Pith. sign in

REVIEW 6 major objections 5 minor 71 references

Data Encryption Battlefield: A Deep Dive into the Dynamic Confrontations in Ransomware Attacks

T0 review · 6 major / 5 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper argues that online incremental classifiers, especially the Hoeffding Tree, can tell ransomware-encrypted files from normal files in real time, and that a warm-started Random Forest is the better tool for intermittent encryption.

desk verdict The paper's headline result—Hoeffding Tree for full/Base64, Random Forest for intermittent—is a useful empirical rule, but the underspecified train/test split makes the accuracy numbers impossible to trust as reported. read the letter →

arxiv 2504.20681 v1 pith:J52A6ZBK submitted 2025-04-29 cs.CR

Arash Mahboubi , Hamed Aboutorab , Seyit Camtepe , Hang Thanh Bui , Khanh Luong , Keyvan Ansari , Shenlu Wang , Bazara Barry This is my paper · ORCID
classification cs.CR
keywords ransomwaredetectionintermittentencryptionpartialonlineincrementallearningHoeffdingTreeRandomForestBase64encodingfileentropy
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that the encryption status of a file can be predicted in real time from statistical features of its content, without waiting for a ransomware binary to be identified. It argues that online incremental learners, above all the Hoeffding Tree, are the right tool for the job: on files encrypted by 75 real ransomware families, the Hoeffding Tree classifies strong, partial, and AES-Base64 encryption with average accuracy above 90%, while a warm-started Random Forest is the strongest option for intermittent encryption, staying at roughly 80% or better. The stakes are practical: a detector that sits in the file-access path could flag encryption as it happens and protect backups or shared storage. The paper also claims that entropy alone is a weak signal, because Base64 encoding and partial or intermittent encryption keep entropy in near-normal ranges, and that a richer feature set restores separability.

What carries the argument

The load-bearing object is a per-file feature vector: byte entropy, byte frequency, byte variance, kurtosis, skewness, average string and word length, entropy variance across 512-byte blocks, percentile utilization of byte values, and, for intermittent encryption, differential entropy. These features are fed to two online-capable learners. The Hoeffding Tree, also called the Very Fast Decision Tree, builds a decision tree incrementally, examining each instance once, which is what lets it track a changing stream. The Random Forest with warm-start keeps previously learned model state and updates as new batches arrive, which helps it handle the irregular byte patterns of intermittent encryption. The argument turns on pairing the right statistic with the right update rule: content-distribution features separate encrypted from plaintext buffers, and the online update rule adapts when the encryption tactic changes.

What would settle it

Take the 11,928-file dataset and split by source-file identity so that no normal file and its encrypted counterpart appear in different splits, or train on one corpus and test on a fresh corpus of the same formats; if accuracy on genuinely unseen files drops toward the entropy-only baseline, the high figures came from file-identity memorization rather than learned encryption statistics.

Watch

Extended reading notes

Core claim

The central claim is that file-level encryption is detectable from content statistics and that the best learner depends on the adversary's encryption mode. On the paper's dataset of 11,928 files (32.6 GB) encrypted by 75 ransomware families, the Hoeffding Tree, a decision tree grown incrementally from a data stream, reaches above 90% accuracy on average against GrandCrab, the lab-developed AES-Base64 pipeline, Paradise's partial encryption, and CryptFile2's RSA-2048 encryption, often hitting perfect accuracy in later batches. Against Black Basta's intermittent encryption, the Hoeffding Tree underperforms, and a Random Forest classifier with warm-start does better, exceeding 80% and reaching about 95% in several batches. The paper further reports that entropy-only classifiers stay near chance on intermittently encrypted files, with the best accuracy at 0.5331 for Decision Trees, while the full feature vector lifts batch Decision Trees to 98.08% accuracy. The online learner also uses far fewer resources than the batch model, about 0.27 seconds of CPU time and 0.016 MB of memory versus 3.76 seconds and 7.47 MB.

Load-bearing premise

The reported accuracy depends on the way data was split for training and testing: if the same original file appears in both its normal and encrypted form on both sides of the split, the model can memorize file identity rather than learn what encryption looks like.

Editorial extensions

If this is right

  • A user-space file-system guard can classify writes in real time, because the online model needs only about 0.27 seconds of CPU time and 0.016 MB of memory per evaluation, making live interception feasible.
  • Deployments should be tactic-aware: the Hoeffding Tree for full, partial, and AES-Base64 encryption, and a warm-started Random Forest when intermittent encryption is suspected.
  • Entropy-only detectors will miss modern ransomware because Base64 encoding and intermittent encryption keep entropy in normal-looking ranges; the richer feature set is the reason the classifiers work.
  • Because online models update without full retraining, they can keep pace with new ransomware families as long as the underlying statistical features remain discriminative.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A step the paper does not take: test how quickly each learner recovers when the encryption tactic switches mid-stream, since real attacks can mix tactics.
  • A natural extension is chunk-level detection, classifying 512-byte blocks rather than whole files so a guard can alert before an entire large file is encrypted.
  • The reported 442-second feature-extraction time for a 3.58 GB Excel file suggests whole-file statistics may be too slow for hot storage, so sampling or streaming moments would decide practical feasibility.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

