Pith. sign in

REVIEW 3 major objections 5 minor 51 references

A Kings Ransom for Encryption: Ransomware Classification using Augmented One-Shot Learning and Bayesian Approximation

T0 review · 3 major / 5 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that a person can identify which of 50 ransomware families has infected a machine by photographing the splash screen or ransom note with an ordinary phone, using one clean reference image per family and uncertainty-based…

desk verdict Practical ransomware-photo classification with a real evaluation flaw: the 93.6% headline isn't unbiased because excluded grid searches leak test information. read the letter →

arxiv 1908.06750 v1 pith:N7FHFSEX submitted 2019-08-19 cs.CV cs.CRcs.LG

Amir Atapour-Abarghouei , Stephen Bonner , Andrew Stephen McGough This is my paper · ORCID
classification cs.CVcs.CRcs.LG
keywords ransomwareclassificationone-shotlearningdataaugmentationmodeluncertaintyBayesianapproximationdropoutsplashscreenrecognitionimage
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Ransomware victims, especially non-experts, currently have few options after infection beyond paying or seeking help without knowing what hit them. This paper claims that a simple photograph of the ransom note or splash screen, taken with a consumer phone camera, is enough to identify which of 50 known ransomware families is present. The method needs only one clean reference image per family: carefully chosen augmentations simulate the visual mess of a real screen photo, and Monte-Carlo dropout provides an uncertainty score that flags unrelated images and never-seen families for special handling instead of misclassifying them. In the authors' experiments the best model, DenseNet-201 pretrained on ImageNet, reaches 93.6% accuracy on a 500-photo test set, and the lightweight custom network reaches 71.6% while still separating known from unknown inputs. The appeal is a post-infection classification aid for lay users that can learn a new family from a single image.

What carries the argument

The argument rides on two mechanisms. First, a one-shot augmentation loop: each training iteration randomly composes ten transformations (rotation in [-90°, 90°], contrast up to 2x, brightness up to 3x, elliptical occlusion up to a quarter of the image, Gaussian/motion/defocus blur, Gaussian noise, hue/saturation shifts, and perspective warp up to 50%) applied to the single reference image, so the network learns screen-capture-like variation without ever seeing a real photo. Second, Bayesian approximation through dropout: dropout is applied before every weight layer of the custom lightweight network, and at inference the predictive mean and variance are estimated from N stochastic forward passes; the variance is the uncertainty signal. With fixed dropout rate 0.05 this signal cleanly separates positive test screenshots (mean uncertainty 0.015) from negative unrelated images (0.330), enabling the proposed 0.12 rejection threshold. Deep networks achieve higher accuracy but cannot easily carry dropout after every layer, which is why the paper pairs a light uncertainty network with optionally a deep classifier.

What would settle it

Retrain the full pipeline with augmentation parameters, network choice, and the uncertainty threshold selected only on a held-out validation set disjoint from the 500 test photos, then evaluate on the same 500 photos; if accuracy or known/unknown separation drops materially below the reported figures, the reported performance is partly an artifact of test-time tuning. An even more direct check is to have independent users capture photos of the same 50 splash screens on a wider range of monitors and phones and see whether the 93.6% accuracy and the 0.12 threshold transfer.

Watch

Extended reading notes

Core claim

The authors set out to show that ransomware family classification does not require a large corpus of labelled screenshots or any monitoring of network or system behaviour. With one original splash-screen image per family, they train classifiers by applying ten random augmentations—rotation, contrast, brightness, random occlusion (for glare), Gaussian, motion and defocus blur, noise, colour perturbation, and perspective warp—to simulate the conditions of a casual photograph of a screen. Their central experimental result is that this augmentation protocol takes accuracy from 25.2% with no augmentation to 93.6% with a DenseNet-201 network, with high F1 and AUC across the 50 classes. They also report that keeping dropout active at inference and averaging stochastic forward passes produces uncertainty values roughly an order of magnitude larger for unrelated images (mean 0.330) than for in-distribution ransomware screenshots (mean 0.015), so a threshold of 0.12 can divert unknown inputs for special handling. The paper's own stated conclusion is that post-infection, photo-based ransomware classification for lay users is feasible.

