Pith. sign in

REVIEW 4 major objections 6 minor 49 references

iCNN-LSTM: A batch-based incremental ransomware detection system using Sysmon

T0 review · 4 major / 6 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims a batch-incremental CNN-LSTM system that reads Sysmon event logs detects ransomware in a stream with a 99.61% F2-score, 0.17% false positives, and 4.69% false negatives on a highly imbalanced dataset.

desk verdict Plausible incremental ransomware detector, but the within-batch split leaks and the headline F2 doesn't demonstrate generalization to new ransomware. read the letter →

arxiv 2501.01083 v1 pith:GQ4DEK4A submitted 2025-01-02 cs.CR

Jamil Ispahany , MD Rafiqul Islam , M. Arif Khan , MD Zahidul Islam This is my paper · ORCID
classification cs.CR
keywords ransomwaredetectiondeeplearningincrementalSysmonattentionmechanismCNN-LSTMimbalanceddatabatch
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that a hybrid CNN-LSTM model reading Windows Sysmon event logs can spot ransomware in a continuous stream with an average F2-score of 99.61%, a false-negative rate of 4.69%, and a false-positive rate of 0.17% on a highly imbalanced dataset. Its distinguishing move is batch-based incremental learning: instead of rebuilding the model from scratch, it updates the network every 10,000 events, so the detector can absorb new ransomware variants as they appear. If true, this would give endpoint security a real-time detector that stays current without the cost of full retraining, and that prioritizes catching attacks (recall) over avoiding false alarms.

What carries the argument

The load-bearing machinery is the parallel-LSTM-plus-attention CNN-LSTM classifier combined with a batch-incremental update loop. Sysmon events are embedded with fastText, filtered by Pearson-correlation feature selection, balanced with SMOTE, and fed into 1D CNN layers that extract local patterns; parallel LSTM modules then process the sequence, and an attention mechanism weights the most informative hidden states before the dense classification layers. This parallel arrangement removes the sequential LSTM bottleneck and is what the paper credits for the improved runtime, while the 10,000-event batch updates give the model its ability to adapt to new ransomware variants without a complete rebuild.

What would settle it

Re-run the incremental protocol with training and test batches separated by whole ransomware sample (or family), and compare the per-family recall; if the F2-score falls substantially below 99.61%, the reported performance came from split leakage rather than generalization to new variants.

Watch

Extended reading notes

Core claim

The central discovery is that an architecture made of parallel LSTM branches with an attention layer, mounted after 1D CNN feature extractors, detects ransomware events in a stream of Sysmon logs more accurately and faster than seven CNN/LSTM baselines re-implemented inside the same incremental framework. On the authors' imbalanced dataset of nearly 200,000 events, the proposed system reached a 99.61% F2-score, 99.62% recall, and 99.61% precision, with a 4.69% false-negative rate, and it did so while reducing runtime compared to sequentially stacked CNN-LSTM models. The batch-incremental updating procedure, which uses 10,000-event mini-batches and SMOTE balancing, kept the F2-score above 99% even when each batch introduced ransomware families absent from the initial training set.

Load-bearing premise

The evaluation assumes that the per-batch 80:20 split keeps test events genuinely unseen, but since all ransomware logs come from repeated lab detonations of only six families, similar events may appear on both sides of the split and inflate the reported F2-score.