6 major / 5 minor

Summary. The paper studies file-level detection of ransomware encryption using statistical features and online incremental machine learning. It systematizes adversarial encryption strategies (Base64 entropy reduction, partial/intermittent encryption), introduces a feature set including entropy variance and percentiles, compares batch classifiers and online learners on a dataset of 11,928 files encrypted by 75 ransomware families, and claims that Hoeffding Tree achieves above 90% accuracy for traditional, AES-Base64, and partial encryption while Random Forest with warm-start functionality achieves above 80% accuracy for intermittent encryption. The paper also sketches a FUSE-based 'DeltaFile Guard' integration for real-time prediction of file encryption status.

Significance. If the reported claims were fully supported, the work would provide a large-scale empirical comparison of online learning methods for ransomware encryption detection and a feature set that could be useful for practitioners. The dataset scale (75 families, 11,928 files) and the use of real-world ransomware are strengths, as is the attention to evasion techniques such as intermittent and partial encryption. However, the current manuscript lacks the methodological detail needed to substantiate the headline claims: the train/test split is underspecified, the warm-start Random Forest claim is absent from the experiments, and the online evaluation protocol is not described. The post hoc introduction of differential entropy and the lack of statistical rigor further weaken the empirical basis. The paper does not ship code or data, which limits reproducibility.

major comments (6)
  1. [5.4] The 70/30 train/test split is not described with respect to file identity and ransomware-family overlap. The manuscript does not state whether the normal and encrypted versions of the same source file are prevented from appearing in different partition splits, nor whether files encrypted by the same ransomware family are allowed to straddle the split. Because Section 3.4 shows that intermittent-encryption patterns are family-specific (e.g., Black Basta's 64/128-byte skip), within-family interpolation can produce the high accuracies in Tables 4 and 5 without any generalization to new families. Provide the exact split construction (or release code/data) and, ideally, a held-out-family evaluation to support the 'evolving adversaries' claim in the abstract.
  2. [Abstract, Section 7, Table 5] The abstract and conclusion state that the 'Random Forest classifier with warm-start functionality' excels at intermittent encryption, yet warm-start is neither defined nor used in any experiment in Sections 5.4-5.9. Table 5 Row B describes Random Forests with a differential entropy feature; Row C merely reports a 'Random Forest Score' without mentioning warm-start. Consequently the headline claim about warm-start Random Forest is not supported by the presented evidence. In addition, the Section 7 claim of 'a minimum of 80% accuracy' for intermittent encryption is numerically inconsistent with Table 5 Row B, where Random Forests report 78.32% accuracy; if the claim refers to Row C, that row's protocol must be clearly distinguished. Either add a warm-start Random Forest experiment (with implementation details) or revise the abstract and conclusion.
  3. [5.9] The evaluation protocol for online learning is underspecified. The text says data are read in rounds of 1000 with a 'sliding window mechanism', but it is not stated whether the accuracy in each row of Tables 4 and 5 is computed on the batch the model was just trained on (test-on-train) or on the next, unseen batch. If the former, the reported accuracies do not measure predictive performance in a real-time file-system setting, which is the paper's central claim. Specify the training/testing order within each batch and report evaluation on a properly held-out portion of the stream.
  4. [5.9, Eq. (9), Table 5 Row B] The differential entropy feature was introduced in the manuscript after observing that Hoeffding Tree underperforms on intermittent encryption, and no separate validation procedure is described for this feature or for the subsequent switch to Random Forest. In addition, Eq. (9) defines differential entropy for continuous random variables, whereas the features are derived from discrete byte counts; the application of continuous differential entropy to discrete file data, including the possibility of negative differential entropy values, is not justified. The claim that Random Forest with differential entropy achieves 'superior predictive accuracy' needs a pre-specified or otherwise properly validated feature-selection protocol and a justification for using continuous differential entropy on discrete data.
  5. [Tables 4, 5; Section 7] Tables 4 and 5 report single-run batch accuracies with no error bars, repeated trials, or class-balance information, making it impossible to assess whether the observed differences between classifiers (e.g., Table 5 Row C) are statistically significant. Batch-to-batch fluctuations are large (for example, Table 4 Row D Hoeffding Tree ranges from 0.85 to 1.00), so without repeated trials or confidence intervals the relative superiority claims are not established. Report mean and standard deviation over multiple runs, state class proportions, and reconcile the claimed 'minimum of 80% accuracy' with the reported 0.7832 figure in Table 5 Row B.
  6. [5.1, 5.4, 5.6.1] The dataset scale is stated inconsistently: Sections 5.1 and 5.6.1 describe a 32.6 GB dataset with 11,928 files, while Section 5.4 refers to a '65.1 GB (70,008,138,878 bytes)' dataset, and Section 3.6.1 additionally describes a separate 3,200-file (8.13 GB) subset. These numbers need to be reconciled, as the inconsistency affects the claimed scale of the empirical evaluation and the interpretation of the feature-extraction resource table.
minor comments (5)
  1. [Tables 4, 5] The column headers in Tables 4 and 5 are garbled (for example, 'Batch SGD Perceptron Passive Aggressive Hoeffding Tree' appears as a single row in parts A-D, and batch numbering starts at 0 or 1 inconsistently across rows). Reformat the tables for readability.
  2. [Throughout] The name 'Hoeffding Tree' appears as 'Hoeffding', 'Hoe ffding', and 'Hoeffding' in different places (e.g., Section 5.8 vs. Table 4 headings). Standardize the spelling.
  3. [5.3, feature 10] The 'percentiles utilization' feature is described verbally, but no formula or algorithmic specification is provided; state exactly how the percentiles are computed (e.g., across byte values of the whole file or per fixed-size block).
  4. [3.4] The 'SmartPattern [N,P]' notation for BlackCat intermittent encryption is not defined precisely; explain how N and P determine the byte-skipping pattern.
  5. [3., Figure 3, 5.] The 'DeltaFile Guard' component is introduced as a named system with a conceptual diagram, but no implementation details, pseudo-code, or evaluation of the FUSE integration are provided; clarify what was actually implemented versus envisioned.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper's central claims are empirical measurements, not quantities derived from their own inputs.

