Pith. sign in

REVIEW 3 major objections 6 minor 82 references

MLRan: A Behavioural Dataset for Ransomware Analysis and Detection

T0 review · 3 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read MLRan, a balanced 4,880-sample ransomware dataset, claims 98% binary detection with 483 selected features.

desk verdict The dataset is the real contribution; the 98% detection numbers are not supported because feature-selection choices were made on the test set, violating the paper's own protocol. read the letter →

arxiv 2505.18613 v1 pith:PKNC4N4Y submitted 2025-05-24 cs.CR cs.LG

Faithful Chiagoziem Onwuegbuche , Adelodun Olaoluwa , Anca Delia Jurcut , Liliana Pasquale This is my paper · ORCID
classification cs.CRcs.LG
keywords ransomwaredatasetdynamicanalysismachinelearningfeatureselectionmutualinformationrecursiveeliminationexplainableAIbehavioralfeatures
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

MLRan is a new behavioural dataset of 4,880 balanced Windows samples: 2,330 ransomware across 64 families and 2,550 goodware, collected from multiple sample sources and spanning 2006 to 2024, with nine behavioural feature groups. The paper's central claim is that, after two-stage feature selection (mutual information filtering at threshold 0.01 followed by recursive feature elimination), a logistic regression model on just 483 features detects ransomware versus goodware at about 98% accuracy, precision and recall. It also proposes GUIDE-MLRan, a fifteen-criterion checklist for building reproducible behavioural ransomware datasets, and releases its dataset, code and metadata so others can rerun or extend the experiments. A fair reader would care because public behavioural ransomware datasets are small, imbalanced and poorly documented; a large, balanced, benchmarkable dataset with a lightweight high-accuracy baseline is a concrete resource for detection research.

What carries the argument

The central object is the dataset itself: 4,880 samples analysed in a hardened open-source dynamic-analysis sandbox with simulated user activity, an extended timeout and realistic system configuration, then encoded as binary presence features in nine categories: API calls, registry keys, file operations, directory operations, strings, network activity, system operations, dropped files and signatures. The argument is carried by a two-stage feature-selection pipeline: group-wise mutual information filtering cuts the 6.4-million-feature space to 24,162, and recursive feature elimination then selects 2% of that (483 features), which the paper reports as the point of highest balanced accuracy. The deployed detection model is logistic regression over those 483 binary features.

What would settle it

Re-run the paper's pipeline with both feature-selection decisions locked inside the training process: split the data time-aware, choose the mutual information threshold and the recursive feature elimination count on training or validation data only, and then evaluate the final model once on the untouched most-recent 20%. If balanced accuracy falls substantially below 98% or varies widely across folds, the reported benchmark is not robust to honest evaluation.

Watch

Extended reading notes

Core claim

The paper's discovery, on its own terms, is that a carefully balanced behavioural dataset at this scale makes high-accuracy ransomware detection easy: no deep model is needed. From 6,467,926 binary presence features extracted from sandbox reports, group-wise mutual information filtering (threshold 0.01) keeps 24,162 features, and recursive feature elimination on a logistic regression estimator selects 483. On a time-aware 80:20 split, with samples ordered by first-seen timestamp and the most recent 20% held out, logistic regression reaches 98.15% accuracy, 98.18% balanced accuracy, 98.16% precision and 98.15% recall for binary classification, producing 12 false positives and 6 false negatives in a 975-sample test set. Explainability analysis using SHAP and LIME shows that the top discriminating features come from API calls, strings, registry and system behaviours, with network features eliminated entirely; distinguishing types and families is harder, with accuracy reaching 87.69% for types and 81.85% for families.

Load-bearing premise

The reported 98% figures assume the held-out test set never influenced feature-selection choices, yet the paper appears to pick the feature-keeping threshold and the final feature count from curves computed on that same test set.

Editorial extensions

If this is right

  • If the central claims hold, MLRan becomes a public benchmark where binary ransomware detection is solved by a linear model and 483 features, giving future work a strong, cheap baseline to beat.
  • The two-stage feature-selection recipe, mutual information filtering followed by recursive feature elimination, transfers to other high-dimensional behavioural datasets and cuts training time from thousands of seconds to under a second for the evaluated models.
  • The explainability results give feature engineers a concrete shortlist: API calls, registry accesses, strings and system operations matter, while network, file and directory features contribute little for binary detection in this environment.
  • Multiclass results for type and family classification are substantially weaker, so the paper's strength is specifically binary detection; researchers using MLRan for family identification should expect lower accuracy.
  • Because the full pipeline is released, any team can reproduce the numbers, update the dataset with new families, or stress-test the 483-feature model on independent data.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the 98% figures likely overstate deployment performance, because the mutual information threshold (0.01) and the recursive-feature-elimination feature count (2%) appear to be selected using test-set performance curves (Section 6.1, Figure 9), which conflicts with the paper's own no-test-snooping guideline; choosing these hyperparameters on a validation split could lower the re
  • Editorial inference: the highest-ranked feature is a generic string found at the start of essentially every Windows executable, so part of the binary signal may come from file-type artifacts rather than ransomware behaviour; removing that feature and retraining would show how much of the 98% is genuinely behavioural.
  • Editorial inference: a more convincing benchmark would run the whole pipeline under nested cross-validation with feature selection inside each fold and then report per-family and per-year performance; the time-aware split is a step in that direction, but the feature-count selection needs to happen before the test set is touched.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper introduces MLRan, a behavioural ransomware dataset of 4,880 Windows samples (2,330 ransomware samples from 64 families spanning locker, crypto, RaaS, and modern types over 2006-2024, plus 2,550 goodware samples from 11 categories). It proposes GUIDE-MLRan, a set of fifteen criteria for constructing and documenting behavioural ransomware datasets, and describes an open-source pipeline for sample collection, Cuckoo Sandbox analysis, feature extraction, and ML evaluation. The authors evaluate several classifiers under a two-stage feature-selection scheme (mutual information filtering followed by recursive feature elimination, reducing 6.4M features to 483) and report binary detection accuracy, precision, and recall up to 98.7%, 98.9%, and 98.5%, together with SHAP/LIME analyses and a misclassification study.