Editorial extensions

If this is right

  • A deployed detector could be updated after every 10,000-event batch, keeping itself current with new ransomware behaviors without a full retraining cycle.
  • The 99.61% F2-score is achieved with recall weighted twice as heavily as precision, so the system is deliberately biased toward catching attacks at the cost of more false alarms.
  • Among the seven CNN/LSTM baselines reimplemented in the same framework, only the proposed architecture reached a false-negative rate below 5% at a runtime of 195.69 seconds.
  • The parallel LSTM branches and attention mechanism eliminate the sequential processing bottleneck, which is the paper's stated reason for the latency reduction.
  • The consistency of the F2-score above 99% across all 15 update batches indicates the incremental mechanism does not suffer from catastrophic forgetting in this setting.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the 80:20 split is done per batch without tracking the originating ransomware sample, the test portion can contain events from the same execution as training events; a family-disjoint holdout would be a stronger test of the 'new variant' claim.
  • The dataset covers only six families on a single Windows 11 lab build, so the transfer of the reported scores to other families, other OS versions, or production-scale event rates is an open question that the paper does not address.
  • A natural next step is to measure per-batch inference latency against a real-world Sysmon event rate; the 195.69-second runtime is an end-to-end training-plus-evaluation figure, not a per-event detection latency.
  • Because SMOTE is applied per batch and features are re-selected by Pearson correlation, the method's long-run behavior under concept drift (e.g., benign software changes) remains to be tested beyond the fixed lab scenario.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes iCNN-LSTM, a batch-based incremental ransomware detection system that classifies Sysmon event streams using a hybrid CNN-LSTM architecture with parallel LSTM branches and attention mechanisms. The authors collect a private dataset of roughly 197,000 Sysmon events (176,130 benign and 20,710 ransomware events from six families), train an initial model on 40,000 events, then update it on fifteen mini-batches of 10,000 events. Each batch is split 80:20, and the model is fine-tuned on the training portion and evaluated on the test portion. The reported results are an F2-score of 99.61%, precision 99.61%, recall 99.62%, FP 0.17%, FN 4.69%, and runtime 195.69 s, which the paper claims are the best among seven CNN/LSTM baselines re-implemented within the same framework. The paper also positions the approach as overcoming the need for full retraining in real-time ransomware detection.

Significance. The paper addresses a real operational need: ransomware detection in endpoint event streams with incremental model updates. If the empirical results were obtained under a leakage-free protocol, the proposed architecture could be a useful contribution. The authors provide a detailed algorithm (Algorithm 1), a realistic lab setup (Windows 11 VMs with Sysmon and internet), and an explicit discussion of limitations (e.g., no degradation detection). However, the central performance claim rests on a private dataset, a within-batch random split that may leak information across train/test, and re-implemented baselines; the evidence for superiority over prior work is therefore not yet convincing. The paper would benefit from releasing code/data or, at minimum, reporting a temporal evaluation with family-level batch composition.

major comments (4)
  1. [§3.6 / Algorithm 1] The evaluation protocol in Section 3.6 and Algorithm 1 splits each 10,000-event update batch into an 80% training and 20% test portion. Since the dataset consists of Sysmon event streams from repeated detonations of six ransomware families, and the selected features in Table 3 (e.g., CallTrace, GrantedAccess, TargetImage, SourceUser, TargetUser, Task) are largely constant for a given attack process, a random split within the same batch places near-identical events from the same execution on both sides of the split. Table 2 reports only event counts per batch, not family-level distribution, so the claim in §3.6 that each update incorporates novel ransomware families is unverifiable. Moreover, even if new families appear in a batch, the test 20% can share an execution with the training 80%. The reported F2-score of 99.61% (Table 7) is therefore consistent with intra-execution memorization rather than generalization to unseen ransomware. The authors should re-evaluate using a temporal split (e.g., train on earlier batches and test on a later batch, with a gap), and report the per-batch family distribution.
  2. [§4.2] Section 4.2 states that Optuna was used for hyperparameter optimization, but the paper does not specify whether a separate validation set was used to guide the search. If the Optuna objective was evaluated on the same test portions that later appear in Table 7, the reported metrics are optimistically biased. The authors should clarify the tuning protocol and, ideally, perform tuning on a split that is disjoint from the final test data used for reporting.
  3. [Abstract; §1; §4.4.2; Table 7] The manuscript is internally inconsistent about false positives and false negatives. The abstract reports FP=0.17% and FN=4.69%, while the contributions bullet in Section 1 states a 'low false positive rate of 4.69%'. Section 4.4.2 repeats this and claims 'the lowest false positive rate of 4.69%', but Table 7 lists 4.69% as the false-negative rate of iCNN-LSTM and shows that the lowest FP among all models is 0.16% (Zhang et al., not iCNN-LSTM). These contradictions prevent a reader from determining which error rate is actually being claimed as minimal. All occurrences should be corrected and the comparative statements checked against Table 7.
  4. [§4.4.2 / Tables 6-7] The comparison in Section 4.4.2 and Tables 6-7 is entirely conducted on the authors' private Sysmon dataset, with prior models re-implemented by the same authors; no code, data, or pre-trained models are provided. As a result, the 'highest F1/F2' and 'fastest runtime' claims cannot be independently reproduced, and the equivalence of the baseline re-implementations to the originals is not assured. I recommend adding a data/code availability statement and, if that is not possible, clearly framing the results as a within-framework architecture comparison with reduced generality claims.
minor comments (6)
  1. [§2.1] Section 2.1 contains a missing citation: 'within the ransomware and malware detection domains []'.
  2. [§3.3.2 / Algorithm 1] Section 3.3.2 introduces SMOTE, but Algorithm 1 does not indicate where SMOTE is applied; the authors should state explicitly that SMOTE is applied only to the training portion after the 80:20 split, to avoid synthetic samples appearing in the test set.
  3. [§3.6 / Table 2] Section 3.6 claims each update contains 'novel samples from various ransomware families', but Table 2 only gives counts; providing the family composition of each batch would make this assertion checkable.
  4. [Figure 9] Figure 9's x-axis is labeled in seconds but the described evaluation is per-batch; please clarify the meaning of the time axis.
  5. [Equation (2)] Equation (2) has a stray '= 1' at the end of the summation; this appears to be a typesetting error.
  6. [Various equations] Several equations (e.g., Equations 4, 6, 10, 13) have inconsistent subscript notation or missing indices; a careful proofread would improve readability.

