{"id":"https://openalex.org/W4387126738","doi":"https://doi.org/10.1145/3565287.3617632","title":"Sorting Ransomware from Malware Utilizing Machine Learning Methods with Dynamic Analysis","display_name":"Sorting Ransomware from Malware Utilizing Machine Learning Methods with Dynamic Analysis","publication_year":2023,"publication_date":"2023-09-28","ids":{"openalex":"https://openalex.org/W4387126738","doi":"https://doi.org/10.1145/3565287.3617632"},"language":"en","primary_location":{"id":"doi:10.1145/3565287.3617632","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3565287.3617632","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3565287.3617632","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the Twenty-fourth International Symposium on Theory, Algorithmic Foundations, and Protocol Design for Mobile Networks and Mobile Computing","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3565287.3617632","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5075546182","display_name":"Joshua Schoenbachler","orcid":"https://orcid.org/0000-0001-8544-6359"},"institutions":[{"id":"https://openalex.org/I55769427","display_name":"Indiana University \u2013 Purdue University Indianapolis","ror":"https://ror.org/05gxnyn08","country_code":"US","type":"education","lineage":["https://openalex.org/I55769427","https://openalex.org/I592451"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Joshua Schoenbachler","raw_affiliation_strings":["Indiana University-Purdue University Indianapolis, Indianapolis, Indiana, United States"],"raw_orcid":"https://orcid.org/0009-0001-7322-924X","affiliations":[{"raw_affiliation_string":"Indiana University-Purdue University Indianapolis, Indianapolis, Indiana, United States","institution_ids":["https://openalex.org/I55769427"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5074600721","display_name":"V. Adithya Krishnan","orcid":"https://orcid.org/0009-0002-5973-8985"},"institutions":[{"id":"https://openalex.org/I157725225","display_name":"University of Illinois Urbana-Champaign","ror":"https://ror.org/047426m28","country_code":"US","type":"education","lineage":["https://openalex.org/I157725225"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Vinay Krishnan","raw_affiliation_strings":["University of Illinois Urbana-Champaign, Champaign, Illinois, United States"],"raw_orcid":"https://orcid.org/0009-0002-5973-8985","affiliations":[{"raw_affiliation_string":"University of Illinois Urbana-Champaign, Champaign, Illinois, United States","institution_ids":["https://openalex.org/I157725225"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5011545428","display_name":"G. S. Agarwal","orcid":"https://orcid.org/0009-0008-9921-8750"},"institutions":[{"id":"https://openalex.org/I55769427","display_name":"Indiana University \u2013 Purdue University Indianapolis","ror":"https://ror.org/05gxnyn08","country_code":"US","type":"education","lineage":["https://openalex.org/I55769427","https://openalex.org/I592451"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Garvit Agarwal","raw_affiliation_strings":["Indiana University-Purdue University Indianapolis, Indianapolis, Indiana, United States"],"raw_orcid":"https://orcid.org/0009-0008-9921-8750","affiliations":[{"raw_affiliation_string":"Indiana University-Purdue University Indianapolis, Indianapolis, Indiana, United States","institution_ids":["https://openalex.org/I55769427"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100448828","display_name":"Feng Li","orcid":"https://orcid.org/0000-0001-7633-7863"},"institutions":[{"id":"https://openalex.org/I55769427","display_name":"Indiana University \u2013 Purdue University Indianapolis","ror":"https://ror.org/05gxnyn08","country_code":"US","type":"education","lineage":["https://openalex.org/I55769427","https://openalex.org/I592451"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Feng Li","raw_affiliation_strings":["Indiana University-Purdue University Indianapolis, Indianapolis, Indiana, United States"],"raw_orcid":"https://orcid.org/0000-0001-7633-7863","affiliations":[{"raw_affiliation_string":"Indiana University-Purdue University Indianapolis, Indianapolis, Indiana, United States","institution_ids":["https://openalex.org/I55769427"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.4372,"has_fulltext":true,"cited_by_count":6,"citation_normalized_percentile":{"value":0.85436438,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":90,"max":97},"biblio":{"volume":null,"issue":null,"first_page":"516","last_page":"521"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9837999939918518,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9793000221252441,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/ransomware","display_name":"Ransomware","score":0.9513595104217529},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.7892097234725952},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7797979116439819},{"id":"https://openalex.org/keywords/random-forest","display_name":"Random forest","score":0.7385736703872681},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.618513822555542},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.6080927848815918},{"id":"https://openalex.org/keywords/support-vector-machine","display_name":"Support vector machine","score":0.5784112215042114},{"id":"https://openalex.org/keywords/gradient-boosting","display_name":"Gradient boosting","score":0.48939815163612366},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.4869502782821655},{"id":"https://openalex.org/keywords/decision-tree","display_name":"Decision tree","score":0.471293568611145},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.3845475912094116},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.1895410120487213},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.12359178066253662}],"concepts":[{"id":"https://openalex.org/C2777667771","wikidata":"https://www.wikidata.org/wiki/Q926331","display_name":"Ransomware","level":3,"score":0.9513595104217529},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.7892097234725952},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7797979116439819},{"id":"https://openalex.org/C169258074","wikidata":"https://www.wikidata.org/wiki/Q245748","display_name":"Random