Pith. sign in

REVIEW 4 major objections 6 minor 55 references

A Sysmon Incremental Learning System for Ransomware Analysis and Detection

T0 review · 4 major / 6 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A streaming Sysmon-based ransomware detector achieves 98.89% accuracy and adapts to new families without full retraining.

desk verdict A credible online-learning ransomware detector on Sysmon logs, but the stitched evaluation stream makes the headline numbers hard to trust for real deployments. read the letter →

arxiv 2501.01089 v1 pith:ZYQIPOMO submitted 2025-01-02 cs.CR

Jamil Ispahany , MD Rafiqul Islam , M. Arif Khan , MD Zahidul Islam This is my paper · ORCID
classification cs.CR
keywords ransomwaredetectionincrementallearningonlineconceptdriftsysmonadaptiverandomforestfeatureselectionimbalanceddata
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that ransomware can be detected continuously, as it happens, by feeding Windows Sysmon security events into an online incremental learning model that updates itself without full retraining. The authors build SILRAD, which uses an Adaptive Random Forest classifier, selects a handful of the most predictive Sysmon features via Pearson correlation, and triggers model updates via ADWIN concept-drift detection. On a stitched stream of nearly 200,000 Sysmon events from six ransomware families, SILRAD reports 98.89% accuracy and a Matthews Correlation Coefficient of 94.11%, and its performance improves as new ransomware families appear. The authors argue that this closes the 'training gap' that leaves systems vulnerable between batch retraining cycles, and that it does so with lower memory and faster classification than competing incremental methods.

What carries the argument

The load-bearing mechanism is the combination of three components: (1) Adaptive Random Forest (ARF), an ensemble of decision trees that each update incrementally and vote on streaming instances; (2) ADWIN (Adaptive Windowing), a drift detector that keeps a variable-length window of recent errors and shrinks the window—and signals a model reset—when the mean error of two sub-windows differs beyond a confidence-based bound; (3) Pearson Correlation Coefficient (PCC) feature selection, which ranks Sysmon log fields by linear correlation with the ransomware/benign label so the model uses only the most predictive features. The paper's contribution is the specific assembly of these pieces on Sysmon events, plus a lab setup that detonates live ransomware in Windows virtual machines and forwards events to a central logging server for feature extraction via fastText embeddings.

What would settle it

Deploy SILRAD on natural continuous Sysmon logs collected from production Windows endpoints (or an instrumented sandbox with interleaved benign and malicious activity), feed it a holdout set of ransomware families not seen in training, and check whether the MCC stays above 94% and whether ADWIN triggers on genuine drift; if accuracy drops below the reported range or the drift detector fires spuriously when the stream is not stitched into blocks, the central claim would be contradicted.

Watch

Extended reading notes

Core claim

SILRAD's central claim is that ransomware behaviour is learnable from a live Sysmon event stream with an online incremental classifier, provided the model can adapt to concept drift. Using only five Sysmon features—TargetObject, Task, CallTrace, ParentImage, and IntegrityLevel—the Adaptive Random Forest engine, coupled with ADWIN drift detection, detects ransomware from six modern families with 98.89% accuracy and a 94.11% MCC on an imbalanced stream in which ransomware is the minority class. The authors further show that, in contrast to batch-trained models (kNN, Naive Bayes, Random Forest) whose MCC collapses as new families are introduced, SILRAD's MCC stays above 90% and even improves over time (Fig. 9a), because ADWIN resets the model when the stream statistics change. They position this as the first online incremental ransomware detector over Sysmon streams, rather than batch or mini-batch updates.

Load-bearing premise

The evaluation assumes that the stitched sequence of separately captured benign and ransomware Sysmon events faithfully represents the temporal order, interleaving, and noise of a real production endpoint stream, so that the measured drift adaptation and accuracy transfer to live deployment.

