{"id":"https://openalex.org/W4415932756","doi":"https://doi.org/10.3390/jcp5040096","title":"Enhancing Ransomware Threat Detection: Risk-Aware Classification via Windows API Call Analysis and Hybrid ML/DL Models","display_name":"Enhancing Ransomware Threat Detection: Risk-Aware Classification via Windows API Call Analysis and Hybrid ML/DL Models","publication_year":2025,"publication_date":"2025-11-05","ids":{"openalex":"https://openalex.org/W4415932756","doi":"https://doi.org/10.3390/jcp5040096"},"language":"en","primary_location":{"id":"doi:10.3390/jcp5040096","is_oa":true,"landing_page_url":"https://doi.org/10.3390/jcp5040096","pdf_url":"https://www.mdpi.com/2624-800X/5/4/96/pdf?version=1762341086","source":{"id":"https://openalex.org/S4210232532","display_name":"Journal of Cybersecurity and Privacy","issn_l":"2624-800X","issn":["2624-800X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cybersecurity and Privacy","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://www.mdpi.com/2624-800X/5/4/96/pdf?version=1762341086","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5120269790","display_name":"Sarah Alhuwayshil","orcid":null},"institutions":[{"id":"https://openalex.org/I4210142658","display_name":"Naif Arab University for Security Sciences","ror":"https://ror.org/049c46160","country_code":"SA","type":"education","lineage":["https://openalex.org/I4210142658"]}],"countries":["SA"],"is_corresponding":false,"raw_author_name":"Sarah Alhuwayshil","raw_affiliation_strings":["Department of Cybersecurity and Digital Forensics, Center for Cybercrime and Economic Crime, Naif Arab University for Security Sciences, Riyadh 14253, Saudi Arabia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Cybersecurity and Digital Forensics, Center for Cybercrime and Economic Crime, Naif Arab University for Security Sciences, Riyadh 14253, Saudi Arabia","institution_ids":["https://openalex.org/I4210142658"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5108661602","display_name":"S. Ramachandran","orcid":"https://orcid.org/0009-0003-9650-8078"},"institutions":[{"id":"https://openalex.org/I4210142658","display_name":"Naif Arab University for Security Sciences","ror":"https://ror.org/049c46160","country_code":"SA","type":"education","lineage":["https://openalex.org/I4210142658"]}],"countries":["SA"],"is_corresponding":false,"raw_author_name":"Sundaresan Ramachandran","raw_affiliation_strings":["Department of Cybersecurity and Digital Forensics, Center for Cybercrime and Economic Crime, Naif Arab University for Security Sciences, Riyadh 14253, Saudi Arabia"],"raw_orcid":"https://orcid.org/0009-0003-9650-8078","affiliations":[{"raw_affiliation_string":"Department of Cybersecurity and Digital Forensics, Center for Cybercrime and Economic Crime, Naif Arab University for Security Sciences, Riyadh 14253, Saudi Arabia","institution_ids":["https://openalex.org/I4210142658"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5074787000","display_name":"Kyounggon Kim","orcid":"https://orcid.org/0000-0002-5675-4253"},"institutions":[{"id":"https://openalex.org/I4210142658","display_name":"Naif Arab University for Security Sciences","ror":"https://ror.org/049c46160","country_code":"SA","type":"education","lineage":["https://openalex.org/I4210142658"]}],"countries":["SA"],"is_corresponding":true,"raw_author_name":"Kyounggon Kim","raw_affiliation_strings":["Department of Cybersecurity and Digital Forensics, Center for Cybercrime and Economic Crime, Naif Arab University for Security Sciences, Riyadh 14253, Saudi Arabia"],"raw_orcid":"https://orcid.org/0000-0002-5675-4253","affiliations":[{"raw_affiliation_string":"Department of Cybersecurity and Digital Forensics, Center for Cybercrime and Economic Crime, Naif Arab University for Security Sciences, Riyadh 14253, Saudi Arabia","institution_ids":["https://openalex.org/I4210142658"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5074787000"],"corresponding_institution_ids":["https://openalex.org/I4210142658"],"apc_list":{"value":1000,"currency":"CHF","value_usd":1207},"apc_paid":{"value":1000,"currency":"CHF","value_usd":1207},"fwci":1.1071,"has_fulltext":true,"cited_by_count":2,"citation_normalized_percentile":{"value":0.79679541,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":97,"max":98},"biblio":{"volume":"5","issue":"4","first_page":"96","last_page":"96"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9811999797821045,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9811999797821045,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.0044999998062849045,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.004399999976158142,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/ransomware","display_name":"Ransomware","score":0.8963000178337097},{"id":"https://openalex.org/keywords/generalization","display_name":"Generalization","score":0.5834000110626221},{"id":"https://openalex.org/keywords/statistical-classification","display_name":"Statistical classification","score":0.3684999942779541},{"id":"https://openalex.org/keywords/system-call","display_name":"System call","score":0.3452000021934509},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.31189998984336853}],"concepts":[{"id":"https://openalex.org/C2777667771","wikidata":"https://www.wikidata.org/wiki/Q926331","display_name":"Ransomware","level":3,"score":0.8963000178337097},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7473999857902527},{"id":"https://openalex.org/C177148314","wikidata":"https://www.wikidata.org/wiki/Q170084","display_name":"Generalization","level":2,"score":0.5834000110626221},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5181999802589417},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.46779999136924744},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.39480000734329224},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.37779998779296875},{"id":"https://openalex.org/C110083411","wikidata":"https://www.wikidata.org/wiki/Q1744628","display_name":"Statistical