Significance. The dataset itself is a potentially valuable community resource: it is larger and more balanced than most prior behavioural ransomware datasets, spans a long temporal range, covers four ransomware types, provides metadata, and ships public code for collection, parsing, feature selection, and training. GUIDE-MLRan is a useful systematisation of dataset-construction requirements, and the paper is transparent about sandbox hardening and labelling. However, the quantitative ML claims are not currently supported because the feature-selection thresholds and feature count are chosen using test-set performance, contrary to the paper's own no-test-snooping protocol. The headline figures must be re-estimated before the paper can be accepted.

major comments (3)
  1. [Section 6.1 (Table 5) and Section 6.2 (Algorithm 2, Figure 9) in light of Section 3.4.3] The evaluation protocol uses the test set to make feature-selection decisions. Section 6.1 compares MI(0.01), MI(0.001), and Chi-Square on test-set metrics and selects MI(0.01); Section 6.2, Algorithm 2, Lines 15-21 transforms X_test and computes balanced accuracy on y_test for each RFE feature count, and Figure 9 selects the 2% (483-feature) configuration. This is precisely the "test snooping" the paper itself prohibits in Section 3.4.3, where it states that test data should be used only for final evaluation. The binary results in Table 6 are therefore optimistic and do not measure generalization to unseen data. The authors should re-run feature selection inside the training folds (nested cross-validation or a separate validation split), freeze thresholds and feature counts before touching the test set, and then report one final test evaluation.
  2. [Abstract and Section 1 vs. Tables 5 and 6] The abstract and introduction report "accuracy, precision and recall of up to 98.7%, 98.9%, 98.5%," but no row in Table 5 or Table 6 attains these values; the closest binary logistic-regression row is 98.15% / 98.16% / 98.15% (Table 6). This mismatch weakens the headline claim. The authors should either identify the exact configuration producing the abstract numbers or correct the reported figures to those in the tables.
  3. [Section 6.2, Result 2] The paper claims that the two-stage feature selection reduced the feature space from over 6.4 million to 483 "without accuracy loss." Because both the MI threshold and the RFE feature count were selected using test-set performance, there is currently no valid evidence for this claim; the comparison between Table 5 MI(0.01) (logistic regression accuracy 97.54%) and Table 6 after RFE (98.15%) is not a fair evaluation. A nested cross-validation comparison with confidence intervals is needed before the efficiency claim can be assessed.
minor comments (6)
  1. [Table 1, ShieldFS row] The ShieldFS row appears to have the #Ran and #Good columns swapped relative to the text in Section 2, which states 383 ransomware samples and 2,245 goodware applications.
  2. [Tables 5 and 6] The first model is labelled "XGBoost" in the tables, while Section 5.3.1 describes LightGBM; the terminology should be aligned.
  3. [Algorithm 2, Line 6] Feature counts are computed from |X_train|, but n_features_to_select is a feature count; the notation should be clarified to refer to the number of features, not the number of training samples.
  4. [Section 6.2, Result 2] The text says "improving model efficiency and interoperability"; "interpretability" is presumably intended.
  5. [Table 9] The hyperparameter grids are listed, but the paper does not state whether hyperparameters were tuned on a validation split or with cross-validation; this should be documented to support the no-snooping claim.
  6. [Figures 13 and 14] The t-SNE visualisations do not report the perplexity or state whether the projection was fitted on training data only, which is needed for reproducibility.

Circularity Check

0 steps flagged · score 2.0 of 10

No load-bearing circularity: the MLRan dataset and its ML evaluation are empirical artifacts; the only self-citations are non-load-bearing, and the headline 98% figures are weakened by test-set-dependent feature selection (a soundness issue, not a reduction of a prediction to its own inputs).

full rationale

The paper's central contributions are a constructed dataset and an empirical ML benchmark, not a derivation chain in which an output equals an input by construction. The two-stage feature selection (MI then RFE) is fit on the training portion, and the reported accuracy, precision, and recall are empirical measurements on a held-out split, so no result reduces to a fitted constant or to a self-citation. The self-citations to Onwuegbuche et al. (2023) are used only as related prior work on multi-stage feature selection and as a comparison for feature-set sizes; they are not invoked as a uniqueness theorem or as the sole justification for the central claims. The most serious flaw is methodological rather than circular: Algorithm 2 (Section 6.2) 'Transform test set: Set Xtest_transformed <- rfe.transform(Xtest)' and 'Calculate balanced accuracy: ... balanced_accuracy_score(ytest, ypred)' selects the RFE feature count using test-set balanced accuracy, and Figure 9 then chooses the 2% (483-feature) configuration with the highest test balanced accuracy; Table 5 likewise selects the MI threshold on test performance. The paper itself warns in Section 3.4.3 that 'test data is misused for feature selection or hyperparameter tuning' produces 'misleading performance metrics,' so the headline 98% numbers are likely optimistic. However, this is test-set snooping or selection bias, not a circular derivation: the reported accuracy is not algebraically identical to the selection criterion, and the model weights themselves are still fit on training data. A correct validation split or nested cross-validation would resolve the concern. Given the absence of definitional or self-citation-based circularity, the appropriate circularity score is low, with the 2 reflecting the minor self-reference and the evaluation-validity caveat rather than any load-bearing circular step.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