Editorial extensions

If this is right

  • Traditional batch classifiers (kNN, Naive Bayes, Random Forest) drop to MCC values below 35% when new ransomware families appear, while SILRAD stays above 94% MCC.
  • Five Sysmon features—TargetObject, Task, CallTrace, ParentImage, and IntegrityLevel—carry almost all of the detection signal, so a lightweight agent can monitor endpoints in real time.
  • SILRAD consumes less memory and classifies faster than Adaptive Random Forest, Hoeffding Tree, Leveraging Bagging, and Streaming Random Patches, while maintaining an MCC over 94%.
  • The improvement of SILRAD's MCC over time as new families are introduced (Fig. 9a) indicates that ADWIN successfully detects and reacts to concept drift in an imbalanced stream.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the pipeline is not ransomware-specific, the same ARF+ADWIN+PCC design could be transferred to other endpoint telemetry (PowerShell logs, ETW events) where concept drift is expected.
  • The reported accuracy depends on the stitched stream; a natural next experiment is to run SILRAD on raw continuous Sysmon logs from an instrumented network to see whether ADWIN still triggers correctly when benign and malicious events interleave naturally rather than in blocks.
  • Since SILRAD's MCC is slightly below Leveraging Bagging and Streaming Random Patches but with a much smaller resource footprint, tuning ARF hyperparameters or adding a second drift detector could close that accuracy gap.
  • The dominance of TargetObject and CallTrace suggests that ransomware detection is driven by object-access and process-ancestry patterns; testing how the top-five feature ranking shifts across a wider set of ransomware families would clarify its generality.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes SILRAD, an online incremental learning system that detects ransomware from Sysmon event streams. The system uses Adaptive Random Forest (ARF) as the base classifier, Pearson Correlation Coefficient (PCC) for feature selection, and ADWIN for concept drift detection. The authors constructed a custom dataset by stitching Sysmon captures from 50 ransomware detonations (six families, 20,710 events) and benign activity (176,130 events), and report 98.89% accuracy and 94.11% MCC for SILRAD, along with lower memory consumption and faster classification than several competing incremental learners.

Significance. If the reported results are robust, the paper makes a useful contribution by demonstrating that online incremental learning can be applied to Sysmon-based ransomware detection, addressing a real limitation of batch retraining. Strengths include the use of live ransomware samples, a Sysmon-specific feature representation, comparison with multiple incremental and batch classifiers, and reporting of resource consumption alongside predictive performance. However, the evaluation rests on a stitched block-structured stream whose realism is not established, and the feature-count selection is performed on the same data used for reporting. The core idea is promising, but the current evidence is not sufficient to support the paper's central claims about continuous real-world detection.