full rationale

The paper's main claims—Hoeffding Tree achieving high accuracy on GrandCrab, AES-Base64, Paradise, and CryptFile2 data, and Random Forest outperforming on Black Basta intermittent encryption—are reported experimental measurements on a constructed dataset (Tables 4 and 5), not derivations from a model whose parameters were fit to the same outputs. The features (byte entropy, variance, kurtosis, skewness, entropy variance, percentiles, differential entropy) are defined independently of the labels and of the reported accuracy numbers; no equation in the paper reduces a predicted quantity to the training target by construction. The cited support for Hoeffding Tree's convergence is the external Domingos–Hulten result, and the self-citations (e.g., [12], [35], [70]) are background references, not load-bearing premises, uniqueness theorems, or ansatz-smuggling citations. Although Section 5.9 describes adding differential entropy after observing Hoeffding Tree's weaker intermittent-encryption performance, this is post-hoc feature/model selection rather than circularity: the resulting accuracy values are still measured, not algebraically implied by the feature definitions. There is thus no fitted parameter renamed as a prediction and no self-citation chain forcing the central conclusion.

Assumptions & free parameters 3 free parameters · 3 assumptions · 1 invented entities

The central empirical claims rest on hand-picked feature parameters (block size, batch size, split ratio) and on the assumption that byte statistics distinguish encryption across file types. No new physical or mathematical entities are introduced beyond the conceptual DeltaFile Guard component.

free parameters (3)
  • Entropy variance block size = 512 bytes
    Defined in Section 5.3 for computing entropy variance across 512-byte blocks; the window size is chosen by hand and affects the feature values.
  • Online learning batch size = 1000 instances per batch
    Table 4 and Section 5.9 state data is fed in rounds of 1000; this batch granularity is arbitrary and may influence online learning behavior.
  • Train/test split ratio = 70/30
    Section 5.4 sets a 70/30 split; no stratification or leakage-aware methodology is described, making the split a hand-chosen parameter that affects all reported accuracies.
assumptions (3)
  • domain assumption Byte-level statistical features (entropy, variance, kurtosis, skewness, percentiles) are sufficient to distinguish encrypted from normal files across all tested file formats
    Section 5.3 builds the entire feature set on byte statistics; the paper assumes these statistics generalize across doc, ppt, xlsx, jpg, png, tif, gif, pdf, mp3, and mp4 files without per-format calibration.
  • standard math The Hoeffding bound guarantees that Hoeffding Trees approximate batch decision trees on this data stream
    Section 5.8 invokes Domingos and Hulten's proof, but the paper does not verify that the data stream satisfies the stationarity or independence conditions required for the bound to apply.
  • domain assumption The executed ransomware samples behave representatively in the controlled Windows environment
    Section 5.2 states samples were tested for execution, but no evidence shows that the resulting encryption patterns match real-world victim deployments, which affects generalization claims.
invented entities (1)
  • DeltaFile Guard
    purpose: Proposed middleware component that intercepts FUSE file operations to apply online incremental learning for encryption-status prediction
    Described in Section 4 as a conceptual architecture; no implementation, prototype, or external validation is provided, and the experiments do not use it.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Data Encryption Battlefield: A Deep Dive into the Dynamic Confrontations in Ransomware Attacks." pith.science (2026). https://pith.science/paper/J52A6ZBK

@misc{pith2026250420681,
  author       = {Pith},
  title        = {Pith review of: Data Encryption Battlefield: A Deep Dive into the Dynamic Confrontations in Ransomware Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/J52A6ZBK}},
  note         = {Machine review of arXiv:2504.20681}
}
read the original abstract