The central claims rest on standard ML background, on the assumption that sandbox behavior is representative, and on VirusTotal-based labeling. The only hand-fitted numbers that directly affect the headline performance are the MI threshold and the RFE feature percentage, both of which appear to be tuned on the test set. No new physical or conceptual entities are introduced.

free parameters (2)
  • MI threshold = 0.01
    Chosen by comparing test-set accuracy across thresholds (Table 5); effectively a hand-picked cutoff that affects the final feature set and reported accuracy.
  • RFE feature percentage = 2% (483 features)
    Selected as the point with highest balanced accuracy on the RFE curve (Figure 9), which appears to be evaluated on the test set.
assumptions (3)
  • domain assumption VirusTotal detection scores provide valid ground truth for ransomware/goodware labels
    Samples were labeled as ransomware if VirusTotal detections were non-zero and as goodware if zero (Section 4.2). If VirusTotal is wrong or evaded, labels are noisy.
  • domain assumption Two minutes of execution in a hardened Windows 7 Cuckoo sandbox captures representative ransomware behavior
    The 120-second timeout and VM configuration are based on prior work (Section 4.3). Ransomware that delays execution or detects the sandbox will not be fully represented.
  • domain assumption The time-aware split prevents temporal leakage
    The paper assumes that ordering by first VirusTotal submission and taking the latest 20% as test isolates future samples (Section 5.5). This assumption is undermined if feature selection uses the test set.

how reviews work

0 comments
Cite this review

Pith. "Pith review of MLRan: A Behavioural Dataset for Ransomware Analysis and Detection." pith.science (2026). https://pith.science/paper/PKNC4N4Y

@misc{pith2026250518613,
  author       = {Pith},
  title        = {Pith review of: MLRan: A Behavioural Dataset for Ransomware Analysis and Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/PKNC4N4Y}},
  note         = {Machine review of arXiv:2505.18613}
}
read the original abstract

Ransomware remains a critical threat to cybersecurity, yet publicly available datasets for training machine learning-based ransomware detection models are scarce and often have limited sample size, diversity, and reproducibility. In this paper, we introduce MLRan, a behavioural ransomware dataset, comprising over 4,800 samples across 64 ransomware families and a balanced set of goodware samples. The samples span from 2006 to 2024 and encompass the four major types of ransomware: locker, crypto, ransomware-as-a-service, and modern variants. We also propose guidelines (GUIDE-MLRan), inspired by previous work, for constructing high-quality behavioural ransomware datasets, which informed the curation of our dataset. We evaluated the ransomware detection performance of several machine learning (ML) models using MLRan. For this purpose, we performed feature selection by conducting mutual information filtering to reduce the initial 6.4 million features to 24,162, followed by recursive feature elimination, yielding 483 highly informative features. The ML models achieved an accuracy, precision and recall of up to 98.7%, 98.9%, 98.5%, respectively. Using SHAP and LIME, we identified critical indicators of malicious behaviour, including registry tampering, strings, and API misuse. The dataset and source code for feature extraction, selection, ML training, and evaluation are available publicly to support replicability and encourage future research, which can be found at https://github.com/faithfulco/mlran.

Figures

Figures reproduced from arXiv: 2505.18613 by the authors.