major comments (4)
  1. [Section 4.4, Fig. 9a] The evaluation stream is described as a concatenation of separately captured goodware and ransomware Sysmon events, with 'blocks of ransomware activity positioned throughout.' No details are given for block order, family order, block lengths, or the stitching rule. Because the model is updated after every labeled event (Algorithm 1), long runs of same-class events let the classifier rapidly adapt to each family's characteristics; the rising MCC curve in Fig. 9a may therefore reflect label-run structure rather than performance on an interleaved production stream. Please report the exact stream construction, evaluate at least one interleaved or temporally realistic stream, and provide per-block and per-family results.
  2. [Section 5.2, Table 3] The number of features (5) was chosen after evaluating classifier performance on the test data, as Table 3 reports MCC for 5, 10, 15, 20, and 25 features and the text selects the best value. This is a form of test-set selection and can inflate the reported metrics. No separate validation procedure or error bars are given. Please use a held-out validation stream for feature-count selection, or report cross-validation or repeated-run variance, so the headline accuracy and MCC are not optimistically biased.
  3. [Table 4, Section 5.3, Abstract, Conclusion] The reported metrics for SILRAD are internally inconsistent. Section 5.3 states 'yielded 98.88% accuracy, 94.99% precision, 94.35% recall, an F1-score of 94.67% and a Matthews correlation coefficient (MCC) 94.04%,' while Table 4 and the abstract/conclusion report 98.89% accuracy, 94.87% precision, 94.59% recall, 94.73% F1-score, and 94.11% MCC. Please reconcile these numbers and ensure all tables, text, and the abstract refer to the same experimental run.
  4. [Table 4, Section 5.3] The comparison with other incremental classifiers is not fully specified: it is unclear whether ARF, HT, LB, and SRP used the same five features selected by PCC or the full feature set. Since the paper's claims about SILRAD's lower memory and faster classification time are central, the comparison must control for the feature set and hyperparameters across all methods. Please state the exact feature set and hyperparameters used for each classifier.
minor comments (6)
  1. [Algorithm 1] The pseudocode is incomplete and contains typographical errors: 'ConvertSentanceToVector' is misspelled, the prediction variable '̈y' is rendered incorrectly, and the algorithm does not specify how the ADWIN window W is used to trigger a model reset.
  2. [Eq. (1)] The scoring function for fastText is mathematically ill-formed: the expression sets a sum of inner products equal to 1, which is not a definition of a score. Please rewrite this as a proper scoring or embedding formula.
  3. [Eq. (3)] The notation for the incremental prediction is confusing: a summation over time is used to define a single prediction. It should be written as y_hat_t = m_{t-1}(x_t), with a separate statement that each prediction is made before the model update.
  4. [Fig. 10] The box plot shows a distribution of MCC values, but the online evaluation appears to be a single pass over one stream. Please explain how the multiple MCC values were obtained (e.g., repeated runs with different seeds, or per-window measurements).
  5. [Sections 5.2 and 5.3] Hyperparameters are only partially reported: ensemble sizes for ARF, LB, and SRP, the number of trees, and the grace period for HT are not fully specified. This limits reproducibility.
  6. [Table 4] 'Random Forrest' should be 'Random Forest'. Additionally, the table should indicate which classifiers are online incremental and which are batch to avoid confusion.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity; SILRAD's reported accuracy and MCC are empirical measurements over an event stream, not quantities forced by construction.

full rationale

The paper's derivation chain is empirical rather than definitional. Predictions are produced by feeding Sysmon events to an Adaptive Random Forest classifier and comparing predicted labels with observed labels; the reported 98.89% accuracy and 94.11% MCC are measured outcomes, not fitted inputs. PCC feature selection (Eq. 2) uses the true class label to rank features, but the paper explicitly restricts this to the training stream, and the selected features are then used to train a classifier whose predictions on subsequent events are evaluated. ADWIN drift detection is an external algorithm, and no equation in the paper defines the reported result in terms of the model's own parameters. The stitched benign/ransomware stream described in Section 4.4 is a threat to external validity rather than circularity: even if block-level label runs inflate the MCC, the metric is still an empirical evaluation outcome. The paper's own stated limitation in Section 3.3 that key features may change over time is a recognized caveat, not a circular step. The two author self-citations (refs [1] and [5]) are background and review references and are not load-bearing for the claimed result. No self-definitional step, fitted-input-as-prediction, or imported uniqueness theorem was found.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The central claim depends on the synthetic stream being representative of real Sysmon traffic, on the sufficiency of six ransomware families to simulate drift, and on event-level classification without temporal context. Feature count (5) and ADWIN delta (0.002) are the main tuned parameters. No new entities are postulated.

free parameters (2)
  • Number of selected features = 5
    The paper evaluated 5, 10, 15, 20, and 25 features and reports the best MCC at 5 (Table 3), making the feature count a post-hoc choice that boosts the headline result.
  • ADWIN confidence delta = 0.002
    Default delta value kept for drift detection; it controls sensitivity of window cuts and thus affects how quickly the model resets (Section 5.2).
assumptions (4)
  • ad hoc to paper The stitched benign/ransomware event stream faithfully represents a continuous real-time Sysmon stream.
    Section 4.4 combines separately collected sequences; no validation that temporal structure matches a live endpoint.
  • domain assumption Six ransomware families and 50 detonations are sufficient to simulate concept drift for new strains.
    Drift is simulated by ordering families in the stream; the limited sample count may not reflect real-world diversity (Section 4.4).
  • domain assumption Event-level classification is the correct granularity for ransomware detection.
    Each Sysmon event is classified independently; no session or sequence context is used (Sections 3.4, 4.4).
  • domain assumption fastText embedding, averaged over word vectors, preserves enough semantic signal for the textual features.
    The average of 100-dimensional word vectors may discard word order and context (Section 3.2).