Circularity Check

1 steps flagged · score 6.0 of 10

Feature selection via PCC is computed on the full batch before the 80:20 split, so the test evaluation is partially constructed from test labels.

  1. fitted input called prediction [Section 3.6, Algorithm 1 (Pre_process_data); Section 3.4.2]
    "for𝐸 ∈𝑊 do ... ̂ 𝑥, ̂ 𝑦←Pre_process_data(DataFrame) (train_𝑥, train_𝑥, test_𝑥, test_𝑦) ←Split data for training and testing𝑀 (̂ 𝑥, ̂ 𝑦) Fit and train𝑀 (train_𝑥, train_𝑦) ... Evaluate model𝑀 (test_𝑥, test_𝑦) ... function PRE_PROCESS_DATA ... ̈ 𝑥←Calculate PCC for all̈ 𝑥 ⊳ Calculate the Pearson Correlation Coefficient (PCC) Select top features in DataFrame"

    In Algorithm 1, Pre_process_data runs before the 80:20 split, and within it computes the Pearson Correlation Coefficient (PCC) of every feature against the class value using the entire batch DataFrame. The resulting top-feature selection is therefore fit with the labels and values of the same 20% that is later designated as the test set. The reported test performance is not an independent measurement: the feature space on which the model is evaluated has been constructed from the test set itself. This makes the F2-score of 99.61% partially self-referential and inflated by construction, so it cannot cleanly support the claim of detecting previously unseen ransomware.

full rationale

The mathematical derivations in the paper (CNN convolution, LSTM gates, attention, F-measure) are standard formulas and are not circular. The central empirical claim is an F2-score measured on batch test splits, not a derived first-principles result. However, the evaluation protocol contains a concrete circular step: Algorithm 1 applies Pre_process_data, which performs PCC-based feature selection on the full batch DataFrame, before the 80:20 train/test split. Because the test split's labels contribute to choosing the features, the held-out evaluation is not independent; the test input representation is fitted to the test data. This fits the fitted-input-called-prediction pattern and partially compromises the headline 99.61% result. Separately, the 80:20 split within a batch of temporally adjacent Sysmon events and the absence of family-level batch attribution raise generalization concerns, but those are validity issues rather than definitional circularity. The self-citations ([1], [4]) support the literature-review premise and are not load-bearing for the empirical outcome. Overall, the core result is partially circular due to the evaluation protocol, though the model training itself is not definitionally equivalent to the test labels.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The system rests on the assumption that Sysmon logs encode detectable ransomware behavior and on a privately collected dataset. The hyperparameters are tuned with Optuna on this dataset, the feature-selection cutoff is not specified, and the batch size is a design choice. No new entities are postulated.