In the rapidly evolving landscape of cybersecurity threats, ransomware represents a significant challenge. Attackers increasingly employ sophisticated encryption methods, such as entropy reduction through Base64 encoding, and partial or intermittent encryption to evade traditional detection methods. This study explores the dynamic battle between adversaries who continuously refine encryption strategies and defenders developing advanced countermeasures to protect vulnerable data. We investigate the application of online incremental machine learning algorithms designed to predict file encryption activities despite adversaries evolving obfuscation techniques. Our analysis utilizes an extensive dataset of 32.6 GB, comprising 11,928 files across multiple formats, including Microsoft Word documents (doc), PowerPoint presentations (ppt), Excel spreadsheets (xlsx), image formats (jpg, jpeg, png, tif, gif), PDFs (pdf), audio (mp3), and video (mp4) files. These files were encrypted by 75 distinct ransomware families, facilitating a robust empirical evaluation of machine learning classifiers effectiveness against diverse encryption tactics. Results highlight the Hoeffding Tree algorithms superior incremental learning capability, particularly effective in detecting traditional and AES-Base64 encryption methods employed to lower entropy. Conversely, the Random Forest classifier with warm-start functionality excels at identifying intermittent encryption methods, demonstrating the necessity of tailored machine learning solutions to counter sophisticated ransomware strategies.

Figures

Figures reproduced from arXiv: 2504.20681 by the authors.

Figure 2
Figure 2. Base64 encoding reduces the entropy from 7.99 to 5.99. However, [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 1
Figure 1. Base64 encoding reduces the entropy from 7.99 to 5.99. Adversary [PITH_FULL_IMAGE:figures/full_fig_p006_1.png] view at source ↗
Figure 3
Figure 3. Conceptualize diagram: DeltaFile Guard represents the utilization of [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Black Basta encrypts CSV files larger than 4 KB. The ransomware [PITH_FULL_IMAGE:figures/full_fig_p014_4.png]
Figure 5
Figure 5. Figure 5: The results of the Hoeffding Tree’s performance on a dataset encrypted by CryptoFile ransomware involved analyzing the confusion matrix, precision, and recall across the first three batches. (a) Batch 3: AC=0.97, (Precision Normal=0.94, En￾crypt=1.0) , (Recall Normal=1…
Figure 6
Figure 6. Figure 6: The analysis of the Hoeffding Tree’s performance on a dataset encrypted by CryptFile2 ransomware extended to include the confusion matrix, precision, and recall measurements across an additional nine batches, following the initial three illustrated in [PITH_FULL_IMAGE…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

71 extracted references · 56 canonical work pages

  1. [1]

    Palmer, Ransomware is the biggest global cyber threat

    D. Palmer, Ransomware is the biggest global cyber threat. and the attacks are still evolving, zDNet (2022). URL https://www.zdnet.com/article/ ransomware-attacks-are-the-biggest-global-cyber-threat-and-still-evolving-warns-cybersecurity-chief/

    work page 2022

  2. [2]

    Mahboubi, S

    A. Mahboubi, S. Camtepe, H. Morarji, Reducing usb attack surface: A lightweight authentication and delegation protocol, in: 2018 International Conference on Smart Computing and Electronic Enterprise (ICSCEE), 2018, pp. 1–7. doi:10.1109/ICSCEE.2018.8538400

    work page arXiv 2018

  3. [3]

    Y . Wang, M. A. Bashar, M. Chandramohan, R. Nayak, Exploring topic models to discern cyber threats on twitter: A case study on log4shell, Intelligent Systems with Applications 20 (2023) 200280. doi:https: //doi.org/10.1016/j.iswa.2023.200280. URL https://www.sciencedirect.com/science/article/pii/ S2667305323001059 20 Table 8: Summary and Critique of Ranso...

    work page arXiv 2023

  4. [4]

    Sabbaghi, A

    F. Sabbaghi, A. Mahboubi, S. H. Othman, Hybrid service for business contingency plan and recovery service as a disaster recovery framework for cloud computing, Journal of Soft Computing and Decision Support Systems 4 (4) (2017) 1–10

    work page 2017

  5. [5]

    Hsu, C.-C

    C.-M. Hsu, C.-C. Yang, H.-H. Cheng, P. E. Setiasabda, J.-S. Leu, En- hancing file entropy analysis to improve machine learning detection rate of ransomware, IEEE Access 9 (2021) 138345–138351. doi:10.1109/ ACCESS.2021.3114148

    arXiv 2021

  6. [6]

    M. J. May, E. Laron, Combating ransomware using content analysis and complex file events, in: 2019 10th IFIP International Conference on New Technologies, Mobility and Security (NTMS), IEEE, 2019, pp. 1–5

    work page 2019

  7. [7]

    J. Lee, K. Lee, A method for neutralizing entropy measurement-based ransomware detection technologies using encoding algorithms, Entropy 24 (2) (2022). doi:10.3390/e24020239. URL https://www.mdpi.com/1099-4300/24/2/239

    work page doi:10.3390/e24020239 2022

  8. [8]