Figure 1
Figure 1. Distribution of software sample types in the MLRan dataset. The dataset contains a total of 4880 samples, split into 2550 (52.25%) Goodware and 2330 (47.75%) Ransomware. The dataset is relatively balanced, with only a slight difference between the two categories [PITH_FULL_IMAGE:figures/full_fig_p014_1.png] view at source ↗
Figure 2
Figure 2. Distribution of ransomware types in the MLRan dataset. The dataset contains a total of 2330 Ransomware samples, split into 1140 (48.92%) Crypto, 468 (20.08%) RaaS, 449 (19.27%) Modern, and 273 (11.72%) Locker. The distributions of ransomware types in [PITH_FULL_IMAGE:figures/full_fig_p015_2.png] view at source ↗
Figure 3
Figure 3. Distribution of ransomware families, colour-coded by their respective ransomware types. The numbers on the bars represent the number of samples from each ransomware family found in the MLRan Dataset. The dataset includes a total of 64 ransomware families, classified into four categories, as shown in the legend and colour-coded in the bars: 32 families belong to the Crypto type, 15 are Modern, 13 are RaaS, and 4 are … view at source ↗
Figures from the paper (12 more)
Figure 4
Figure 4. Figure 4: Distribution of goodware sample categories in the MLRan Dataset. The goodware samples contain 11 categories, with the Most Popular category having the highest sample count of 1212 samples, representing 47.53% of the total. The Productivity category follows with 187 sam…
Figure 5
Figure 5. Figure 5: The stacked bar chart illustrates the distribution of samples in the MLRan dataset across different years, based on their first submission to VirusTotal, segmented by sample type (Goodware and Ransomware). The first submission timestamp from VirusTotal was used as it p…
Figure 6
Figure 6. Figure 6: MLRan ransomware sample collection methodology. The diagram illustrates the four primary sources from which ransomware samples were obtained for the MLRan dataset: EldeRan (552 samples), MOTIF (426 samples), MarauderMap (575 samples), and a curated collection (777 samp…
Figure 7
Figure 7. Figure 7: MLRan goodware sample collection methodology. All the goodware samples were downloaded from the Software Informer website and they cut across 11 different categories. files extensions and types, and behavioural signatures. These features capture key behavioural aspects…
Figure 8
Figure 8. Figure 8: Ransomware detection pipeline showing dynamic analysis, custom feature extraction, multi-stage feature selection, model training, and explainability using SHAP and LIME. 5.4.4. Recall Recall, or sensitivity, measures the model’s ability to detect positive instances: Re…
Figure 9
Figure 9. Figure 9: This plot shows the balanced accuracy of a logistic regression model as a function of the percentage of features se￾lected using Recursive Feature Elimination. The initial dataset contains 24,162 features, and RFE is used to select subsets of features corresponding to …
Figure 10
Figure 10. Figure 10: SHAP decision plot showing the top 50 features ranked by their impact on model output. ability to detect interactions with critical system resources, which are frequently targeted by malicious software seeking to gain elevated privileges or maintain persistence. Furth…
Figure 11
Figure 11. Figure 11: SHAP violin plot showing the top 50 features ranked by their impact on model output. Wider sections indicate features with greater and more variable influence, while positive and negative values reflect their contribution to the positive and negative class predictions…
Figure 12
Figure 12. Figure 12: Confusion matrix for the ransomware detection logistic regression model based on the two-stage feature selection technique. The results show that the model correctly classified 498 Goodware and 459 Ransomware instances, with 12 false positives and 6 false negatives […
Figure 14
Figure 14. Figure 14: t-SNE projection in 3D with misclassified samples highlighted in red with black borders and correctly classified in blue. shown in Figures 13 and 14 respectively. Misclassified sam￾ples are highlighted in red with black borders, and correctly classified samples are in…
Figure 15
Figure 15. Figure 15: LIME explanation of the model’s prediction for a ransomware sample misclassified as goodware. The figure displays the top 5 features and the predicted probabilities for Goodware (79%) and Ransomware (21%), along with the contributions of individual features to the mod…
Figure 16
Figure 16. Figure 16: LIME explanation of the model’s prediction for a goodware sample misclassified as ransomware. The figure displays the top 5 features and the predicted probabilities for Goodware (13%) and Ransomware (87%), along with the contributions of individual features to the mod…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

82 extracted references · 76 canonical work pages

  1. [1]

    , author Al-Sahaf, H

    author Abbasi, M.S. , author Al-Sahaf, H. , author Welch, I. , year 2020 . title Particle swarm optimization: A wrapper-based feature selection method for ransomware detection and classification , in: booktitle Applications of Evolutionary Computation: 23rd European Conference, EvoApplications 2020, Held as Part of EvoStar 2020, Seville, Spain, April 15--...

    2020

  2. [2]

    , year 2024

    author Ahmed, M. , year 2024 . title Ransomware Evolution . publisher CRC Press

    2024

  3. [3]

    , author Alazab, M

    author Al-Hawawreh, M. , author Alazab, M. , author Ferrag, M.A. , author Hossain, M.S. , year 2024 . title Securing the industrial internet of things against ransomware attacks: A comprehensive analysis of the emerging threat landscape and detection mechanisms . journal Journal of Network and Computer Applications volume 223 , pages 103809

    work page 2024

  4. [4]

    , author Alhaidari, F

    author Aljabri, M. , author Alhaidari, F. , author Albuainain, A. , author Alrashidi, S. , author Alansari, J. , author Alqahtani, W. , author Alshaya, J. , year 2024 . title Ransomware detection based on machine learning using memory features . journal Egyptian Informatics Journal volume 25 , pages 100445

    work page 2024

  5. [5]

    , author Algarni, A

    author Alraizza, A. , author Algarni, A. , year 2023 . title Ransomware detection using machine learning: A survey . journal Big Data and Cognitive Computing volume 7 , pages 143

    work page 2023

  6. [6]

    , author Wong, M.Y

    author Alrawi, O. , author Wong, M.Y. , author Avgetidis, A. , author Valakuzhy, K. , author Adjibi, B.V. , author Karakatsanis, K. , author Ahamad, M. , author Blough, D. , author Monrose, F. , author Antonakakis, M. , year 2024 . title Sok: An essential guide for using malware sandboxes in security applications: Challenges, pitfalls, and lessons learned...

    arXiv 2024

  7. [7]

    , author Shanker, R

    author Anand, C. , author Shanker, R. , year 2023 . title Advancing crypto ransomware with multi level extortion: A peril to critical infrastructure , in: booktitle 2023 2nd International Conference for Innovation in Technology (INOCON) , organization IEEE . pp. pages 1--5

    work page 2023

  8. [8]

    , author Zanero, S

    author Andronio, N. , author Zanero, S. , author Maggi, F. , year 2015 . title Heldroid: Dissecting and detecting mobile ransomware , in: booktitle Research in Attacks, Intrusions, and Defenses: 18th International Symposium, RAID 2015, Kyoto, Japan, November 2-4, 2015. Proceedings 18 , organization Springer . pp. pages 382--404

    work page 2015

Show all 82 references
  1. [9]

    , author Laskov, P

    author Apruzzese, G. , author Laskov, P. , author Tastemirova, A. , year 2022 . title Sok: The impact of unlabelled data in cyberthreat detection , in: booktitle 2022 IEEE 7th European Symposium on Security and Privacy (EuroS&P) , organization IEEE . pp. pages 20--42

    2022

  2. [10]

    , author Quiring, E

    author Arp, D. , author Quiring, E. , author Pendlebury, F. , author Warnecke, A. , author Pierazzi, F. , author Wressnegger, C. , author Cavallaro, L. , author Rieck, K. , year 2022 . title Dos and don'ts of machine learning in computer security , in: booktitle 31st USENIX Se...