Load-bearing premise

The central assumption is that the reported 93.6% accuracy was not inflated by tuning on the test photos: the augmentation hyperparameters were set by grid searches excluded from the paper, the custom architecture by preliminary architecture searches, and the 0.12 uncertainty threshold chosen from test uncertainty values, with no separate validation set described.

Editorial extensions

If this is right

  • A lay user can photograph a locked or ransomed screen and receive a probable family name, which can route them to specific removal or recovery guidance.
  • Adding a newly emerged ransomware family reduces to supplying one clean reference image and fine-tuning, because each class is learned from a single image under augmentation.
  • The system can be designed to refuse inputs it does not recognise—unrelated photos or unseen variants—using the uncertainty score, rather than forcing a confident wrong label.
  • Because the method operates after infection and uses only the displayed image, it complements network- and system-level ransomware detectors aimed at security teams.
  • A two-stage deployment is suggested by the authors: the lightweight network's uncertainty gates whether an input is known, and a heavier network such as DenseNet-201 then performs the high-accuracy classification.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • We infer the same one-shot augmentation recipe could apply to other screen-content identification tasks with one reference image per class—such as distinguishing phishing pages, software versions, or login screens—since it models the physics of photographing a display rather than ransomware-specific features.
  • A natural stress test, beyond this paper's setup, is a broader capture study with more monitors, phones, and lighting conditions; the current test set comes from six monitors and two phones, so how far the 93.6% figure generalises is an open question.
  • We infer that the 0.12 uncertainty threshold is likely dataset-dependent; a deployable service would need to calibrate it on a held-out validation set or update it online, since it was chosen from test uncertainty values.
  • The method only classifies once the ransom screen is visible, so integrating it with an automated screenshot API could turn it into a proactive triage tool; the paper itself stops at a user-captured photo.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes a ransomware-classification pipeline for lay users: given a single clean training image of a ransomware splash screen or ransom note per variant, data augmentation is used to simulate casual phone-camera captures, and a deep network is trained to classify the variant from a new photo. The authors additionally use Monte-Carlo dropout (fixed, concrete, and variational) to obtain model uncertainty and claim that this uncertainty separates in-distribution positive test images from a negative set of unrelated/non-ransomware images. The dataset consists of 50 variants with one (or occasionally more) training images each, 500 positive test photos captured with two phones from six monitors, and 50 negative images. The paper reports accuracy up to 93.6% (DenseNet-201 with full augmentation) and mean uncertainty an order of magnitude higher on the negative set than on the positive set for the custom lightweight network.

Significance. The application is timely and the one-shot-learning-by-augmentation idea is a practical contribution: it avoids collecting a large corpus of real screen captures and fits the low-data regime of ransomware splash screens. A clear strength is the explicit construction and planned release of a dataset with one-shot training, a 500-image positive test set, and a purposefully challenging negative set that includes images visually similar to splash screens. The ablation studies in Tables III and IV are thorough and show that augmentation is essential. The comparison of three dropout-based Bayesian approximation methods is also a useful empirical data point. However, the headline 93.6% accuracy and the uncertainty-separation claim rest on an evaluation protocol that does not demonstrate independence of model selection from the test set; if that issue is fixed, the contribution would be solid and reproducible, and the released code/dataset would be a valuable asset to the community.

