Pith. sign in

REVIEW 1 major objections 8 minor 56 references

SA-DRL: Security-Aware Deep Reinforcement Learning for Ransomware Detection with Asymmetric Reward Design

T0 review · 1 major / 8 minor · reviewed 2026-07-09 · glm-5.2

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Asymmetric rewards cut ransomware missed detections by 67%

desk verdict The within-DRL comparison is clean and well-validated; the headline cross-method comparison is confounded by mismatched cost ratios. read the letter →

arxiv 2607.06880 v1 pith:CXAT6APW submitted 2026-07-08 cs.CR

Jannatul Ferdous , Rafiqul Islam , Md Zahidul Islam This is my paper
classification cs.CR
keywords ransomwaredetectiondeepreinforcementlearningasymmetricrewarddesignfalse-negativeminimizationcost-sensitiveclassificationbehavioralmalwareanalysisDoubleDQNmodelselection
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that the standard practice of penalizing all classification errors equally is a fundamental mismatch for ransomware detection, where a missed attack causes irreversible data encryption and a false alarm merely triggers a reversible quarantine. The authors propose embedding this cost asymmetry directly into the reward signal of a deep reinforcement learning agent—penalizing a false negative four times more heavily than a false positive—so that the learning process itself is steered toward minimizing the most operationally catastrophic error. Across 480 controlled training runs comparing four DRL algorithms, two reward structures, four discount factors, and three random seeds, the asymmetric reward (R2) reduced the mean false-negative rate by 43% relative to the symmetric reward (R1), with the best configuration—Double DQN with a low discount factor of 0.1—achieving a false-negative rate of 0.80%, a 67.6% reduction compared to the best supervised baseline. The paper also introduces a Security-Optimal Model Selection (SOMS) criterion that lexicographically prioritizes minimum false-negative rate, then maximum F1-score, then minimum training time, arguing that model selection in security contexts must reflect operational risk hierarchy rather than aggregate accuracy.

What carries the argument

The key machinery is the interaction between three components: (1) the asymmetric reward function R2 with its 4:1 FN-to-FP penalty ratio, (2) the episodic MDP formulation with episode-level random permutation of training samples, which ensures that difficult ransomware samples triggering high-penalty updates receive reinforced corrective signals across diverse positional contexts, and (3) the DDQN architecture whose decoupled action-selection/action-evaluation reduces the Q-value overestimation that would otherwise be amplified under asymmetric penalties. The SOMS criterion provides the selection layer: a lexicographic ordering that first minimizes FNR, then maximizes F1, then minimizes wall

What would settle it

The core claim would be substantially weakened if a supervised classifier (e.g., MLP or Random Forest) trained with a class-weighted loss using the same 4:1 FN-to-FP cost ratio achieved a comparable or lower false-negative rate on the same dataset and cross-validation protocol. Such a result would suggest that the FNR reduction is attributable to the cost asymmetry itself—which supervised methods can encode via weighted loss—rather than to the reinforcement learning formulation, the episodic MDP structure, or the permutation mechanism.

Watch

Extended reading notes

Core claim

The central mechanism is the asymmetric reward function R2, which assigns a penalty of −2.0 for a false negative (missed ransomware) versus −0.5 for a false positive (benign false alarm), creating an effective optimization pressure ratio of approximately 2:1 toward avoiding missed detections over avoiding false alarms. When embedded into the TD-error updates of value-based DRL agents—particularly DDQN, which decouples action selection from value estimation to reduce Q-value overestimation bias—this asymmetric signal produces larger parameter updates for missed ransomware samples, functionally resembling adaptive sample weighting without explicit per-sample weight computation. The paper finds

Load-bearing premise

The paper assumes that formulating independent sample classification as a sequential MDP with episode-level random permutation provides a meaningful advantage over standard cost-sensitive supervised learning with class-weighted loss. However, the supervised baselines use a different cost ratio (5:1) than the DRL asymmetric reward (4:1), and no experiment directly compares DRL+R2 against supervised learning with a matched 4:1 cost ratio. This makes it impossible to isolate the

Editorial extensions

If this is right

  • If reward-function design is as consequential as the results suggest, then security-focused ML benchmarks should report FNR as a primary metric and evaluate detectors under multiple cost ratios rather than reporting aggregate accuracy alone.
  • The finding that lower discount factors (γ=0.1) outperform higher ones (γ=0.99) for this task implies that when classification decisions are effectively independent per sample, long-horizon credit assignment adds noise rather than signal—a principle that may extend to other i.i.d. classification tasks reformulated as sequential decision problems.
  • The episode-level permutation mechanism, which creates an implicit adaptive weighting effect through asymmetric TD-error magnitudes across shuffled sample orders, offers a parameter-free alternative to explicit class-weighting or focal loss that could be tested in other cost-sensitive domains.
  • The SOMS lexicographic selection protocol provides a template for deployment-oriented model selection in any domain where error types have unequal operational consequences, such as medical diagnosis, fraud detection, or autonomous safety systems.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper does not include a direct controlled comparison between DRL+R2 and supervised learning with a matched 4:1 cost-weighted loss (the baselines use a 5:1 ratio). If supervised methods with a matched cost ratio achieve similar FNR reductions, the unique contribution of the RL formulation—versus the cost asymmetry itself—would be substantially narrowed. This experiment would falsify or strengt
  • The 4:1 penalty ratio is described as 'conservatively' chosen and the paper notes it should be recalibrated for different operational environments. An ablation sweeping ratios (e.g., 2:1, 4:1, 8:1, 10:1) would reveal whether FNR reduction scales monotonically with penalty asymmetry or plateaus, and whether excessive ratios destabilize Q-value learning as the paper speculates.
  • The claim that episode-level random permutation produces 'adaptive sample weighting' is theoretically motivated but not empirically isolated. A controlled experiment comparing permutation against fixed ordering, while holding all else constant, would test whether this mechanism contributes measurably to the observed FNR reduction or is merely a regularization side-effect.
  • The single balanced dataset (1,000 ransomware, 1,000 benign) limits generalizability. Testing on naturally imbalanced corpora (where ransomware is rare) would reveal whether the 4:1 ratio remains effective or whether the penalty must scale with class prior, as the cost-asymmetry literature in imbalanced classification suggests.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