classification","level":2,"score":0.3684999942779541},{"id":"https://openalex.org/C2778579508","wikidata":"https://www.wikidata.org/wiki/Q722192","display_name":"System call","level":2,"score":0.3452000021934509},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.31189998984336853},{"id":"https://openalex.org/C115051666","wikidata":"https://www.wikidata.org/wiki/Q6522493","display_name":"Ranging","level":2,"score":0.27239999175071716},{"id":"https://openalex.org/C40305131","wikidata":"https://www.wikidata.org/wiki/Q2616305","display_name":"Obfuscation","level":2,"score":0.250900000333786}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.3390/jcp5040096","is_oa":true,"landing_page_url":"https://doi.org/10.3390/jcp5040096","pdf_url":"https://www.mdpi.com/2624-800X/5/4/96/pdf?version=1762341086","source":{"id":"https://openalex.org/S4210232532","display_name":"Journal of Cybersecurity and Privacy","issn_l":"2624-800X","issn":["2624-800X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cybersecurity and Privacy","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:c5df04cbdbf8456b82ad6b89249d00ed","is_oa":true,"landing_page_url":"https://doaj.org/article/c5df04cbdbf8456b82ad6b89249d00ed","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Journal of Cybersecurity and Privacy, Vol 5, Iss 4, p 96 (2025)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.3390/jcp5040096","is_oa":true,"landing_page_url":"https://doi.org/10.3390/jcp5040096","pdf_url":"https://www.mdpi.com/2624-800X/5/4/96/pdf?version=1762341086","source":{"id":"https://openalex.org/S4210232532","display_name":"Journal of Cybersecurity and Privacy","issn_l":"2624-800X","issn":["2624-800X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cybersecurity and Privacy","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1333892626","display_name":null,"funder_award_id":"NAUSS-23-R13","funder_id":"https://openalex.org/F4320319362","funder_display_name":"Naif Arab University for Security Sciences"}],"funders":[{"id":"https://openalex.org/F4320319362","display_name":"Naif Arab University for Security Sciences","ror":"https://ror.org/049c46160"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4415932756.pdf","grobid_xml":"https://content.openalex.org/works/W4415932756.grobid-xml"},"referenced_works_count":19,"referenced_works":["https://openalex.org/W2964829536","https://openalex.org/W2989588798","https://openalex.org/W3011213835","https://openalex.org/W3015737415","https://openalex.org/W3112173953","https://openalex.org/W3127265720","https://openalex.org/W3175671845","https://openalex.org/W4286630725","https://openalex.org/W4319659935","https://openalex.org/W4382940845","https://openalex.org/W4383427404","https://openalex.org/W4384835155","https://openalex.org/W4387234384","https://openalex.org/W4391785438","https://openalex.org/W4399332970","https://openalex.org/W4401748807","https://openalex.org/W4402349337","https://openalex.org/W4406266948","https://openalex.org/W4408792025"],"related_works":[],"abstract_inverted_index":{"Ransomware":[0],"attacks":[1],"pose":[2],"a":[3,70,110],"serious":[4],"threat":[5,60,87],"to":[6,12,29,53,57,123,150],"computer":[7],"networks,":[8],"causing":[9],"widespread":[10],"disruption":[11],"individual,":[13],"corporate,":[14],"governmental,":[15],"and":[16,62,91,106,109,118,127,142,172],"critical":[17],"national":[18],"infrastructures.":[19],"To":[20],"mitigate":[21],"their":[22,170],"impact,":[23],"extensive":[24],"research":[25],"has":[26],"been":[27],"conducted":[28],"analyze":[30],"ransomware":[31,77,165],"operations.":[32],"However,":[33],"most":[34,75],"prior":[35],"studies":[36],"have":[37],"focused":[38],"on":[39,94],"decryption,":[40],"post-infection":[41],"response,":[42],"or":[43],"general":[44],"family-level":[45],"classification":[46,55,71],"for":[47,73,169],"performance":[48,84],"evaluation,":[49],"with":[50,85],"limited":[51],"attention":[52],"linking":[54],"accuracy":[56,145],"each":[58],"family\u2019s":[59],"level":[61],"behavioral":[63,173],"patterns.":[64,97],"In":[65],"this":[66],"study,":[67],"we":[68],"propose":[69],"framework":[72],"the":[74,135,157],"dangerous":[76],"families":[78,166],"targeting":[79],"Windows":[80],"systems,":[81],"correlating":[82],"model":[83],"defined":[86],"levels":[88],"(high,":[89],"medium,":[90],"low)":[92],"based":[93],"API":[95],"call":[96],"Two":[98],"independent":[99],"datasets":[100,122],"were":[101],"used,":[102],"extracted":[103],"from":[104,148],"VirusTotal":[105],"Cuckoo":[107],"Sandbox,":[108],"cross-source":[111],"evaluation":[112],"strategy":[113],"was":[114],"applied,":[115],"alternating":[116],"training":[117],"testing":[119],"roles":[120],"between":[121],"assess":[124],"generalization":[125],"ability":[126],"minimize":[128],"source":[129],"bias.":[130],"The":[131],"results":[132],"show":[133],"that":[134],"proposed":[136],"approach,":[137],"particularly":[138],"when":[139],"using":[140],"XGBoost":[141],"LightGBM,":[143],"achieved":[144],"rates":[146],"ranging":[147],"84":[149],"100%":[151],"across":[152],"datasets.":[153],"These":[154],"findings":[155],"confirm":[156],"effectiveness":[158],"of":[159],"our":[160],"method":[161],"in":[162],"accurately":[163],"classifying":[164],"while":[167],"accounting":[168],"severity":[171],"characteristics.":[174]},"counts_by_year":[{"year":2026,"cited_by_count":2}],"updated_date":"2026-08-21T09:56:20.448147","created_date":"2025-11-05T00:00:00"}