major comments (3)
  1. [Sections III-B, III-C, IV-A, IV-C] This is the load-bearing issue for the central claim.
  2. [Section III-A and Table V] The claim that uncertainty can identify 'previously-unseen ransomware variants' is not supported by the evaluation data. Section III-A describes the negative test set as containing 'unrelated and/or non-ransomware images', and Table V reports uncertainty on that set; there is no indication that the negative set contains any ransomware variants that were not in the training set. The conclusion repeats the claim about 'new previously-unseen ransomware variants', but no experiment directly tests rejection of held-out ransomware variants. Either the negative set should be augmented with unseen-variant images, or the claim should be weakened to rejection of unrelated/non-ransomware images.
  3. [Sections IV-A, IV-C, and V] The two components of the claimed system are evaluated on different models, and the end-to-end pipeline is not measured. The 93.6% accuracy is reported for DenseNet-201 at 256×256 resolution (Table I) without the dropout layers used for uncertainty, while the uncertainty experiments use the custom 128×128 network (Table V), whose own positive-test accuracy is 0.708 for fixed dropout. The two-stage solution described in Section V is only a proposal. The abstract's wording that the system 'ensures' special cases are handled may overstate what is demonstrated; the paper should explicitly state that classification accuracy and uncertainty rejection are evaluated separately and that the combined system has not been tested.
minor comments (5)
  1. [Title and Abstract] The title is given as 'A Kings Ransom for Encryption' but should be 'A King's Ransom for Encryption'; also the abstract's phrase 'easy-to-use post-infection ransomware classification for the lay user has not been attempted before' is too strong, as the related-work section itself discusses recent ransomware classification efforts.
  2. [Section III-A] The sentence 'In the following, we will outline the details of the our dataset, data augmentation techniques and the different networks used' contains a typo ('the our dataset'), and the paragraph describing the training set does not specify the exact number of images per class for the classes with multiple splash screens; providing a table of the 50 variants with their image counts would improve reproducibility.
  3. [Section III-C] The claim that 'no normalization is performed in the network' is interesting but not justified; the paper should state whether this refers to batch normalization, input normalization, or both, and discuss the effect on training stability.
  4. [Section IV-B and Table IV] The notation P/R/B/C/N/O/M/CP/D/G in Table IV is explained in the caption, but the order of letters does not match the order in the caption listing ('C: Contrast; R: Rotation; B: Brightness; P: Perspective; M: Motion blur; D: Defocus blur; G: Gaussian blur; N: Noise; O: Occlusion; CP: Colour Perturbation'); reordering or a more explicit legend would avoid confusion.
  5. [Section IV-C] The text around Figure 6 says 'As seen in Figure 6, our experiments point to the same conclusions' but the figure is a pair of plots without error bars or statistical tests; reporting the standard deviation of uncertainty across the 50 negative and 500 positive images (as partially done in Table V) would make the 'order of magnitude' claim more precise.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity; the classification and uncertainty claims are empirical and do not reduce to their inputs, though the post-hoc uncertainty threshold and excluded grid-searches are evaluation-transparency concerns.

full rationale

The paper's central claims are empirical rather than derivational: a classifier trained on one clean image per variant with augmentation is evaluated on a separately captured 500-image positive test set, and uncertainty is evaluated on a 50-image negative set. No equation in Sections III or IV defines an output in terms of the quantity it is supposed to predict; accuracy, F1, and AUC are measured on held-out captures, not computed from the augmentation parameters. The 93.6% figure is a test-set measurement for a specific architecture (DenseNet-201), not a quantity obtained by substituting fitted constants into a formula. The excluded grid-searches for augmentation hyperparameters and the preliminary architecture searches are a validation-protocol risk: if the test set influenced those searches, the reported numbers are optimistic. However, the paper does not state that the test set was used for those searches, so claiming circularity would require speculation. Similarly, the 0.12 uncertainty threshold in Section IV-C is chosen after inspecting test uncertainty values, which is a mild form of post-hoc fitting, but the paper's main uncertainty claim is the order-of-magnitude difference in mean uncertainties (0.015 vs 0.330, Table V), which does not depend on that threshold. The self-citations ([30], [32], [35]) are related-work references to depth estimation and graph representation and carry no load-bearing argument. Overall, no prediction is equivalent by construction to an input, so there is no significant circularity; the minor post-hoc threshold choice and undisclosed tuning searches justify only a score of 1.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central claims rest on several unverified assumptions about the test distribution and the validity of MC-dropout uncertainty, plus four free parameters that were tuned without a reported validation split. These parameters are the augmentation ranges, the fixed dropout rate, the custom architecture, and the rejection threshold; the last is selected from the test data post hoc.