forest","level":2,"score":0.7385736703872681},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.618513822555542},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.6080927848815918},{"id":"https://openalex.org/C12267149","wikidata":"https://www.wikidata.org/wiki/Q282453","display_name":"Support vector machine","level":2,"score":0.5784112215042114},{"id":"https://openalex.org/C70153297","wikidata":"https://www.wikidata.org/wiki/Q5591907","display_name":"Gradient boosting","level":3,"score":0.48939815163612366},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.4869502782821655},{"id":"https://openalex.org/C84525736","wikidata":"https://www.wikidata.org/wiki/Q831366","display_name":"Decision tree","level":2,"score":0.471293568611145},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3845475912094116},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.1895410120487213},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.12359178066253662}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3565287.3617632","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3565287.3617632","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3565287.3617632","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the Twenty-fourth International Symposium on Theory, Algorithmic Foundations, and Protocol Design for Mobile Networks and Mobile Computing","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3565287.3617632","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3565287.3617632","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3565287.3617632","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the Twenty-fourth International Symposium on Theory, Algorithmic Foundations, and Protocol Design for Mobile Networks and Mobile Computing","raw_type":"proceedings-article"},"sustainable_development_goals":[{"display_name":"Life in Land","id":"https://metadata.un.org/sdg/15","score":0.4699999988079071}],"awards":[{"id":"https://openalex.org/G5382165872","display_name":"REU Site: Enhancing Undergraduate Experiences in Mobile Cloud and Data Security","funder_award_id":"1852105","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4387126738.pdf","grobid_xml":"https://content.openalex.org/works/W4387126738.grobid-xml"},"referenced_works_count":6,"referenced_works":["https://openalex.org/W2998313947","https://openalex.org/W3195121218","https://openalex.org/W4200569302","https://openalex.org/W4221014202","https://openalex.org/W4296367487","https://openalex.org/W4316690373"],"related_works":["https://openalex.org/W4285067014","https://openalex.org/W4399423660","https://openalex.org/W4386690025","https://openalex.org/W3208169454","https://openalex.org/W4322710485","https://openalex.org/W4366990902","https://openalex.org/W4317732970","https://openalex.org/W4402664569","https://openalex.org/W4315777889","https://openalex.org/W4388550696"],"abstract_inverted_index":{"Ransomware":[0],"attacks":[1],"have":[2,11],"grown":[3],"significantly":[4],"in":[5,90,180,205],"the":[6,24,46,91,214],"past":[7],"dozen":[8],"years":[9],"and":[10,29,69,85,103,120,143,162,170,210,233,246],"disrupted":[12],"businesses":[13],"that":[14,58],"engage":[15],"with":[16,164],"personal":[17],"data.":[18,200],"In":[19,186],"this":[20],"paper,":[21],"we":[22,193,237],"discuss":[23],"identification":[25],"of":[26,168,173],"ransomware,":[27,67],"malware,":[28,68],"benign":[30,70,104,157,191,247],"software":[31,71,158,197],"from":[32,43,54,101,156,219,244],"one":[33],"another":[34],"using":[35,74,127,146],"machine":[36,129],"learning":[37,130],"techniques.":[38],"We":[39,65,77],"collected":[40,66],"data":[41],"samples":[42,72],"repositories":[44],"on":[45,79],"internet":[47],"as":[48,50,175,177],"well":[49,176],"referencing":[51],"a":[52,55,60,113,202,230],"dataset":[53],"previous":[56],"study":[57],"provided":[59],"basis":[61],"for":[62,152,183],"our":[63],"approach.":[64],"manually":[73],"Cuckoo":[75],"Sandbox\u2122.":[76],"filtered":[78],"certain":[80,88],"feature":[81,107],"groups":[82,108],"to":[83,97,188,198,240],"test":[84],"determine":[86],"if":[87],"activity/processes":[89],"infection":[92],"process":[93],"could":[94],"be":[95,227],"used":[96],"correctly":[98],"distinguish":[99,242],"ransomware":[100,155,189,199,218,234,243],"malware":[102,196,220,232,245],"software.":[105,221,248],"These":[106],"represent":[109],"correlated":[110],"processes":[111],"within":[112],"running":[114],"application:":[115],"network":[116],"activity,":[117],"registry/events":[118],"processes,":[119],"file":[121],"interactions.":[122],"The":[123,149],"datasets":[124],"were":[125,159,213,238],"analyzed":[126],"several":[128],"(ML)":[131],"models":[132],"which":[133],"included":[134],"Random":[135,160,184],"Forest,":[136],"Support":[137],"Vector":[138],"Machines":[139],"(SVM),":[140],"Gradient":[141,207],"Boosting,":[142],"Decision":[144,211],"Trees":[145,212],"binary":[147],"classification.":[148],"best":[150,215],"classifiers":[151],"distinctly":[153],"identifying":[154],"Forest":[161],"SVM":[163],"an":[165,171,178],"f1-":[166],"score":[167],"86%":[169],"f1-score":[172],"82%":[174],"85%":[179],"overall":[181],"accuracy":[182,204],"Forest.":[185],"addition":[187],"versus":[190],"software,":[192],"also":[194],"compared":[195],"Yielding":[201],"100%":[203],"performance,":[206],"Boosting":[208],"Classifier":[209],"at":[216],"distinguishing":[217],"This":[222],"high":[223],"result":[224],"may":[225],"partially":[226],"caused":[228],"by":[229],"smaller":[231],"dataset.":[235],"Overall,":[236],"able":[239],"successfully":[241]},"counts_by_year":[{"year":2025,"cited_by_count":3},{"year":2024,"cited_by_count":2},{"year":2023,"cited_by_count":1}],"updated_date":"2026-08-06T08:24:18.245995","created_date":"2025-10-10T00:00:00"}