    2022

  3. [11]

    , author Aziz, A

    author Ashraf, A. , author Aziz, A. , author Zahoora, U. , author Rajarajan, M. , author Khan, A. , year 2019 . title Ransomware analysis using feature engineering and deep neural networks . journal arXiv preprint arXiv:1910.00286

    2019 arXiv

  4. [12]

    , author Mekala, S.H

    author Baig, Z. , author Mekala, S.H. , author Zeadally, S. , year 2023 . title Ransomware attacks of the covid-19 pandemic: Novel strains, victims, and threat actors . journal IT Professional volume 25 , pages 37--44

    2023

  5. [13]

    , author Barkworth, A

    author Beaman, C. , author Barkworth, A. , author Akande, T.D. , author Hakak, S. , author Khan, M.K. , year 2021 . title Ransomware: Recent advances, analysis, challenges and future research directions . journal Computers & security volume 111 , pages 102490

    2021

  6. [14]

    , author Goodfellow, I

    author Bengio, Y. , author Goodfellow, I. , author Courville, A. , year 2017 . title Deep learning . volume volume 1 . publisher MIT press Cambridge, MA, USA

    2017

  7. [15]

    , author Ceschin, F

    author Botacin, M. , author Ceschin, F. , author Sun, R. , author Oliveira, D. , author Gr \'e gio, A. , year 2021 . title Challenges and pitfalls in malware research . journal Computers & Security volume 106 , pages 102287

    2021

  8. [16]

    , author Zhu, Y

    author Cai, L. , author Zhu, Y. , year 2015 . title The challenges of data quality and data quality assessment in the big data era . journal Data science journal volume 14 , pages 2--2

    2015

  9. [17]

    , author Botacin, M

    author Ceschin, F. , author Botacin, M. , author Bifet, A. , author Pfahringer, B. , author Oliveira, L.S. , author Gomes, H.M. , author Gr \'e gio, A. , year 2024 . title Machine learning (in) security: A stream of problems . journal Digital Threats: Research and Practice vol...

    2024

  10. [18]

    , author Chen, J

    author Chen, H. , author Chen, J. , author Ding, J. , year 2021 . title Data evaluation and enhancement for quality improvement of machine learning . journal IEEE Transactions on Reliability volume 70 , pages 831--847

    2021

  11. [19]

    O'Reilly Media, Inc

    author Chio, C. , author Freeman, D. , year 2018 . title Machine learning and security: Protecting systems with data and algorithms . publisher " O'Reilly Media, Inc."

    2018

  12. [20]

    , author Guagnelli, A

    author Continella, A. , author Guagnelli, A. , author Zingaro, G. , author De Pasquale, G. , author Barenghi, A. , author Zanero, S. , author Maggi, F. , year 2016 . title Shieldfs: a self-healing, ransomware-aware filesystem , in: booktitle Proceedings of the 32nd annual conf...

    2016

  13. [21]

    , author Mohri, M

    author Cortes, C. , author Mohri, M. , author Riley, M. , author Rostamizadeh, A. , year 2008 . title Sample selection bias correction theory , in: booktitle International conference on algorithmic learning theory , organization Springer . pp. pages 38--53

    2008

  14. [22]

    , author Bhattarai, M

    author Eren, M.E. , author Bhattarai, M. , author Joyce, R.J. , author Raff, E. , author Nicholas, C. , author Alexandrov, B.S. , year 2023 . title Semi-supervised classification of malware families under extreme class imbalance via hierarchical non-negative matrix factorizati...

    2023

  15. [23]

    , author Komninos, N

    author Fernando, D.W. , author Komninos, N. , year 2024 . title Fesad ransomware detection framework with machine learning using adaption to concept drift . journal Computers & Security volume 137 , pages 103629

    2024

  16. [24]

    , author Pieri, Z

    author Fisher, T. , author Pieri, Z. , author Howell, C.J. , author O’Malley, R. , author Tremblay, L. , author Dawoud, M. , year 2025 . title Vendor communication themes in darknet ransomware-as-a-service (raas) advertisements . journal Computers in Human Behavior volume 165 ...

    2025

  17. [25]

    , author Zahedi, M

    author Gao, H. , author Zahedi, M. , author Treude, C. , author Rosenstock, S. , author Cheong, M. , year 2024 . title Documenting ethical considerations in open source ai models , in: booktitle Proceedings of the 18th ACM/IEEE International Symposium on Empirical Software Eng...