how reviews work

0 comments
Cite this review

Pith. "Pith review of A Sysmon Incremental Learning System for Ransomware Analysis and Detection." pith.science (2026). https://pith.science/paper/ZYQIPOMO

@misc{pith2026250101089,
  author       = {Pith},
  title        = {Pith review of: A Sysmon Incremental Learning System for Ransomware Analysis and Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ZYQIPOMO}},
  note         = {Machine review of arXiv:2501.01089}
}
read the original abstract

In the face of increasing cyber threats, particularly ransomware attacks, there is a pressing need for advanced detection and analysis systems that adapt to evolving malware behaviours. Throughout the literature, using machine learning (ML) to obviate ransomware attacks has increased in popularity. Unfortunately, most of these proposals leverage non-incremental learning approaches that require the underlying models to be updated from scratch to detect new ransomware, wasting time and resources. This approach is problematic because it leaves sensitive data vulnerable to attack during retraining, as newly emerging ransomware strains may go undetected until the model is updated. Furthermore, most of these approaches are not designed to detect ransomware in real-time data streams, limiting their effectiveness in complex network environments. To address this challenge, we present the Sysmon Incremental Learning System for Ransomware Analysis and Detection (SILRAD), which enables continuous updates to the underlying model and effectively closes the training gap. By leveraging the capabilities of Sysmon for detailed monitoring of system activities, our approach integrates online incremental learning techniques to enhance the adaptability and efficiency of ransomware detection. The most valuable features for detection were selected using the Pearson Correlation Coefficient (PCC), and concept drift detection was implemented through the ADWIN algorithm, ensuring that the model remains responsive to changes in ransomware behaviour. We compared our results to other popular techniques, such as Hoeffding Trees (HT) and Leveraging Bagging Classifier (LB), observing a detection accuracy of 98.89% and a Matthews Correlation Coefficient (MCC) rate of 94.11%, demonstrating the effectiveness of our technique.

Figures

Figures reproduced from arXiv: 2501.01089 by the authors.

Figure 1
Figure 1. The Proposed Sysmon Incremental Learning System for Ransomware Analysis and Detection (SILRAD). The blue arrows indicate the data stream used to train the model, and the red arrows indicate system activity to be classified 3.1. Dynamic analysis using Sysmon Employing dynamic analysis mitigates the vulnerabilities of static analysis, such as obfuscation and polymorphism. Subsequently, researchers have explored a broa… view at source ↗
Figure 2
Figure 2. fastText conversion to vectors using n-grams. The above example shows the process to convert the word "explain" into vectors where 𝑣𝑛 represents the vector representation of the corresponding 𝑛-gram within the training stream, as illustrated in the [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. The most significant Sysmon features calculated by the Pearson Correlation Coefficient (PCC) 𝑃 𝐶𝐶(𝑥, 𝑦) = 𝑐𝑜𝑣(𝑥, 𝑦) 𝜎𝑥𝜎𝑦 = 𝐸[(𝑥 − 𝑥)(𝑦 − 𝑦)] 𝜎𝑥𝜎𝑦 (2) Where 𝑥 and 𝑦 are the averages of 𝑥 and 𝑦; 𝜎𝑥 and 𝜎𝑦 are the standard deviations, respectively [47]. As seen in [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: The online learning model used by SILRAD whereby the model is trained and predictions made per instance of data arriving 𝑡 ≤ 1 does not produce accurate predictions for ̂𝑦0 , as can be seen in the results in Fig. 9a. For this reason, it is assumed real-world scenario, …
Figure 5
Figure 5. Figure 5: The experiment setup used to detonate ransomware and harvest features 4.2. SILRAD environment The core infrastructure of SILRAD is hosted on an Ubuntu Server 22.04 LTS, equipped with 4 CPUs, 12GB of RAM, and 80GB of disk space. SILRAD operates through two primary compo…
Figure 6
Figure 6. Figure 6: Number of Sysmon events triggered from both goodware and ransomware by eventID Ispahany et al.: Preprint submitted to Elsevier Page 12 of 20 [PITH_FULL_IMAGE:figures/full_fig_p012_6.png]
Figure 7
Figure 7. Figure 7: The training and testing approach for traditional ML techniques [PITH_FULL_IMAGE:figures/full_fig_p014_7.png]
Figure 8
Figure 8. Figure 8: MCC rate of training and testing the dataset using traditional ML techniques 5. Results We carried out two experiments to validate the effectiveness of SILRAD. First, we measured the performance of traditional ML techniques against the dataset to validate the article’s…
Figure 9
Figure 9. Figure 9: MCC rate over time and Memory consumption over time for SILRAD and several incremental learning algorithms 5.2. Experiment two: Comparing SILRADs performance with different features To optimise SILRAD’s performance, we evaluate the classification results using differen…
Figure 10
Figure 10. Figure 10: Box plot to show the distribution of the MCC rate for various classifiers 6. Conclusion and future work This paper proposed the Sysmon Incremental Learning system for Ransomware Analysis and Detection (SILRAD) technique to detect ransomware activity. Using only five f…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