free parameters (4)
  • Augmentation hyperparameters = not reported
    Ranges for rotation, contrast, brightness, occlusion, blur, noise, and perspective are set by exhaustive grid search excluded from the paper (Section III-B).
  • Fixed dropout rate = 0.05
    Chosen by intensive grid search for all six dropout layers (Section III-D).
  • Custom architecture design = 6 conv layers, 4096-d feature vector
    Selected via preliminary architecture searches excluded for brevity (Section III-C).
  • Uncertainty rejection threshold = 0.12
    Chosen post hoc from positive and negative test uncertainty values (Section IV-C).
assumptions (5)
  • domain assumption MC dropout with a fixed rate provides a useful estimate of predictive uncertainty for out-of-distribution detection.
    Employed in Sections II-C and IV-C; the paper relies on this to reject negative images, but does not measure rejection accuracy with a proper metric.
  • domain assumption The negative test set of 50 images is representative of the out-of-distribution inputs the system will meet, including unseen ransomware variants.
    Section III-A; the negative set contains only author-chosen images from the same screens, not actual unseen ransomware variants.
  • domain assumption The 500 positive test photos, taken from 6 screens with 2 phones, represent the lay-user capture distribution.
    Section III-A; assumes this narrow capture setup generalizes to all consumer cameras and screens.
  • domain assumption Data augmentation can simulate the photographic capture process well enough that a model trained on one clean image per class transfers to real photos.
    Core premise of the one-shot approach, validated only on the authors' own test set (Section IV-B).
  • standard math Dropout as Bayesian approximation (Gal and Ghahramani) is a valid interpretation of MC dropout uncertainty.
    Section II-C and Eq. 2; the paper treats this as an established result.

how reviews work

0 comments
Cite this review

Pith. "Pith review of A Kings Ransom for Encryption: Ransomware Classification using Augmented One-Shot Learning and Bayesian Approximation." pith.science (2026). https://pith.science/paper/N7FHFSEX

@misc{pith2026190806750,
  author       = {Pith},
  title        = {Pith review of: A Kings Ransom for Encryption: Ransomware Classification using Augmented One-Shot Learning and Bayesian Approximation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/N7FHFSEX}},
  note         = {Machine review of arXiv:1908.06750}
}
read the original abstract

Newly emerging variants of ransomware pose an ever-growing threat to computer systems governing every aspect of modern life through the handling and analysis of big data. While various recent security-based approaches have focused on detecting and classifying ransomware at the network or system level, easy-to-use post-infection ransomware classification for the lay user has not been attempted before. In this paper, we investigate the possibility of classifying the ransomware a system is infected with simply based on a screenshot of the splash screen or the ransom note captured using a consumer camera commonly found in any modern mobile device. To train and evaluate our system, we create a sample dataset of the splash screens of 50 well-known ransomware variants. In our dataset, only a single training image is available per ransomware. Instead of creating a large training dataset of ransomware screenshots, we simulate screenshot capture conditions via carefully designed data augmentation techniques, enabling simple and efficient one-shot learning. Moreover, using model uncertainty obtained via Bayesian approximation, we ensure special input cases such as unrelated non-ransomware images and previously-unseen ransomware variants are correctly identified for special handling and not mis-classified. Extensive experimental evaluation demonstrates the efficacy of our work, with accuracy levels of up to 93.6% for ransomware classification.

Figures

Figures reproduced from arXiv: 1908.06750 by the authors.