    McIntosh, J

    T. McIntosh, J. Jang-Jaccard, P. Watters, T. Susnjak, The inadequacy of entropy-based ransomware detection, in: T. Gedeon, K. W. Wong, M. Lee (Eds.), Neural Information Processing, Springer International Publishing, Cham, 2019, pp. 181–189

    work page 2019

Show all 71 references
  1. [10]

    Homayoun, A

    S. Homayoun, A. Dehghantanha, M. Ahmadzadeh, S. Hashemi, R. Khayami, Know abnormal, find evil: Frequent pattern mining for ran- somware threat hunting and intelligence, IEEE Transactions on Emerging Topics in Computing 8 (2) (2020) 341–351.doi:10.1109/TETC.2017. 2756908

    2020 doi

  2. [11]

    Nallaperuma, R

    D. Nallaperuma, R. Nawaratne, T. Bandaragoda, A. Adikari, S. Nguyen, T. Kempitiya, D. De Silva, D. Alahakoon, D. Pothuhera, Online in- cremental machine learning platform for big data-driven smart tra ffic management, IEEE Transactions on Intelligent Transportation Systems 20 ...

    2019

  3. [12]

    Mahboubi, K

    A. Mahboubi, K. Ansari, S. Camtepe, J. Duda, P. Morawiecki, M. Pawłowski, J. Pieprzyk, Digital Immunity Module: Preventing Un- wanted Encryption using Source Coding (1 2022). doi:10.36227/ techrxiv.17789735.v1. 21 URL https://shorturl.at/jGIV9

    2022

  4. [13]

    Kantee, Rump file systems: Kernel code reborn, in: 2009 USENIX Annual Technical Conference (USENIX ATC 09), USENIX Association, San Diego, CA, 2009

    A. Kantee, Rump file systems: Kernel code reborn, in: 2009 USENIX Annual Technical Conference (USENIX ATC 09), USENIX Association, San Diego, CA, 2009. URL https://www.usenix.org/conference/usenix-09/ rump-file-systems-kernel-code-reborn

    2009

  5. [14]

    M. E. Ahmed, H. Kim, S. Camtepe, S. Nepal, Peeler: Profiling kernel- level events to detect ransomware, in: E. Bertino, H. Shulman, M. Waid- ner (Eds.), Computer Security – ESORICS 2021, Springer International Publishing, Cham, 2021, pp. 240–260

    2021

  6. [15]

    Continella, A

    A. Continella, A. Guagnelli, G. Zingaro, G. De Pasquale, A. Barenghi, S. Zanero, F. Maggi, Shieldfs: A self-healing, ransomware-aware filesys- tem, in: Proceedings of the 32nd Annual Conference on Computer Se- curity Applications, ACSAC ’16, Association for Computing Machin- e...

    2016

  7. [16]

    Hirano, R

    M. Hirano, R. Hodota, R. Kobayashi, Ransap: An open dataset of ran- somware storage access patterns for training machine learning models, Forensic Science International: Digital Investigation 40 (2022) 301314. doi:https://doi.org/10.1016/j.fsidi.2021.301314. URL https://www.sc...

    2022

  8. [17]

    Hirano, R

    M. Hirano, R. Kobayashi, Machine learning based ransomware detec- tion using storage access patterns obtained from live-forensic hyper- visor, in: 2019 Sixth International Conference on Internet of Things: Systems, Management and Security (IOTSMS), 2019, pp. 1–6. doi: 10.1109/...

    2019

  9. [18]

    Huang, J

    J. Huang, J. Xu, X. Xing, P. Liu, M. K. Qureshi, Flashguard: Leverag- ing intrinsic flash properties to defend against encryption ransomware, in: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, CCS ’17, Association for Computing Ma- chine...

    2017

  10. [19]

    H. L. Jeong, S. K. Ahn, S. H. Baek, K.-W. Park, Anomaly detection tech- nology using potential di fference displacement detection of data bus., J. Internet Serv. Inf. Secur. 9 (4) (2019) 68–77

    2019

  11. [20]

    Kharaz, S

    A. Kharaz, S. Arshad, C. Mulliner, W. Robertson, E. Kirda, UNVEIL: A Large-Scale, automated approach to detecting ransomware, in: 25th USENIX Security Symposium (USENIX Security 16), USENIX Associ- ation, Austin, TX, 2016, pp. 757–772. URL https://www.usenix.org/conference/ us...

    2016

  12. [21]

    Mehnaz, A

    S. Mehnaz, A. Mudgerikar, E. Bertino, Rwguard: A real-time detec- tion system against cryptographic ransomware, in: M. Bailey, T. Holz, M. Stamatogiannakis, S. Ioannidis (Eds.), Research in Attacks, Intru- sions, and Defenses, Springer International Publishing, Cham, 2018, pp. 114–136

    2018

  13. [22]

    S. M. Milajerdi, B. Eshete, R. Gjomemo, V . Venkatakrishnan, Poirot: Aligning attack behavior with kernel audit records for cyber threat hunt- ing, in: Proceedings of the 2019 ACM SIGSAC Conference on Com- puter and Communications Security, CCS ’19, Association for Com- puting...