free parameters (3)
  • Optuna-tuned hyperparameters = LSTM units 384, CNN filters 32, kernel 9, dropout 0.1033/0.4057, learning rate 0.001, epochs 100, batch 1024
    Chosen by automatic search on the imbalanced dataset; no separate validation set is described, so reported test metrics may reflect tuning.
  • PCC feature selection threshold = unspecified (top features listed as CallTrace, GrantedAccess, SourceUser, TargetImage, TargetUser, Task)
    The paper says the top features are selected but does not state the exact cutoff or number of features, leaving a hand-specified selection step.
  • Incremental batch size = 10,000 events
    Chosen by the authors to define the update window; the paper does not test sensitivity to this choice.
assumptions (5)
  • domain assumption Sysmon event streams contain sufficient signal to distinguish ransomware from benign software
    The whole approach relies on Sysmon default events carrying discriminative features; Section 3.2 asserts this without external validation.
  • domain assumption The collected dataset is representative of real-world ransomware behavior
    The lab setup uses six known families and portable apps; Section 3.3.1 states this but offers no comparison to real enterprise event distributions.
  • domain assumption The 80:20 split of each batch gives an unbiased estimate of future performance
    Section 3.6/Algorithm 1 assumes events within a batch are independent and that later batches contain genuinely novel ransomware; family-level distribution is not reported, so leakage is possible.
  • domain assumption SMOTE-generated synthetic samples improve minority-class learning in this feature space
    The paper cites SMOTE literature but does not validate that synthetic Sysmon events are realistic; Section 3.3.2 acknowledges SMOTE degrades in high dimensions and relies on low-dimensional selected features.
  • standard math Standard definitions of CNN convolution, LSTM gates, and softmax attention are taken as given
    Used throughout Section 3.5 without proof.

how reviews work

0 comments
Cite this review

Pith. "Pith review of iCNN-LSTM: A batch-based incremental ransomware detection system using Sysmon." pith.science (2026). https://pith.science/paper/GQ4DEK4A

@misc{pith2026250101083,
  author       = {Pith},
  title        = {Pith review of: iCNN-LSTM: A batch-based incremental ransomware detection system using Sysmon},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/GQ4DEK4A}},
  note         = {Machine review of arXiv:2501.01083}
}
read the original abstract

In response to the increasing ransomware threat, this study presents a novel detection system that integrates Convolutional Neural Networks (CNNs) and Long Short-Term Memory (LSTM) networks. By leveraging Sysmon logs, the system enables real-time analysis on Windows-based endpoints. Our approach overcomes the limitations of traditional models by employing batch-based incremental learning, allowing the system to continuously adapt to new ransomware variants without requiring complete retraining. The proposed model achieved an impressive average F2-score of 99.61\%, with low false positive and false negative rates of 0.17\% and 4.69\%, respectively, within a highly imbalanced dataset. This demonstrates exceptional accuracy in identifying malicious behaviour. The dynamic detection capabilities of Sysmon enhance the model's effectiveness by providing a reliable stream of security events, mitigating the vulnerabilities associated with static detection methods. Furthermore, the parallel processing of LSTM modules, combined with attention mechanisms, significantly improves training efficiency and reduces latency, making our system well-suited for real-world applications. These findings underscore the potential of our CNN-LSTM framework as a robust solution for real-time ransomware detection, ensuring adaptability and resilience in the face of evolving cyber threats.

Figures

Figures reproduced from arXiv: 2501.01083 by the authors.