    2024

  18. [26]

    , author Liu, G

    author Gong, Y. , author Liu, G. , author Xue, Y. , author Li, R. , author Meng, L. , year 2023 . title A survey on dataset quality in machine learning . journal Information and Software Technology volume 162 , pages 107268

    2023

  19. [27]

    , author Kakisim, A.G

    author Gulmez, S. , author Kakisim, A.G. , author Sogukpinar, I. , year 2024 . title Xran: Explainable deep learning-based ransomware detection using dynamic analysis . journal Computers & Security volume 139 , pages 103703

    2024

  20. [28]

    , author Tibshirani, R

    author Hastie, T. , author Tibshirani, R. , author Friedman, J. , year 2017 . title The elements of statistical learning: data mining, inference, and prediction

    2017

  21. [29]

    , author Garcia, E.A

    author He, H. , author Garcia, E.A. , year 2009 . title Learning from imbalanced data . journal IEEE Transactions on knowledge and data engineering volume 21 , pages 1263--1284

    2009

  22. [30]

    , author Hern \'a ndez- \'A lvarez, M

    author Herrera-Silva, J.A. , author Hern \'a ndez- \'A lvarez, M. , year 2023 . title Dynamic feature dataset for ransomware detection using machine learning algorithms . journal Sensors volume 23 , pages 1053

    2023

  23. [31]

    , author Hodota, R

    author Hirano, M. , author Hodota, R. , author Kobayashi, R. , year 2022 . title Ransap: An open dataset of ransomware storage access patterns for training machine learning models . journal Forensic Science International: Digital Investigation volume 40 , pages 301314

    2022

  24. [32]

    , author Kobayashi, R

    author Hirano, M. , author Kobayashi, R. , year 2025 . title Ransmap: Open dataset of ransomware storage and memory access patterns for creating deep learning based ransomware detectors . journal Computers & Security volume 150 , pages 104202

    2025

  25. [33]

    , author Kieseberg, P

    author Holzinger, A. , author Kieseberg, P. , author Tjoa, M. , author Weippl, E. , year 2019 . title Machine learning and knowledge extraction

    2019

  26. [34]

    , author Dehghantanha, A

    author Homayoun, S. , author Dehghantanha, A. , author Ahmadzadeh, M. , author Hashemi, S. , author Khayami, R. , year 2017 . title Know abnormal, find evil: frequent pattern mining for ransomware threat hunting and intelligence . journal IEEE transactions on emerging topics i...

    2017

  27. [35]

    , author Guo, L

    author Hou, Y. , author Guo, L. , author Zhou, C. , author Xu, Y. , author Yin, Z. , author Li, S. , author Sun, C. , author Jiang, Y. , year 2024 . title An empirical study of data disruption by ransomware attacks

    2024

  28. [36]

    , author Suarez-Tangil, G

    author Hurier, M. , author Suarez-Tangil, G. , author Dash, S.K. , author Bissyand \'e , T.F. , author Le Traon, Y. , author Klein, J. , author Cavallaro, L. , year 2017 . title Euphony: Harmonious unification of cacophonous anti-virus vendor labels for android malware , in: b...

    2017

  29. [37]

    , author Islam, M.R

    author Ispahany, J. , author Islam, M.R. , author Islam, M.Z. , author Khan, M.A. , year 2024 . title Ransomware detection using machine learning: A review, research limitations and future directions . journal IEEE Access

    2024

  30. [38]

    , author Razak, M.F.A

    author Jaya, M.I. , author Razak, M.F.A. , year 2022 . title Dynamic ransomware detection for windows platform using machine learning classifiers . journal JOIV: International Journal on Informatics Visualization volume 6 , pages 469--474

    2022

  31. [39]

    , author Chen, H

    author Jeremiah, S.R. , author Chen, H. , author Gritzalis, S. , author Park, J.H. , year 2024 . title Leveraging application permissions and network traffic attributes for android ransomware detection . journal Journal of Network and Computer Applications volume 230 , pages 103950

    2024

  32. [40]

    , author Traor \'e , I

    author Jethva, B. , author Traor \'e , I. , author Ghaleb, A. , author Ganame, K. , author Ahmed, S. , year 2020 . title Multilayer ransomware detection using grouped registry key operations, file entropy and file signature monitoring . journal Journal of Computer Security vol...

    2020

  33. [41]

    , author Li, G

    author Jiang, Y. , author Li, G. , author Li, S. , author Guo, Y. , year 2024 . title Benchmfc: A benchmark dataset for trustworthy malware family classification under concept drift . journal Computers & Security volume 139 , pages 103706

    2024

  34. [42]

    , author Amlani, D

    author Joyce, R.J. , author Amlani, D. , author Nicholas, C. , author Raff, E. , year 2023 . title Motif: A malware reference dataset with ground truth family labels . journal Computers & Security volume 124 , pages 102921

    2023

  35. [43]

    , year 2021

    author Kamolov, S. , year 2021 . title Feature selection: state-of-the-art survey . journal Annals of Mathematics and Computer Science volume 4 , pages 48--54

    2021

  36. [44]

    , author Tian, J

    author Kang, M. , author Tian, J. , year 2018 . title Machine learning: Data pre-processing . journal Prognostics and health management of electronics: fundamentals, machine learning, and the internet of things , pages 111--130

    2018

  37. [45]

    , author Gupta, A

    author Kapoor, A. , author Gupta, A. , author Gupta, R. , author Tanwar, S. , author Sharma, G. , author Davidson, I.E. , year 2021 . title Ransomware detection, avoidance, and mitigation scheme: A review and future directions . journal Sustainability volume 14 , pages 8

    2021

  38. [46]

    , author Mac Namee, B

    author Kelleher, J.D. , author Mac Namee, B. , author D'arcy, A. , year 2020 . title Fundamentals of machine learning for predictive data analytics: algorithms, worked examples, and case studies . publisher MIT press

    2020

  39. [47]

    , author Payne, B

    author Kerns, Q. , author Payne, B. , author Abegaz, T. , year 2022 . title Double-extortion ransomware: A technical analysis of maze ransomware , in: booktitle Proceedings of the Future Technologies Conference (FTC) 2021, Volume 3 , organization Springer . pp. pages 82--94

    2022

  40. [48]

    , author Mantovani, A

    author K \"u chler, A. , author Mantovani, A. , author Han, Y. , author Bilge, L. , author Balzarotti, D. , year 2021 . title Does every second count? time-based evolution of malware behavior in sandboxes , in: booktitle NDSS 2021, Network and Distributed Systems Security Symp...