Figure 1
Figure 1. Examples from our dataset: training images (ran [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 3
Figure 3. The custom architecture used in our experiments. [PITH_FULL_IMAGE:figures/full_fig_p002_3.png] view at source ↗
Figure 4
Figure 4. Confusion matrices for the better performing models (DenseNet-201 [9], DenseNet-161 [9], ShuffleNet-V2 [11], [PITH_FULL_IMAGE:figures/full_fig_p003_4.png] view at source ↗
Figures from the paper (3 more)
Figure 5
Figure 5. Figure 5: Test accuracy of our custom network with fixed dropout [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 6
Figure 6. Figure 6: Comparing the uncertainty values as our custom network is trained with fixed dropout [16] (FDO), concrete dropout [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]
Figure 7
Figure 7. Figure 7: Examples demonstrating the effectiveness of model uncertainty, using positive test data (screenshots of images from [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

51 extracted references · 45 canonical work pages

  1. [1]

    Classification of ransomware families with machine learning based on N-gram of opcodes,

    H. Zhang, X. Xiao, F. Mercaldo, S. Ni, F. Martinelli, and A. K. Sangaiah, “Classification of ransomware families with machine learning based on N-gram of opcodes,” Future Generation Computer Systems, vol. 90, pp. 211–221, 2019

    work page 2019

  2. [2]

    Ransomware, threat and detection techniques: A review,

    S. Kok, A. Abdullah, N. Jhanjhi, and M. Supramaniam, “Ransomware, threat and detection techniques: A review,” Int. J. Computer Science and Network Security, vol. 19, no. 2, p. 136, 2019

    work page 2019

  3. [3]

    Ransomware threat success factors, taxonomy, and countermeasures: A survey and research directions,

    B. A. S. Al-rimy, M. A. Maarof, and S. Z. M. Shaid, “Ransomware threat success factors, taxonomy, and countermeasures: A survey and research directions,” Computers & Security, vol. 74, pp. 144–166, 2018

    work page 2018

  4. [4]

    Evaluating shallow and deep networks for ransomware detection and classification,

    R. Vinayakumar, K. P. Soman, K. K. S. Velan, and S. Ganorkar, “Evaluating shallow and deep networks for ransomware detection and classification,” in Int. Conf. Advances in Computing, Communications and Informatics, 2017, pp. 259–265

    work page 2017

  5. [5]

    Extinguishing ransomware - A hybrid approach to Android ransomware detection,

    A. Ferrante, M. Malek, F. Martinelli, F. Mercaldo, and J. Milosevic, “Extinguishing ransomware - A hybrid approach to Android ransomware detection,” inInt. Symp. Foundations and Practice of Security. Springer, 2017, pp. 242–258

    work page 2017

  6. [6]

    Very deep convolutional networks for large-scale image recognition,

    K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition,” arXiv preprint arXiv:1409.1556 , 2014

    arXiv 2014

  7. [7]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in IEEE Conf. Computer Vision and Pattern Recognition , 2016, pp. 770–778

    work page 2016

  8. [8]

    SqueezeNet: AlexNet-level accuracy with 50x fewer parameters and 0.5 MB model size,

    F. Iandola, S. Han, M. Moskewicz, K. Ashraf, W. Dally, and K. Keutzer, “SqueezeNet: AlexNet-level accuracy with 50x fewer parameters and 0.5 MB model size,” arXiv preprint arXiv:1602.07360 , 2016

    arXiv 2016

Show all 51 references
  1. [9]

    Densely connected convolutional networks,

    G. Huang, Z. Liu, L. Van Der Maaten, and K. Q. Weinberger, “Densely connected convolutional networks,” in IEEE Conf. Computer Vision and Pattern Recognition, 2017, pp. 4700–4708

    2017

  2. [10]

    Rethinking the Inception architecture for computer vision,

    C. Szegedy, V . Vanhoucke, S. Ioffe, J. Shlens, and Z. Wojna, “Rethinking the Inception architecture for computer vision,” in IEEE Conf. Computer Vision and Pattern Recognition , 2016, pp. 2818–2826

    2016

  3. [11]

    ShuffleNet v2: Practical guidelines for efficient CNN architecture design,

    N. Ma, X. Zhang, H.-T. Zheng, and J. Sun, “ShuffleNet v2: Practical guidelines for efficient CNN architecture design,” in Euro. Conf. Com- puter Vision, 2018, pp. 116–131

    2018

  4. [12]