Figure 1
Figure 1. The proposed batch-based incremental ransomware detection framework using Sysmon. Blue arrows indicate the data stream that trains the model, while red arrows represent the data flow to be classified. Additionally, the blue dashed line symbolises the logical step of baselining the model, distinguishing it from actual data flows. Ispahany et al.: Preprint submitted to Elsevier Page 4 of 24 [PITH_FULL_IMAGE:figures/f… view at source ↗
Figure 2
Figure 2. The laboratory setup used to collect both ransomware and goodware events to build the dataset. some of which can be seen in [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. fastText conversion to vectors using n-grams. The above example shows the process of converting the word "explain" into vectors where 𝑣𝑛 represents the vector representation of the corresponding 𝑛-gram To elaborate, let’s denote the set of 𝑛-grams for a given word by 𝑤, a subset of the dictionary of all 𝑛-grams of size 𝐺. Each 𝑛-gram, 𝑔, from this set is mapped to a unique vector z𝑔 in an 𝑁-dimensional space. Simil… view at source ↗
Figures from the paper (8 more)
Figure 4
Figure 4. Figure 4: A heatmap showing the correlations between features within the training dataset with new batches of data, we ensure that our feature selection remains up-to-date and relevant to the evolving dynamics of the dataset. This systematic approach allows us to streamline our …
Figure 5
Figure 5. Figure 5: The structure of an LSTM model. The red region denoted by 𝑓𝑡 outlines the forget gate; The blue shaded region denoted by 𝑖 𝑡 represents the input gate, and the orange region (𝑂𝑡 ) represents the output gate or exploding and supports effective learning over time lags of…
Figure 6
Figure 6. Figure 6: The attention mechanism Finally, the output of the LSTM ℎ𝑡 is determined from the output gate vector 𝑜𝑡 and the activation of the cell state 𝐶𝑡 using Formula 12: ℎ𝑡 = 𝑜𝑡 ∗ tanh(𝐶𝑡 ) (12) 3.5.3. Attention mechanism Attention mechanisms have recently garnered significant…
Figure 7
Figure 7. Figure 7: The proposed CNN-LSTM model, comprising of parallel LSTM blocks and attention mechanisms 𝑐 = ∑ 𝑇 𝑡=1 𝛼𝑡ℎ𝑡 (15) Finally, the final output can be determined by combining the context vector 𝑐 with the hidden state of the current time step using the following formula: 𝑜𝑢𝑡𝑝…
Figure 8
Figure 8. Figure 8: The process to incrementally update the CNN-LSTM model. The initial model is built using training data. Subsequent mini-batches of 10,000 events are used to update the model weights periodically can be more indicative of malicious activity. The output of these layers i…
Figure 9
Figure 9. Figure 9: A graph demonstrating the F2-score vs Time of our batch-incremental ransomware detection technique (iCNN￾LSTM). Each data point consists of a new training batch used to update the model [PITH_FULL_IMAGE:figures/full_fig_p018_9.png]
Figure 10
Figure 10. Figure 10: A comparison of the F2-score, false negatives, and false positives of various CNN/LSTM models for ransomware/malware detection, as applied within our incremental learning framework, based on the literature [PITH_FULL_IMAGE:figures/full_fig_p019_10.png]
Figure 11
Figure 11. Figure 11: A comparison of the F2-score vs the runtime for various studies. The size of the data points represents the false negative rate Ispahany et al.: Preprint submitted to Elsevier Page 19 of 24 [PITH_FULL_IMAGE:figures/full_fig_p019_11.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

49 extracted references · 44 canonical work pages

  1. [1]

    Ispahany, R

    J. Ispahany, R. Islam, Detecting malicious covid-19 urls using machine learning techniques (2021)

    work page 2021

  2. [2]

    Beerman, D

    J. Beerman, D. Berent, Z. Falter, S. Bhunia, A review of colonial pipeline ransomware attack, in: 2023 IEEE/ACM 23rd International Symposium on Cluster, Cloud and Internet Computing Workshops (CCGridW), IEEE, 2023, pp. 8–15

    work page 2023

  3. [3]

    Dossett, A timeline of the biggest ransomware attacks (Nov 2021)

    J. Dossett, A timeline of the biggest ransomware attacks (Nov 2021). URL https://www.cnet.com/personal-finance/crypto/a-timeline-of-the-biggest-ransomware-attacks/

    work page 2021

  4. [4]