    2019

  14. [23]

    D. Min, Y . Ko, R. Walker, J. Lee, Y . Kim, A content-based ransomware detection and backup solid-state drive for ransomware defense, IEEE Transactions on Computer-Aided Design of Integrated Circuits and Sys- tems 41 (7) (2022) 2038–2051. doi:10.1109/TCAD.2021.3099084

    2022

  15. [24]

    Scaife, H

    N. Scaife, H. Carter, P. Traynor, K. R. B. Butler, Cryptolock (and drop it): Stopping ransomware attacks on user data, in: 2016 IEEE 36th Inter- national Conference on Distributed Computing Systems (ICDCS), 2016, pp. 303–312. doi:10.1109/ICDCS.2016.46

    2016 doi

  16. [25]

    Constantin, New royal ransomware group evades detection with partial encryption, CSO (December 2022)

    L. Constantin, New royal ransomware group evades detection with partial encryption, CSO (December 2022). URL https://www.csoonline.com/article/574223/ new-royal-ransomware-group-evades-detection-with-partial-encryption. html

    2022

  17. [26]

    Toulas, Ransomware gangs switching to new intermittent encryption tactic, Bleeping Computer (September 2022)

    B. Toulas, Ransomware gangs switching to new intermittent encryption tactic, Bleeping Computer (September 2022). URL https://www.bleepingcomputer.com/news/security/ ransomware-gangs-switching-to-new-intermittent-encryption-tactic/

    2022

  18. [27]

    Z. A. Genç, G. Lenzini, D. Sgandurra, On deception-based protection against cryptographic ransomware, in: R. Perdisci, C. Maurice, G. Giac- into, M. Almgren (Eds.), Detection of Intrusions and Malware, and Vul- nerability Assessment, Springer International Publishing, Cham, 20...

    2019

  19. [28]

    Kharraz, E

    A. Kharraz, E. Kirda, Redemption: Real-time protection against ran- somware at end-hosts, in: M. Dacier, M. Bailey, M. Polychronakis, M. Antonakakis (Eds.), Research in Attacks, Intrusions, and Defenses, Springer International Publishing, Cham, 2017, pp. 98–119

    2017

  20. [29]

    Kumbhojkar, Base64 encoding algorithm, published in The Startup, 5 min read, Jan 15, 2021 (2021)

    A. Kumbhojkar, Base64 encoding algorithm, published in The Startup, 5 min read, Jan 15, 2021 (2021). URL https://medium.com/swlh/base64-encoding-algorithm-42abb929087d

    2021

  21. [30]

    Maguire, C

    D. Maguire, C. Davis, M. Penna, Configure client-specific message size limits, microsoft, Article. Accessed: 2023-12-10 (Jan. 2023). URL https://learn.microsoft.com/en-us/exchange/ configure-client-specific-message-size-limits-exchange-2013-help

    2023

  22. [31]

    S. R. Davies, R. Macfarlane, W. J. Buchanan, Comparison of entropy calculation methods for ransomware encrypted file identification, Entropy 24 (10) (2022). URL https://www.mdpi.com/1099-4300/24/10/1503

    2022

  23. [32]

    Lee, S.-Y

    K. Lee, S.-Y . Lee, K. Yim, Machine learning based file entropy analy- sis for ransomware detection in backup systems, IEEE Access 7 (2019) 110205–110215. doi:10.1109/ACCESS.2019.2931136

    2019

  24. [33]

    S. R. Davies, R. Macfarlane, W. J. Buchanan, Di fferential area analysis for ransomware attack detection within mixed file datasets, Computers & Security 108 (2021) 102377. doi:https://doi.org/10.1016/j. cose.2021.102377. URL https://www.sciencedirect.com/science/article/pii/ ...

    2021

  25. [34]

    Kharaz, S

    A. Kharaz, S. Arshad, C. Mulliner, W. Robertson, E. Kirda, {UNVEIL}: A{Large-Scale}, automated approach to detecting ransomware, in: 25th USENIX security symposium (USENIX Security 16), 2016, pp. 757–772

    2016

  26. [35]

    Mahboubi, S

    A. Mahboubi, S. Camtepe, K. Ansari, M. Pawłowski, P. Morawiecki, H. Aboutorab, J. Pieprzyk, J. Duda, Shared file protection against unau- thorised encryption using a bu ffer-based signature verification method, Journal of Information Security and Applications 86 (2024) 103873....