55 extracted references · 48 canonical work pages

  1. [1]

    Ispahany, R

    J. Ispahany, R. Islam, Detecting malicious covid-19 urls using machine learning techniques (2021)

    2021

  2. [2]

    URL https://home.treasury.gov/news/press-releases/jy0471

    Treasury continues to counter ransomware as part of whole-of-government effort; sanctions ransomware operators and virtual currency exchange (Nov 2021). URL https://home.treasury.gov/news/press-releases/jy0471

    work page 2021

  3. [3]

    B. A. S. Al-rimy, M. A. Maarof, S. Z. M. Shaid, Ransomware threat success factors, taxonomy, and countermeasures: A survey and research directions, Computers & Security 74 (2018) 144–166

    work page 2018

  4. [4]

    Urooj, B

    U. Urooj, B. A. S. Al-rimy, A. Zainal, F. A. Ghaleb, M. A. Rassam, Ransomware detection using the dynamic analysis and machine learning: A survey and research directions, Applied Sciences 12 (1) (2021) 172. Ispahany et al.: Preprint submitted to Elsevier Page 17 of 20 A Sysmon Incremental Learning System for Ransomware Analysis and Detection

    work page 2021

  5. [5]

    Ispahany, M

    J. Ispahany, M. R. Islam, M. Z. Islam, M. A. Khan, Ransomware detection using machine learning: A review, research limitations and future directions, IEEE Access (2024)

    2024

  6. [6]

    Barnum, Standardizing cyber threat intelligence information with the structured threat information expression (stix), Mitre Corporation 11 (2012) 1–22

    S. Barnum, Standardizing cyber threat intelligence information with the structured threat information expression (stix), Mitre Corporation 11 (2012) 1–22

    work page 2012

  7. [7]

    The Federal Bureau of Investigation (FBI), I

    C. The Federal Bureau of Investigation (FBI), I. S. A. (CISA), the Multi-State Information Sharing, A. C. (MS-ISAC), Stopransomware: Rhysida ransomware (Nov 2023). URL https://www.cisa.gov/sites/default/files/2023-11/aa23-319a-stopransomware-rhysida-ransomware_1.pdf

    work page 2023

  8. [8]

    D. C. D’Elia, L. Invidia, L. Querzoni, Rope: Covert multi-process malware execution with return-oriented programming, in: European Symposium on Research in Computer Security, Springer, 2021, pp. 197–217

    work page 2021

Show all 55 references
  1. [9]

    S.S.Chakkaravarthy,D.Sangeetha,V.Vaidehi,Asurveyonmalwareanalysisandmitigationtechniques,ComputerScienceReview32(2019) 1–23