    Ispahany, M

    J. Ispahany, M. R. Islam, M. Z. Islam, M. A. Khan, Ransomware detection using machine learning: A review, research limitations and future directions, IEEE Access (2024)

    work page 2024

  5. [5]

    Bello, H

    I. Bello, H. Chiroma, U. A. Abdullahi, A. Y. Gital, F. Jauro, A. Khan, J. O. Okesola, S. M. Abdulhamid, Detecting ransomware attacks using intelligent algorithms: Recent development and next direction from deep learning and big data perspectives, Journal of Ambient Intelligence and Humanized Computing 12 (2021) 8699–8717

    work page 2021

  6. [6]

    D. W. Fernando, N. Komninos, T. Chen, A study on the evolution of ransomware detection using machine learning and deep learning techniques, IoT 1 (2) (2020) 551–604

    work page 2020

  7. [7]

    Hemalatha, S

    J. Hemalatha, S. A. Roseline, S. Geetha, S. Kadry, R. Damaševičius, An efficient densenet-based deep learning model for malware detection, Entropy 23 (3) (2021) 344

    work page 2021

  8. [8]

    E.B.Karbab,M.Debbabi,A.Derhab,Swiftr:Cross-platformransomwarefingerprintingusinghierarchicalneuralnetworksonhybridfeatures, Expert Systems with Applications 225 (2023) 120017

    work page 2023

Show all 49 references
  1. [9]

    B.Zhang,W.Xiao,X.Xiao,A.K.Sangaiah,W.Zhang,J.Zhang,Ransomwareclassificationusingpatch-basedcnnandself-attentionnetwork on embedded n-grams of opcodes, Future Generation Computer Systems 110 (2020) 708–720

    2020

  2. [10]

    Zhang, J

    X. Zhang, J. Wang, S. Zhu, Dual generative adversarial networks based unknown encryption ransomware attack detection, IEEE Access 10 (2021) 900–913

    2021

  3. [11]

    M.Gazzan,F.T.Sheldon,Anenhancedminimaxlossfunctiontechniqueingenerativeadversarialnetworkforransomwarebehaviorprediction, Future Internet 15 (10) (2023) 318

    2023

  4. [12]

    Zahoora, A

    U. Zahoora, A. Khan, M. Rajarajan, S. H. Khan, M. Asam, T. Jamal, Ransomware detection using deep learning based unsupervised feature extraction and a cost sensitive pareto ensemble classifier, Scientific Reports 12 (1) (2022) 15647

    2022

  5. [13]

    Woralert, C

    C. Woralert, C. Liu, Z. Blasingame, Hard-lite: A lightweight hardware anomaly realtime detection framework targeting ransomware, IEEE Transactions on Circuits and Systems I: Regular Papers (2023). Ispahany et al.:Preprint submitted to Elsevier Page 21 of 24 iCNN-LSTM: A batch-...

    2023

  6. [14]

    K.C.Roy,Q.Chen,Deepran:Attention-basedbilstmandcrfforransomwareearlydetectionandclassification,InformationSystemsFrontiers 23 (2) (2021) 299–315

    2021

  7. [15]

    Ciaramella, G

    G. Ciaramella, G. Iadarola, F. Martinelli, F. Mercaldo, A. Santone, Explainable ransomware detection with deep learning techniques, Journal of Computer Virology and Hacking Techniques (2023) 1–14

    2023

  8. [16]

    Y. Luan, S. Lin, Research on text classification based on cnn and lstm, in: 2019 IEEE international conference on artificial intelligence and computer applications (ICAICA), IEEE, 2019, pp. 352–355

    2019

  9. [17]

    M. Yang, J. Wang, Adaptability of financial time series prediction based on bilstm, Procedia Computer Science 199 (2022) 18–25

    2022

  10. [18]

    Shaohu, W

    L. Shaohu, W. Yuandeng, H. Rui, Prediction of drilling plug operation parameters based on incremental learning and cnn-lstm, Geoenergy Science and Engineering 234 (2024) 212631