    2024

  27. [36]

    Alzubi, A

    J. Alzubi, A. Nayyar, A. Kumar, Machine learning from theory to algo- rithms: an overview, in: Journal of physics: conference series, V ol. 1142, IOP Publishing, 2018, p. 012012

    2018

  28. [37]

    K. Das, R. N. Behera, A survey on machine learning: concept, algorithms and applications, International Journal of Innovative Research in Com- puter and Communication Engineering 5 (2) (2017) 1301–1309

    2017

  29. [38]

    S. C. Hoi, D. Sahoo, J. Lu, P. Zhao, Online learning: A comprehensive survey, Neurocomputing 459 (2021) 249–289.doi:https://doi.org/ 10.1016/j.neucom.2021.04.112. URL https://www.sciencedirect.com/science/article/pii/ S0925231221006706

    2021 doi

  30. [39]

    Toomaj, A

    A. Toomaj, A. Di Crescenzo, Generalized entropies, variance and appli- cations, Entropy 22 (6) (2020) 709

    2020

  31. [40]

    M. H. Hilman, M. A. Rodriguez, R. Buyya, Task runtime predic- tion in scientific workflows using an online incremental learning ap- proach, in: 2018 IEEE /ACM 11th International Conference on Utility and Cloud Computing (UCC), 2018, pp. 93–102. doi:10.1109/UCC. 2018.00018

    2018

  32. [41]

    Y . Wu, Y . Chen, L. Wang, Y . Ye, Z. Liu, Y . Guo, Y . Fu, Large scale in- cremental learning, in: 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2019, pp. 374–382. doi:10.1109/ CVPR.2019.00046

    2019

  33. [42]

    Hulten, L

    G. Hulten, L. Spencer, P. Domingos, Mining time-changing data streams, in: Proceedings of the Seventh ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, KDD ’01, Association for Computing Machinery, New York, NY , USA, 2001, p. 97–106. doi: 10.1145/502...

    2001

  34. [43]

    Cocomazzi, Custom-branded ransomware: The vice society group and 22 the threat of outsourced development, accessed: 2023-12-10 (2022)

    A. Cocomazzi, Custom-branded ransomware: The vice society group and 22 the threat of outsourced development, accessed: 2023-12-10 (2022). URL https://shorturl.at/nsxFT

    2022

  35. [44]

    J. V . Michalowicz, J. M. Nichols, F. Bucholtz, Handbook of di fferential entropy, Crc Press, 2013

    2013

  36. [45]

    J. Bang, J. N. Kim, S. Lee, Entropy sharing in ransomware: Bypass- ing entropy-based detection of cryptographic operations, Sensors 24 (5) (2024). doi:10.3390/s24051446. URL https://www.mdpi.com/1424-8220/24/5/1446

    2024 doi

  37. [46]

    G. Y . Kim, J.-Y . Paik, Y . Kim, E.-S. Cho, Byte frequency based indica- tors for crypto-ransomware detection from empirical analysis, Journal of Computer Science and Technology 37 (2) (2022) 423–442

    2022

  38. [47]

    von der Assen, C

    J. von der Assen, C. Feng, A. H. Celdrán, R. Oleš, G. Bovet, B. Stiller, Guardfs: a file system for integrated detection and mitigation of linux- based ransomware (2024). arXiv:2401.17917

    2024 arXiv

  39. [48]

    Zhang, W

    B. Zhang, W. Xiao, X. Xiao, A. K. Sangaiah, W. Zhang, J. Zhang, Ran- somware classification using patch-based cnn and self-attention network on embedded n-grams of opcodes, Future Generation Computer Systems 110 (2020) 708–720

    2020

  40. [49]

    Moser, C

    A. Moser, C. Kruegel, E. Kirda, Limits of static analysis for malware detection, in: Twenty-third annual computer security applications confer- ence (ACSAC 2007), IEEE, 2007, pp. 421–430

    2007

  41. [50]

    R. Tian, R. Islam, L. Batten, S. Versteeg, Di fferentiating malware from cleanware using behavioural analysis, in: 2010 5th international confer- ence on malicious and unwanted software, Ieee, 2010, pp. 23–30

    2010

  42. [51]

    De Gaspari, D

    F. De Gaspari, D. Hitaj, G. Pagnotta, L. De Carli, L. V . Mancini, The naked sun: Malicious cooperation between benign-looking processes, in: Applied Cryptography and Network Security: 18th International Confer- ence, ACNS 2020, Rome, Italy, October 19–22, 2020, Proceedings, P...

    2020

  43. [52]

    Marcus, P

    D. Marcus, P. Greve, S. Masiello, D. Scharoun, et al., Mcafee threats report: Third quarter 2009 (2010)

    2010

  44. [53]

    Whitham, Automating the generation of enticing text content for high- interaction honeyfiles (2017)

    B. Whitham, Automating the generation of enticing text content for high- interaction honeyfiles (2017)

    2017

  45. [54]

    Cabaj, W

    K. Cabaj, W. Mazurczyk, Using software-defined networking for ran- somware mitigation: the case of cryptowall, Ieee Network 30 (6) (2016) 14–20

    2016

  46. [55]

    O. M. Alhawi, J. Baldwin, A. Dehghantanha, Leveraging machine learn- ing techniques for windows ransomware network traffic detection, Cyber threat intelligence (2018) 93–106

    2018

  47. [56]

    A. O. Almashhadani, M. Kaiiali, S. Sezer, P. O’Kane, A multi-classifier network-based crypto ransomware detection system: A case study of locky ransomware, IEEE access 7 (2019) 47053–47067