    2021

  41. [49]

    , author Vella, M

    author Leguesse, Y. , author Vella, M. , author Ellul, J. , year 2018 . title Androneo: Hardening android malware sandboxes by predicting evasion heuristics , in: booktitle Information Security Theory and Practice: 11th IFIP WG 11.2 International Conference, WISTP 2017, Herakl...

    2018

  42. [50]

    , author Lu, S

    author Liu, K. , author Lu, S. , author Liu, C. , year 2014 . title Poster: Fingerprinting the publicly available sandboxes , in: booktitle Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security , pp. pages 1469--1471

    2014

  43. [51]

    , author Goschorska, M

    author Marcinkowski, B. , author Goschorska, M. , author Wile \'n ska, N. , author Siuta, J. , author Kajdanowicz, T. , year 2024 . title Mirad: A method for interpretable ransomware attack detection . journal IEEE Access

    2024

  44. [52]

    , author Kayes, A

    author McIntosh, T. , author Kayes, A. , author Chen, Y.P.P. , author Ng, A. , author Watters, P. , year 2021 . title Ransomware mitigation in the modern era: A comprehensive review, research challenges, and future directions . journal ACM Computing Surveys (CSUR) volume 54 , ...

    2021

  45. [53]

    , author Herbig, F.J

    author Minnaar, A. , author Herbig, F.J. , year 2021 . title Cyberattacks and the cybercrime threat of ransomware to hospitals and healthcare services during the covid-19 pandemic . journal Acta Criminologica: African Journal of Criminology & Victimology volume 34 , pages 155--185

    2021

  46. [54]

    , author Gimenez, P.F

    author Miranda, T.C. , author Gimenez, P.F. , author Lalande, J.F. , author Tong, V.V.T. , author Wilke, P. , year 2022 . title Debiasing android malware datasets: How can i trust your results if your dataset is biased? journal IEEE Transactions on Information Forensics and Se...

    2022

  47. [55]

    , author Moreira, D.C

    author Moreira, C.C. , author Moreira, D.C. , author Sales Jr, C. , year 2024 . title A comprehensive analysis combining structural features for detection of new ransomware families . journal Journal of Information Security and Applications volume 81 , pages 103716

    2024

  48. [56]

    , author de Sales Jr, C.d.S

    author Moreira, C.C. , author de Sales Jr, C.d.S. , author Moreira, D.C. , year 2022 . title Understanding ransomware actions through behavioral feature analysis . journal Journal of Communication and Information Systems volume 37 , pages 61--76

    2022

  49. [57]

    , author Khan, H

    author Nasir, M.S. , author Khan, H. , author Qureshi, A. , author Rafiq, A. , author Rasheed, T. , year 2024 . title Ethical aspects in cyber security maintaining data integrity and protection: A review . journal Spectrum of engineering sciences volume 2 , pages 420--454

    2024

  50. [58]

    title The cyber threat to uk businesses

    author National Cyber Security Centre , year 2018 . title The cyber threat to uk businesses

    2018

  51. [59]

    , author Jurcut, A.D

    author Onwuegbuche, F.C. , author Jurcut, A.D. , author Pasquale, L. , year 2023 . title Enhancing ransomware classification with multi-stage feature selection and data imbalance correction , in: booktitle International Symposium on Cyber Security, Cryptology, and Machine Lear...

    2023

  52. [60]

    , author Nissim, N

    author Or-Meir, O. , author Nissim, N. , author Elovici, Y. , author Rokach, L. , year 2019 . title Dynamic malware analysis in the modern era—a state of the art survey . journal ACM Computing Surveys (CSUR) volume 52 , pages 1--48

    2019

  53. [61]

    , author Pierazzi, F

    author Pendlebury, F. , author Pierazzi, F. , author Jordaney, R. , author Kinder, J. , author Cavallaro, L. , year 2019 . title \ TESSERACT \ : Eliminating experimental bias in malware classification across space and time , in: booktitle 28th USENIX security symposium (USENIX...

    2019

  54. [62]

    , author Almobaideen, W

    author Praveen, M. , author Almobaideen, W. , year 2023 . title The current state of research on malware written in the rust programming language , in: booktitle 2023 International Conference on Information Technology (ICIT) , organization IEEE . pp. pages 266--270

    2023

  55. [63]

    , author Coull, S

    author Rahman, M.S. , author Coull, S. , author Wright, M. , year 2022 . title On the limitations of continual learning for malware classification , in: booktitle Conference on Lifelong Learning Agents , organization PMLR . pp. pages 564--582

    2022

  56. [64]

    , author Narayan, V

    author Raj, A. , author Narayan, V. , author Muskan, V. , author Sani, A. , author Sharma, P. , author Sarma, S. , year 2024 . title Modern ransomware: Evolution, methodology, attack model, prevention and mitigation using multi-tiered approach . journal Security and Privacy vo...