    2019

  2. [10]

    Afianian, S

    A. Afianian, S. Niksefat, B. Sadeghiyan, D. Baptiste, Malware dynamic analysis evasion techniques: A survey, ACM Computing Surveys (CSUR) 52 (6) (2019) 1–28

    2019

  3. [11]

    Kumar, et al., An emerging threat fileless malware: a survey and research challenges, Cybersecurity 3 (1) (2020) 1–12

    S. Kumar, et al., An emerging threat fileless malware: a survey and research challenges, Cybersecurity 3 (1) (2020) 1–12

    2020

  4. [12]

    URL https://www.ic3.gov/Media/News/2022/220318.pdf

    Indicators of compromise associated with avoslocker ransomware (Mar 2022). URL https://www.ic3.gov/Media/News/2022/220318.pdf

    2022

  5. [13]

    Bajpai, R

    P. Bajpai, R. Enbody, Attacking key management in ransomware, IT Professional 22 (2) (2020) 21–27

    2020

  6. [14]

    H. Liu, P. Patras, Netsentry: A deep learning approach to detecting incipient large-scale network attacks, Computer Communications 191 (2022) 119–132

    2022

  7. [15]

    Berrueta, D

    E. Berrueta, D. Morato, E. Magaña, M. Izal, Crypto-ransomware detection using machine learning models in file-sharing network scenarios with encrypted traffic, Expert Systems with Applications 209 (2022) 118299

    2022

  8. [16]

    L.FernandezMaimo,A.HuertasCeldran,A.L.PeralesGomez,F.J.GarciaClemente,J.Weimer,I.Lee,Intelligentanddynamicransomware spread detection and mitigation in integrated clinical environments, Sensors 19 (5) (2019) 1114

    2019

  9. [17]

    Homayoun, A

    S. Homayoun, A. Dehghantanha, M. Ahmadzadeh, S. Hashemi, R. Khayami, K.-K. R. Choo, D. E. Newton, Drthis: Deep ransomware threat hunting and intelligence system at the fog layer, Future Generation Computer Systems 90 (2019) 94–104

    2019

  10. [18]

    S. K. Shaukat, V. J. Ribeiro, Ransomwall: A layered defense system against cryptographic ransomware attacks using machine learning, in: 2018 10th International Conference on Communication Systems & Networks (COMSNETS), IEEE, 2018, pp. 356–363

    2018

  11. [19]

    K.C.Roy,Q.Chen,Deepran:Attention-basedbilstmandcrfforransomwareearlydetectionandclassification,InformationSystemsFrontiers 23 (2) (2021) 299–315

    2021

  12. [20]

    A. O. Almashhadani, M. Kaiiali, D. Carlin, S. Sezer, Maldomdetector: A system for detecting algorithmically generated domain names with machine learning, Computers & Security 93 (2020) 101787

    2020

  13. [21]

    Y. Ye, T. Li, Y. Chen, Q. Jiang, Automatic malware categorization using cluster ensemble, in: Proceedings of the 16th ACM SIGKDD international conference on Knowledge discovery and data mining, 2010, pp. 95–104

    2010

  14. [22]

    Santos, J

    I. Santos, J. Nieves, P. G. Bringas, Semi-supervised learning for unknown malware detection, in: International Symposium on Distributed Computing and Artificial Intelligence, Springer, 2011, pp. 415–422

    2011

  15. [23]

    J.Singh,J.Singh,Asurveyonmachinelearning-basedmalwaredetectioninexecutablefiles,JournalofSystemsArchitecture(2020)101861

    2020

  16. [24]

    Hsu, C.-C

    C.-M. Hsu, C.-C. Yang, H.-H. Cheng, P. E. Setiasabda, J.-S. Leu, Enhancing file entropy analysis to improve machine learning detection rate of ransomware, IEEE Access 9 (2021) 138345–138351

    2021

  17. [25]