    MobileNetv2: Inverted residuals and linear bottlenecks,

    M. Sandler, A. Howard, M. Zhu, A. Zhmoginov, and L.-C. Chen, “MobileNetv2: Inverted residuals and linear bottlenecks,” in IEEE Conf. Computer Vision and Pattern Recognition , 2018, pp. 4510–4520

    2018

  5. [13]

    Aggregated residual transformations for deep neural networks,

    S. Xie, R. Girshick, P. Doll ´ar, Z. Tu, and K. He, “Aggregated residual transformations for deep neural networks,” in IEEE Conf. Computer Vision and Pattern Recognition , 2017, pp. 1492–1500

    2017

  6. [14]

    How to make a neural network say dont know,

    B. Karmakar and N. R. Pal, “How to make a neural network say dont know,” Information Sciences, vol. 430-431, pp. 444–466, 2018

    2018

  7. [15]

    Adversarial examples in the physical world,

    A. Kurakin, I. Goodfellow, and S. Bengio, “Adversarial examples in the physical world,” in Int. Conf. Learning Representations, 2017, pp. 1–11

    2017

  8. [16]

    Dropout as a Bayesian approximation: Representing model uncertainty in deep learning,

    Y . Gal and Z. Ghahramani, “Dropout as a Bayesian approximation: Representing model uncertainty in deep learning,” in Int. Conf. Machine Learning, 2016, pp. 1050–1059

    2016

  9. [17]

    Concrete dropout,

    Y . Gal, J. Hron, and A. Kendall, “Concrete dropout,” in Advances in Neural Information Processing Systems , 2017, pp. 3581–3590

    2017

  10. [18]

    Variational dropout and the local reparameterization trick,

    D. P. Kingma, T. Salimans, and M. Welling, “Variational dropout and the local reparameterization trick,” in Advances in Neural Information Processing Systems, 2015, pp. 2575–2583

    2015

  11. [19]

    Variational Gaussian dropout is not Bayesian,

    J. Hron, A. Matthews, and Z. Ghahramani, “Variational Gaussian dropout is not Bayesian,” arXiv preprint arXiv:1711.02989 , 2017

    2017 arXiv

  12. [20]

    Variational Bayesian dropout: Pitfalls and fixes,

    ——, “Variational Bayesian dropout: Pitfalls and fixes,” arXiv preprint arXiv:1807.01969, 2018

    2018 arXiv

  13. [21]

    Botminer: Clustering analysis of network traffic for protocol and structure independent Botnet detection,

    G. Gu, R. Perdisci, J. Zhang, and W. Lee, “Botminer: Clustering analysis of network traffic for protocol and structure independent Botnet detection,” USENIX Security Symposium , 2008

    2008

  14. [22]

    Software-defined networking-based ransomware detection using HTTP traffic characteris- tics,

    K. Cabaj, M. Gregorczyk, and W. Mazurczyk, “Software-defined networking-based ransomware detection using HTTP traffic characteris- tics,” Computers & Electrical Engineering , vol. 66, pp. 353–368, 2018

    2018

  15. [23]

    Scalable, behavior-based malware clustering,

    U. Bayer, P. M. Comparetti, C. Hlauschek, C. Kruegel, and E. Kirda, “Scalable, behavior-based malware clustering,” in Network and Dis- tributed System Security Symposium , vol. 9, 2009, pp. 8–11

    2009

  16. [24]

    JACKSTRAWS: Picking command and control connections from Bot traffic,

    G. Jacob, R. Hund, C. Kruegel, and T. Holz, “JACKSTRAWS: Picking command and control connections from Bot traffic,” in USENIX Security Symposium, 2011

    2011

  17. [25]

    Heldroid: Fast and efficient linguistic-based ransomware detection,

    N. Andronio, “Heldroid: Fast and efficient linguistic-based ransomware detection,” Ph.D. dissertation, 2015

    2015

  18. [26]