    2024

  11. [19]

    J. Read, A. Bifet, B. Pfahringer, G. Holmes, Batch-incremental versus instance-incremental learning in dynamic and evolving data, in: AdvancesinIntelligentDataAnalysisXI:11thInternationalSymposium,IDA2012,Helsinki,Finland,October25-27,2012.Proceedings11, Springer, 2012, pp. 313–323

    2012

  12. [20]

    A.Gepperth,B.Hammer,Incrementallearningalgorithmsandapplications,in:Europeansymposiumonartificialneuralnetworks(ESANN), 2016

    2016

  13. [21]

    B.C.Wallace,K.Small,C.E.Brodley,T.A.Trikalinos,Classimbalance,redux,in:2011IEEE11thinternationalconferenceondatamining, Ieee, 2011, pp. 754–763

    2011

  14. [22]

    Belouadah, A

    E. Belouadah, A. Popescu, U. Aggarwal, L. Saci, Active class incremental learning for imbalanced datasets, in: European Conference on Computer Vision, Springer, 2020, pp. 146–162

    2020

  15. [23]

    B. A. S. Al-rimy, M. A. Maarof, S. Z. M. Shaid, Crypto-ransomware early detection model using novel incremental bagging with enhanced semi-random subspace selection, Future Generation Computer Systems 101 (2019) 476–491

    2019

  16. [24]

    Or-Meir, N

    O. Or-Meir, N. Nissim, Y. Elovici, L. Rokach, Dynamic malware analysis in the modern era—a state of the art survey, ACM Computing Surveys (CSUR) 52 (5) (2019) 1–48

    2019

  17. [25]

    Thara, B

    D. Thara, B. PremaSudha, F. Xiong, Auto-detection of epileptic seizure events using deep neural network with different feature scaling techniques, Pattern Recognition Letters 128 (2019) 544–550

    2019

  18. [26]

    2, IEEE, 2012, pp

    L.Lusa,etal.,Evaluationofsmoteforhigh-dimensionalclass-imbalancedmicroarraydata,in:201211thinternationalconferenceonmachine learning and applications, Vol. 2, IEEE, 2012, pp. 89–94

    2012

  19. [27]

    Bojanowski, E

    P. Bojanowski, E. Grave, A. Joulin, T. Mikolov, Enriching word vectors with subword information, Transactions of the association for computational linguistics 5 (2017) 135–146

    2017

  20. [28]

    Venkatesh, J

    B. Venkatesh, J. Anuradha, A review of feature selection and its methods, Cybernetics and information technologies 19 (1) (2019) 3–26

    2019

  21. [29]

    Goodfellow, Y

    I. Goodfellow, Y. Bengio, A. Courville, Deep learning, MIT press, 2016

    2016

  22. [30]

    Stanković, D

    L. Stanković, D. Mandic, Convolutional neural networks demystified: A matched filtering perspective-based tutorial, IEEE Transactions on Systems, Man, and Cybernetics: Systems 53 (6) (2023) 3614–3628

    2023

  23. [31]

    Hochreiter, J

    S. Hochreiter, J. Schmidhuber, Long short-term memory, Neural computation 9 (8) (1997) 1735–1780

    1997

  24. [32]

    2708–2717

    W.Zheng,P.Zhao,K.Huang,G.Chen,Understandingthepropertyoflongtermmemoryforthelstmwithattentionmechanism,in:Proceedings of the 30th ACM International Conference on Information & Knowledge Management, 2021, pp. 2708–2717

    2021

  25. [33]

    S. Chen, L. Ge, Exploring the attention mechanism in lstm-based hong kong stock price movement prediction, Quantitative Finance 19 (9) (2019) 1507–1515

    2019

  26. [34]

    L.Zhang,G.Zhu,L.Mei,P.Shen,S.A.A.Shah,M.Bennamoun,Attentioninconvolutionallstmforgesturerecognition,Advancesinneural information processing systems 31 (2018)

    2018

  27. [35]

    X. Dai, H. Yin, N. K. Jha, Grow and prune compact, fast, and accurate lstms, IEEE Transactions on Computers 69 (3) (2019) 441–452