    Y.A.Ahmed,B.Koçer,S.Huda,B.A.S.Al-rimy,M.M.Hassan,Asystemcallrefinement-basedenhancedminimumredundancymaximum relevance method for ransomware early detection, Journal of Network and Computer Applications 167 (2020) 102753

    2020

  18. [26]

    S. Kok, A. Abdullah, N. Jhanjhi, Early detection of crypto-ransomware using pre-encryption detection algorithm, Journal of King Saud University-Computer and Information Sciences (2020)

    2020

  19. [27]

    B. M. Khammas, Ransomware detection using random forest technique, ICT Express 6 (4) (2020) 325–331

    2020

  20. [28]

    S. Kok, A. Azween, N. Jhanjhi, Evaluation metric for crypto-ransomware detection using machine learning, Journal of Information Security and Applications 55 (2020) 102646

    2020

  21. [29]

    Chaganti, V

    R. Chaganti, V. Ravi, T. D. Pham, A multi-view feature fusion approach for effective malware classification using deep learning, Journal of Information Security and Applications 72 (2023) 103402

    2023

  22. [30]

    Gulmez, A

    S. Gulmez, A. G. Kakisim, I. Sogukpinar, Xran: Explainable deep learning-based ransomware detection using dynamic analysis, Computers & Security (2024) 103703

    2024

  23. [31]

    Ciaramella, G

    G. Ciaramella, G. Iadarola, F. Martinelli, F. Mercaldo, A. Santone, Explainable ransomware detection with deep learning techniques, Journal of Computer Virology and Hacking Techniques (2023) 1–14

    2023

  24. [32]

    M. Cen, X. Deng, F. Jiang, R. Doss, Zero-ran sniff: A zero-day ransomware early detection method based on zero-shot learning, Computers & Security 142 (2024) 103849

    2024

  25. [33]

    Z. Li, A. L. G. Rios, L. Trajković, Machine learning for detecting the westrock ransomware attack using bgp routing records, IEEE Communications Magazine 61 (3) (2022) 20–26

    2022

  26. [34]

    Rhode, P

    M. Rhode, P. Burnap, A. Wedgbury, Real-time malware process detection and automated process killing, Security and Communication Networks 2021 (2021) 1–23

    2021

  27. [35]

    R. M. A. Molina, S. Torabi, K. Sarieddine, E. Bou-Harb, N. Bouguila, C. Assi, On ransomware family attribution using pre-attack paranoia activities, IEEE Transactions on Network and Service Management (2021)

    2021

  28. [36]

    Woralert, C

    C. Woralert, C. Liu, Z. Blasingame, Hard-lite: A lightweight hardware anomaly realtime detection framework targeting ransomware, IEEE Transactions on Circuits and Systems I: Regular Papers (2023)

    2023

  29. [37]

    Davidian, M

    M. Davidian, M. Kiperberg, N. Vanetik, Early ransomware detection with deep learning models, Future Internet 16 (8) (2024) 291. Ispahany et al.: Preprint submitted to Elsevier Page 18 of 20 A Sysmon Incremental Learning System for Ransomware Analysis and Detection

    2024

  30. [38]

    A.A.Darem,F.A.Ghaleb,A.A.Al-Hashmi,J.H.Abawajy,S.M.Alanazi,A.Y.Al-Rezami,Anadaptivebehavioral-basedincrementalbatch learning malware variants detection model using concept drift detection and sequential deep learning, IEEE Access 9 (2021) 97180–97196

    2021

  31. [39]

    J.Li,D.Xue,W.Wu,J.Wang,Incrementallearningformalwareclassificationinsmalldatasets,SecurityandCommunicationNetworks2020 (2020)

    2020

  32. [40]

    M. Yang, J. Wang, Adaptability of financial time series prediction based on bilstm, Procedia Computer Science 199 (2022) 18–25

    2022

  33. [41]

    Caviglione, M

    L. Caviglione, M. Choraś, I. Corona, A. Janicki, W. Mazurczyk, M. Pawlicki, K. Wasielewska, Tight arms race: overview of current malware threats and trends in their detection, IEEE Access (2020)