    Cutting the gordian knot: A look under the hood of ransomware attacks,

    A. Kharraz, W. Robertson, D. Balzarotti, L. Bilge, and E. Kirda, “Cutting the gordian knot: A look under the hood of ransomware attacks,” in Int. Conf. Detection of Intrusions and Malware, and Vulnerability Assessment. Springer, 2015, pp. 3–24

    2015

  19. [27]

    Cryptolock (and drop it): Stopping ransomware attacks on user data,

    N. Scaife, H. Carter, P. Traynor, and K. R. Butler, “Cryptolock (and drop it): Stopping ransomware attacks on user data,” in Int. Conf. Distributed Computing Systems. IEEE, 2016, pp. 303–312

    2016

  20. [28]

    Au- tomated dynamic analysis of ransomware: Benefits, limitations and use for detection,

    D. Sgandurra, L. Mu ˜noz-Gonz´alez, R. Mohsen, and E. C. Lupu, “Au- tomated dynamic analysis of ransomware: Benefits, limitations and use for detection,” arXiv preprint arXiv:1609.03020 , 2016

    2016 arXiv

  21. [29]

    Evaluating shallow and deep networks for ransomware detection and classification,

    R. Vinayakumar, K. Soman, K. S. Velan, and S. Ganorkar, “Evaluating shallow and deep networks for ransomware detection and classification,” in Int. Conf. Advances in Computing, Communications and Informatics . IEEE, 2017, pp. 259–265

    2017

  22. [30]

    Real-time monocular depth estimation using synthetic data with domain adaptation via image style transfer,

    A. Atapour-Abarghouei and T. P. Breckon, “Real-time monocular depth estimation using synthetic data with domain adaptation via image style transfer,” inIEEE Conf. Computer Vision and Pattern Recognition, 2018, pp. 2800–2810

    2018

  23. [31]

    Faster R-CNN: Towards real- time object detection with region proposal networks,

    S. Ren, K. He, R. Girshick, and J. Sun, “Faster R-CNN: Towards real- time object detection with region proposal networks,” in Advances in Neural Information Processing Systems , 2015, pp. 91–99

    2015

  24. [32]

    Veritatem Dies Aperit - temporally consistent depth prediction enabled by a multi-task geometric and semantic scene understanding approach,

    A. Atapour-Abarghouei and T. P. Breckon, “Veritatem Dies Aperit - temporally consistent depth prediction enabled by a multi-task geometric and semantic scene understanding approach,” in IEEE Conf. Computer Vision and Pattern Recognition , 2019, pp. 3373–3384

    2019

  25. [33]

    Distributed representations of words and phrases and their composi- tionality,

    T. Mikolov, I. Sutskever, K. Chen, G. S. Corrado, and J. Dean, “Distributed representations of words and phrases and their composi- tionality,” in Advances in Neural Information Processing Systems , 2013, pp. 3111–3119

    2013

  26. [34]

    node2vec: Scalable feature learning for networks,

    A. Grover and J. Leskovec, “node2vec: Scalable feature learning for networks,” in Int. Conf. Knowledge Discovery and Data Mining. ACM, 2016, pp. 855–864

    2016

  27. [35]

    Temporal graph offset reconstruction: Towards tempo- rally robust graph representation learning,

    S. Bonner, J. Brennan, I. Kureshi, G. Theodoropoulos, A. S. McGough, and B. Obara, “Temporal graph offset reconstruction: Towards tempo- rally robust graph representation learning,” in IEEE Int. Conf. Big Data , 2018, pp. 3737–3746

    2018

  28. [36]

    One-shot learning of object categories,

    L. Fei-Fei, R. Fergus, and P. Perona, “One-shot learning of object categories,” IEEE Trans. Pattern Analysis and Machine Intelligence , vol. 28, no. 4, pp. 594–611, 2006

    2006

  29. [37]

    One-shot learning of generative speech concepts,

    B. Lake, C.-y. Lee, J. Glass, and J. Tenenbaum, “One-shot learning of generative speech concepts,” in Cognitive Science Society , vol. 36, no. 36, 2014

    2014

  30. [38]