    2019

  28. [36]

    J. Zhang, Deepmal: A cnn-lstm model for malware detection based on dynamic semantic behaviours, in: 2020 International Conference on Computer Information and Big Data Applications (CIBDA), IEEE, 2020, pp. 313–316

    2020

  29. [37]

    F. O. Ozkok, M. Celik, A hybrid cnn-lstm model for high resolution melting curve classification, Biomedical Signal Processing and Control 71 (2022) 103168

    2022

  30. [38]

    W. Lu, J. Li, Y. Li, A. Sun, J. Wang, A cnn-lstm-based model to forecast stock prices, Complexity 2020 (1) (2020) 6622927

    2020

  31. [39]

    M.S.Akhtar,T.Feng,Detectionofmalwarebydeeplearningascnn-lstmmachinelearningtechniquesinrealtime,Symmetry14(11)(2022) 2308

    2022

  32. [40]

    Srivastava, G

    N. Srivastava, G. Hinton, A. Krizhevsky, I. Sutskever, R. Salakhutdinov, Dropout: a simple way to prevent neural networks from overfitting, The journal of machine learning research 15 (1) (2014) 1929–1958

    2014

  33. [41]

    G. E. Hinton, N. Srivastava, A. Krizhevsky, I. Sutskever, R. R. Salakhutdinov, Improving neural networks by preventing co-adaptation of feature detectors, arXiv preprint arXiv:1207.0580 (2012)

    2012 arXiv

  34. [42]

    Akiba, S

    T. Akiba, S. Sano, T. Yanase, T. Ohta, M. Koyama, Optuna: A next-generation hyperparameter optimization framework, in: Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2019

    2019

  35. [43]

    Christen, D

    P. Christen, D. J. Hand, N. Kirielle, A review of the f-measure: its history, properties, criticism, and alternatives, ACM Computing Surveys 56 (3) (2023) 1–24

    2023

  36. [44]

    Maniath, A

    S. Maniath, A. Ashok, P. Poornachandran, V. Sujadevi, P. S. AU, S. Jan, Deep learning lstm based ransomware detection, in: 2017 Recent Developments in Control, Automation & Power Engineering (RDCAPE), IEEE, 2017, pp. 442–446

    2017

  37. [45]

    R.Agrawal,J.W.Stokes,M.Marinescu,K.Selvaraj,Robustneuralmalwaredetectionmodelsforemulationsequencelearning,in:MILCOM 2018-2018 IEEE Military Communications Conference (MILCOM), IEEE, 2018, pp. 1–8

    2018

  38. [46]

    Homayoun, A

    S. Homayoun, A. Dehghantanha, M. Ahmadzadeh, S. Hashemi, R. Khayami, K.-K. R. Choo, D. E. Newton, Drthis: Deep ransomware threat hunting and intelligence system at the fog layer, Future Generation Computer Systems 90 (2019) 94–104

    2019

  39. [47]

    Bensaoud, J

    A. Bensaoud, J. Kalita, Cnn-lstm and transfer learning models for malware classification based on opcodes and api calls, Knowledge-Based Systems 290 (2024) 111543. Ispahany et al.:Preprint submitted to Elsevier Page 22 of 24 iCNN-LSTM: A batch-based incremental ransomware dete...

    2024

  40. [48]

    Deivakani, M

    M. Deivakani, M. S. Sheela, K. Priyadarsini, Y. Farhaoui, An intelligent security mechanism in mobile ad-hoc networks using precision probability genetic algorithms (ppga) and deep learning technique (stacked lstm), Sustainable Computing: Informatics and Systems (2024) 101021....

    2024

  41. [49]

    He is a recipient of a scholarship at the Cyber Security Cooperative Research Centre (CSCRC)

    Biography Section Jamil Ispahanyis pursuing a PhD at the School of Computing, Mathematics and Engineering at Charles Sturt University, Australia. He is a recipient of a scholarship at the Cyber Security Cooperative Research Centre (CSCRC). His research interests include cyber ...

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.