    2019

  48. [57]

    M. Alam, S. Bhattacharya, S. Dutta, S. Sinha, D. Mukhopadhyay, A. Chattopadhyay, Ratafia: Ransomware analysis using time and fre- quency informed autoencoders, in: 2019 IEEE International Symposium on Hardware Oriented Security and Trust (HOST), IEEE, 2019, pp. 218– 227

    2019

  49. [58]

    Aurangzeb, R

    S. Aurangzeb, R. N. B. Rais, M. Aleem, M. A. Islam, M. A. Iqbal, On the classification of microsoft-windows ransomware using hardware profile, PeerJ Computer Science 7 (2021) e361

    2021

  50. [59]

    G. O. Ganfure, C.-F. Wu, Y .-H. Chang, W.-K. Shih, Deepguard: Deep generative user-behavior analytics for ransomware detection, in: 2020 IEEE International Conference on Intelligence and Security Informatics (ISI), IEEE, 2020, pp. 1–6

    2020

  51. [60]

    S. Baek, Y . Jung, D. Mohaisen, S. Lee, D. Nyang, Ssd-assisted ran- somware detection and data recovery techniques, IEEE Transactions on Computers 70 (10) (2020) 1762–1776

    2020

  52. [61]

    Hsu, C.-C

    C.-M. Hsu, C.-C. Yang, H.-H. Cheng, P. E. Setiasabda, J.-S. Leu, En- hancing file entropy analysis to improve machine learning detection rate of ransomware, IEEE Access 9 (2021) 138345–138351

    2021

  53. [62]

    G. O. Ganfure, C.-F. Wu, Y .-H. Chang, W.-K. Shih, Rtrap: Trapping and containing ransomware with machine learning, IEEE Transactions on Information Forensics and Security 18 (2023) 1433–1448. doi: 10.1109/TIFS.2023.3240025

    2023

  54. [63]

    J. Lee, J. Lee, J. Hong, How to make e fficient decoy files for ransomware detection?, in: Proceedings of the International Conference on Research in Adaptive and Convergent Systems, 2017, pp. 208–212

    2017

  55. [64]

    Gómez-Hernández, L

    J. Gómez-Hernández, L. Álvarez González, P. García-Teodoro, R-locker: Thwarting ransomware action through a honeyfile-based approach, Com- puters & Security 73 (2018) 389–398. doi:https://doi.org/10. 1016/j.cose.2017.11.019. URL https://www.sciencedirect.com/science/article/pi...

    2018

  56. [65]

    Mehnaz, A

    S. Mehnaz, A. Mudgerikar, E. Bertino, Rwguard: A real-time detection system against cryptographic ransomware, in: International symposium on research in attacks, intrusions, and defenses, Springer, 2018, pp. 114– 136

    2018

  57. [66]

    Cabaj, P

    K. Cabaj, P. Gawkowski, K. Grochowski, D. Osojca, Network activity analysis of cryptowall ransomware, Przeglad Elektrotechniczny 91 (11) (2015) 201–204

    2015

  58. [67]

    Mbol, J.-M

    F. Mbol, J.-M. Robert, A. Sadighian, An e fficient approach to detect tor- rentlocker ransomware in computer systems, in: Cryptology and Net- work Security: 15th International Conference, CANS 2016, Milan, Italy, November 14-16, 2016, Proceedings 15, Springer, 2016, pp. 532–541

    2016

  59. [68]

    S. Song, B. Kim, S. Lee, et al., The effective ransomware prevention tech- nique using process monitoring on android platform, Mobile Information Systems 2016 (2016)

    2016

  60. [69]

    Andronio, S

    N. Andronio, S. Zanero, F. Maggi, Heldroid: Dissecting and detecting mobile ransomware, in: Research in Attacks, Intrusions, and Defenses: 18th International Symposium, RAID 2015, Kyoto, Japan, November 2- 4, 2015. Proceedings 18, Springer, 2015, pp. 382–404

    2015

  61. [70]

    Mahboubi, K

    A. Mahboubi, K. Ansari, S. Camtepe, Using process mining to identify file system metrics impacted by ransomware execution, in: S. Bouzefrane, M. Laurent, S. Boumerdassi, E. Renault (Eds.), Mobile, Secure, and Pro- grammable Networking, Springer International Publishing, Cham, ...

    2021

  62. [71]

    Camtepe, J

    S. Camtepe, J. Duda, A. Mahboubi, P. Morawiecki, S. Nepal, M. Pawłowski, J. Pieprzyk, Ans-based compression and encryption with 128-bit security, International Journal of Information Security 21 (5) (2022) 1051–1067

    2022

  63. [72]

    Pieprzyk, J

    J. Pieprzyk, J. Duda, M. Pawłowski, S. Camtepe, A. Mahboubi, P. Morawiecki, The compression optimality of asymmetric numeral sys- tems, Entropy 25 (4) (2023). doi:10.3390/e25040672. URL https://www.mdpi.com/1099-4300/25/4/672 23

    2023 doi

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.