    Siamese neural networks for one-shot image recognition,

    G. Koch, R. Zemel, and R. Salakhutdinov, “Siamese neural networks for one-shot image recognition,” in Int. Conf. Machine Learning Workshop, vol. 2, 2015

    2015

  31. [39]

    One-shot learning with memory-augmented neural networks,

    A. Santoro, S. Bartunov, M. Botvinick, D. Wierstra, and T. Lillicrap, “One-shot learning with memory-augmented neural networks,” arXiv preprint arXiv:1605.06065, 2016

    2016 arXiv

  32. [40]

    Matching networks for one shot learning,

    O. Vinyals, C. Blundell, T. Lillicrap, D. Wierstra et al. , “Matching networks for one shot learning,” in Advances in Neural Information Processing Systems, 2016, pp. 3630–3638

    2016

  33. [41]

    Multi- level semantic feature augmentation for one-shot learning,

    Z. Cheny, Y . Fuy, Y . Zhang, Y .-G. Jiang, X. Xue, and L. Sigal, “Multi- level semantic feature augmentation for one-shot learning,” IEEE Trans. Image Processing, 2019

    2019

  34. [42]

    Data augmentation using learned transformations for one-shot medical image segmentation,

    A. Zhao, G. Balakrishnan, F. Durand, J. V . Guttag, and A. V . Dalca, “Data augmentation using learned transformations for one-shot medical image segmentation,” in IEEE Conf. Computer Vision and Pattern Recognition, 2019, pp. 8543–8553

    2019

  35. [43]

    Dropout inference in Bayesian networks with alpha- divergences,

    Y . Li and Y . Gal, “Dropout inference in Bayesian networks with alpha- divergences,” in Int. Conf. Machine Learning , 2017, pp. 2052–2061

    2017

  36. [44]

    Neural network based intrusion detection system for critical infrastructures,

    O. Linda, T. V ollmer, and M. Manic, “Neural network based intrusion detection system for critical infrastructures,” in Int. Joint Conf. Neural Networks, 2009, pp. 1827–1834

    2009

  37. [45]

    What uncertainties do we need in Bayesian deep learning for computer vision?

    A. Kendall and Y . Gal, “What uncertainties do we need in Bayesian deep learning for computer vision?” in Advances in Neural Information Processing Systems, 2017, pp. 5574–5584

    2017

  38. [46]

    Dropout: A simple way to prevent neural networks from overfitting,

    N. Srivastava, G. Hinton, A. Krizhevsky, and R. Salakhutdinov, “Dropout: A simple way to prevent neural networks from overfitting,” J. Machine Learning Research , vol. 15, no. 1, pp. 1929–1958, 2014

    1929

  39. [47]

    Deep Gaussian processes,

    A. Damianou and N. Lawrence, “Deep Gaussian processes,” in Artificial Intelligence and Statistics , 2013, pp. 207–215

    2013

  40. [48]

    Automatic differentiation in PyTorch,

    A. Paszke, S. Gross, S. Chintala, G. Chanan, E. Yang, Z. Lin, A. Des- maison, L. Antiga, and A. Lerer, “Automatic differentiation in PyTorch,” in Advances in Neural Information Processing Systems , 2017, pp. 1–4

    2017

  41. [49]

    Adam: A method for stochastic optimization,

    D. Kingma and J. Ba, “Adam: A method for stochastic optimization,” in Proc. Int. Conf. Learning Representations , 2014, pp. 1–15

    2014

  42. [50]

    Bayesian layers: A module for neural network uncertainty,

    D. Tran, D. Mike, M. van der Wilk, and D. Hafner, “Bayesian layers: A module for neural network uncertainty,” arXiv preprint arXiv:1812.03973, 2018

    2018 arXiv

  43. [51]

    Optimizing over a Bayesian last layer,

    N. Weber, J. Starc, A. Mittal, and L. Marquez, “Optimizing over a Bayesian last layer,” in Advances in Neural Information Processing Systems Workshops, 2018, pp. 31–12

    2018

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.