    2024

  57. [65]

    , author Dietrich, C.J

    author Rossow, C. , author Dietrich, C.J. , author Grier, C. , author Kreibich, C. , author Paxson, V. , author Pohlmann, N. , author Bos, H. , author Van Steen, M. , year 2012 . title Prudent practices for designing malware experiments: Status quo and outlook , in: booktitle ...

    2012

  58. [66]

    , author Becker, K

    author Schwabe, D. , author Becker, K. , author Seyferth, M. , author Kla , A. , author Schaeffter, T. , year 2024 . title The metric-framework for assessing data quality for trustworthy ai in medicine: a systematic review . journal NPJ Digital Medicine volume 7 , pages 203

    2024

  59. [67]

    , author Rivera, R

    author Sebasti \'a n, M. , author Rivera, R. , author Kotzias, P. , author Caballero, J. , year 2016 . title Avclass: A tool for massive malware labeling , in: booktitle Research in Attacks, Intrusions, and Defenses: 19th International Symposium, RAID 2016, Paris, France, Sept...

    2016

  60. [68]

    , author Mu \ n oz-Gonz \'a lez, L

    author Sgandurra, D. , author Mu \ n oz-Gonz \'a lez, L. , author Mohsen, R. , author Lupu, E.C. , year 2016 . title Automated dynamic analysis of ransomware: Benefits, limitations and use for detection . journal arXiv preprint arXiv:1609.03020

    2016 arXiv

  61. [69]

    , author Shiravi, H

    author Shiravi, A. , author Shiravi, H. , author Tavallaee, M. , author Ghorbani, A.A. , year 2012 . title Toward developing a systematic approach to generate benchmark datasets for intrusion detection . journal computers & security volume 31 , pages 357--374

    2012

  62. [70]

    , author Bhoyar, K.K

    author Theng, D. , author Bhoyar, K.K. , year 2024 . title Feature selection techniques for machine learning: a survey of more than two decades of research . journal Knowledge and Information Systems volume 66 , pages 1575--1637

    2024

  63. [71]

    , author Pastrana, S

    author Thomas, D.R. , author Pastrana, S. , author Hutchings, A. , author Clayton, R. , author Beresford, A.R. , year 2017 . title Ethical issues in research using datasets of illicit origin , in: booktitle Proceedings of the 2017 Internet Measurement Conference , pp. pages 445--462

    2017

  64. [72]

    , author Chen, H

    author Tran, N. , author Chen, H. , author Bhuyan, J. , author Ding, J. , year 2022 . title Data curation and quality evaluation for machine learning-based cyber intrusion detection . journal IEEE Access volume 10 , pages 121900--121923

    2022

  65. [73]

    , author Al-rimy, B.A.S

    author Urooj, U. , author Al-rimy, B.A.S. , author Zainal, A. , author Ghaleb, F.A. , author Rassam, M.A. , year 2021 . title Ransomware detection using the dynamic analysis and machine learning: A survey and research directions . journal Applied Sciences volume 12 , pages 172

    2021

  66. [74]

    , author Zeng, V

    author Verma, R.M. , author Zeng, V. , author Faridi, H. , year 2019 . title Data quality for security challenges: Case studies of phishing, malware and intrusion detection datasets , in: booktitle Proceedings of the 2019 ACM SIGSAC conference on computer and communications se...

    2019

  67. [75]

    , author Wang, R.Y

    author Wand, Y. , author Wang, R.Y. , year 1996 . title Anchoring data quality dimensions in ontological foundations . journal Communications of the ACM volume 39 , pages 86--95

    1996

  68. [76]

    , author Strong, D.M

    author Wang, R.Y. , author Strong, D.M. , year 1996 . title Beyond accuracy: What data quality means to data consumers . journal Journal of management information systems volume 12 , pages 5--33

    1996

  69. [77]

    , author Holz, T

    author Willems, C. , author Holz, T. , author Freiling, F. , year 2007 . title Toward automated dynamic malware analysis using cwsandbox . journal IEEE Security & Privacy volume 5 , pages 32--39

    2007

  70. [78]

    , year 2023

    author Yaseen, Q.M. , year 2023 . title The effect of the ransomware dataset age on the detection accuracy of machine learning models . journal Information volume 14 , pages 193

    2023

  71. [79]

    , author Abdulazeez, A

    author Zebari, R. , author Abdulazeez, A. , author Zeebaree, D. , author Zebari, D. , author Saeed, J. , year 2020 . title A comprehensive review of dimensionality reduction techniques for feature selection and feature extraction . journal Journal of Applied Science and Techno...

    2020

  72. [80]

    , author Cheng, G

    author Zhou, Y. , author Cheng, G. , author Chen, Z. , author Yu, S. , year 2023 . title Malpurifier: Enhancing android malware detection with adversarial purification against evasion attacks . journal arXiv preprint arXiv:2312.06423

    2023 arXiv

  73. [81]

    , author Tu, F

    author Zhou, Y. , author Tu, F. , author Sha, K. , author Ding, J. , author Chen, H. , year 2024 . title A survey on data quality dimensions and tools for machine learning invited paper , in: booktitle 2024 IEEE International Conference on Artificial Intelligence Testing (AITe...

    2024

  74. [82]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.