    2020

  34. [42]

    Mavroeidis, A

    V. Mavroeidis, A. Jøsang, Data-driven threat hunting using sysmon, in: Proceedings of the 2nd international conference on cryptography, security and privacy, 2018, pp. 82–88

    2018

  35. [43]

    C.Smiliotopoulos,K.Barmpatsalou,G.Kambourakis,Revisitingthedetectionoflateralmovementthroughsysmon,AppliedSciences12(15) (2022) 7746

    2022

  36. [44]

    Grimshaw, B

    C. Grimshaw, B. Lachine, T. Perkins, E. Coote, Link-based anomaly detection with sysmon and graph neural networks, in: 2024 IEEE 3rd International Conference on AI in Cybersecurity (ICAIC), IEEE, 2024, pp. 1–6

    2024

  37. [45]

    Do Xuan, D

    C. Do Xuan, D. Huong, A new approach for apt malware detection based on deep graph network for endpoint systems, Applied Intelligence 52 (12) (2022) 14005–14024

    2022

  38. [46]

    Bojanowski, E

    P. Bojanowski, E. Grave, A. Joulin, T. Mikolov, Enriching word vectors with subword information, Transactions of the association for computational linguistics 5 (2017) 135–146

    2017

  39. [47]

    doi:10.1007/978-1-4419-9863-7_ 372

    J.Wang,PearsonCorrelationCoefficient,SpringerNewYork,NewYork,NY,2013,pp.1671–1671. doi:10.1007/978-1-4419-9863-7_ 372. URL https://doi.org/10.1007/978-1-4419-9863-7_372

    2013 doi

  40. [48]

    Bernardo, E

    A. Bernardo, E. Della Valle, A. Bifet, Incremental rebalancing learning on evolving data streams, in: 2020 International Conference on Data Mining Workshops (ICDMW), IEEE, 2020, pp. 844–850

    2020

  41. [49]

    H.M.Gomes,A.Bifet,J.Read,J.P.Barddal,F.Enembreck,B.Pfharinger,G.Holmes,T.Abdessalem,Adaptiverandomforestsforevolving data stream classification, Machine Learning 106 (9) (2017) 1469–1495

    2017

  42. [50]

    A.Bifet,R.Gavalda,Learningfromtime-changingdatawithadaptivewindowing,in:Proceedingsofthe2007SIAMinternationalconference on data mining, SIAM, 2007, pp. 443–448

    2007

  43. [51]

    H. M. Gomes, J. Read, A. Bifet, Streaming random patches for evolving data stream classification, in: 2019 IEEE international conference on data mining (ICDM), IEEE, 2019, pp. 240–249

    2019

  44. [52]

    Montiel, M

    J. Montiel, M. Halford, S. M. Mastelini, G. Bolmier, R. Sourty, R. Vaysse, A. Zouitine, H. M. Gomes, J. Read, T. Abdessalem, et al., River: machine learning for streaming data in python, The Journal of Machine Learning Research 22 (1) (2021) 4945–4952

    2021

  45. [53]

    Y. Liu, Y. Li, D. Xie, Implications of imbalanced datasets for empirical roc-auc estimation in binary classification tasks, Journal of Statistical Computation and Simulation (2023) 1–21

    2023

  46. [54]

    Chicco, G

    D. Chicco, G. Jurman, The matthews correlation coefficient (mcc) should replace the roc auc as the standard metric for assessing binary classification, BioData Mining 16 (1) (2023) 1–23. Ispahany et al.: Preprint submitted to Elsevier Page 19 of 20 A Sysmon Incremental Learnin...

    2023

  47. [55]

    He is a recipient of a scholarship at the Cyber Security Cooperative Research Centre (CSCRC)

    Biography Section Jamil Ispahanyis pursuing a PhD at the School of Computing, Mathematics and Engineering at Charles Sturt University, Australia. He is a recipient of a scholarship at the Cyber Security Cooperative Research Centre (CSCRC). His research interests include cyber ...

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.