41],"capable":[42],"identifying":[44],"HoR":[45],"behavior":[46,95],"early.":[47],"In":[48],"this":[49],"study,":[50],"we":[51],"construct":[52],"a":[53,77],"dataset":[54],"TTP":[56,156],"sequences":[57],"from":[58,154],"15":[59],"prominent":[60],"ransomware":[61,94,163],"families":[62],"observed":[63,101],"2023":[65],"2024,":[67],"according":[69],"MITRE":[72],"ATT&CK":[73],"framework.":[74],"We":[75],"evaluate":[76],"range":[78],"sequence":[80],"modeling":[81],"approaches,":[82],"including":[83],"Markov":[84],"chains,":[85],"n-gram":[86],"analysis,":[87],"LSTM,":[88],"GRU,":[89],"RNN,":[91],"classify":[93],"based":[96],"on":[97],"progression":[99],"TTPs.":[102],"RNN":[104],"model":[105,141],"achieved":[106],"highest":[108],"accuracy":[109,142],"82%":[111],"an":[113,121],"AUC":[114],"0.9694":[116],"(95%":[117],"CI:":[118],"0.0087\u20130.0168),":[119],"with":[120],"average":[122],"false":[123],"positive":[124],"rate":[125],"between":[126],"0.0087":[127],"0.0168":[129],"using":[130],"10-fold":[131],"cross-validation.":[132],"SMOTE":[133],"was":[134],"used":[135],"address":[137],"class":[138],"imbalance,":[139],"improving":[140],"by":[143],"6%":[144],"(from":[145],"76%":[146],"82%).":[148],"These":[149],"results":[150],"show":[151],"that":[152],"learning":[153],"ordered":[155],"patterns":[157],"can":[158],"support":[159],"timely":[160],"detection":[161],"activity,":[164],"enabling":[165],"earlier":[166],"intervention":[167],"threat":[169],"response":[170],"workflows.":[171]},"counts_by_year":[],"updated_date":"2026-05-21T06:26:12.895304","created_date":"2025-12-26T00:00:00"}