1 major / 8 minor

Summary. The paper proposes SA-DRL, a deep reinforcement learning framework for ransomware detection that embeds asymmetric false-negative/false-positive costs directly into the reward signal. Four DRL agents (DQN, DDQN, PPO, A2C) are evaluated under symmetric (R1) and asymmetric (R2) rewards across 480 controlled training runs with 5-fold cross-validation and three seeds. A Security-Optimal Model Selection (SOMS) criterion prioritizes FNR minimization. The SOMS-selected DDQN with R2 and gamma=0.1 achieves FNR=0.0080, a 67.6% reduction relative to the best supervised baseline (MLP, FNR=0.0247). The within-DRL comparison (R2 vs R1) is well-designed and statistically validated via Friedman and Wilcoxon tests. The cross-method comparison against supervised baselines is confounded by mismatched cost ratios.

Significance. The paper addresses a genuine operational gap in ransomware detection: symmetric loss functions do not reflect the asymmetric consequences of false negatives (irreversible encryption) versus false positives (reversible alerts). The experimental rigor is a notable strength—480 runs, stratified cross-validation, multiple seeds, and non-parametric statistical validation are above the norm for this area. The within-DRL ablation (Table 10) cleanly isolates the reward function effect with all other variables fixed, and the Wilcoxon tests (Table 11) confirm statistical significance. The SOMS criterion is a reasonable contribution toward security-first model selection. However, the headline comparative claim against supervised baselines rests on a confounded experimental design that needs to be addressed.

major comments (1)
  1. Section 3.6 and Table 9: The headline 67.6% FNR reduction of DDQN+R2 over the best supervised baseline (MLP) rests on a confounded comparison. The DRL asymmetric reward R2 uses a 4:1 FN:FP penalty ratio (Section 3.3.2, Eq. 23: -2.0 for FN, -0.5 for FP), while the supervised baselines use class weights wFN=5.0, wFP=1.0 (Section 3.6), a 5:1 ratio. These are different cost ratios applied through different mechanisms. The paper states this ensures 'comparisons reflected genuine modeling differences rather than evaluation asymmetries,' but it introduces a confound: we cannot determine whether DDQN's lower FNR stems from the RL formulation itself or from the different cost ratio. To support the central comparative claim, the authors should either (a) run supervised baselines with a matched 4:1 cost ratio, (b) run DRL with a 5:1 ratio to match the baselines, or (c) sweep both cost ratios and报告.
minor comments (8)
  1. Table 1: The family counts sum to 1000 but some families have very few samples (e.g., BlueSky=8, Mallox=10). With 5-fold CV, some folds may contain only 1-2 samples from these families. The paper should note this potential instability.
  2. Section 3.1.2: The paper states 'approximately 11,000 raw telemetry attributes' were reduced to 103 features via 'domain-guided feature engineering.' The specific feature selection criteria are not described. Providing the list of selected features or the selection methodology would improve reproducibility.
  3. Table 3: The learning rates differ across algorithms (1e-3 for DQN/DDQN, 3e-4 for PPO, 7e-4 for A2C). Were these tuned per algorithm? If so, the tuning protocol should be described; if not, the rationale for these specific values should be given, as they affect the cross-algorithm comparison.
  4. Section 5.4: The claim that 'lower discount factors prioritize immediate classification outcomes' is reasonable, but the paper could note that this finding is specific to the episodic i.i.d. formulation used here and may not generalize to RL-based detection with true temporal dependencies. A brief note would strengthen this claim.
  5. Table 12: The comparison with prior work is useful but mixes metrics (some report accuracy, some F1, some FNR). The table would be clearer if all metrics were converted to a common set, or if missing metrics were explicitly marked as 'not applicable' rather than '–'.
  6. Section 6: The paper acknowledges that the evaluation is confined to a single balanced dataset of 2,000 samples. This is a significant limitation given that real-world ransomware detection involves severe class imbalance. The authors should discuss how the 4:1 ratio and the RL formulation might behave under imbalance, not only in limitations but also in the discussion of deployment.
  7. Figure 8: The heatmap is informative but the color scale could be improved—some cells are difficult to distinguish. Consider using a diverging colormap or annotating each cell with the exact value.
  8. The paper uses 'adaptive sample weighting' to describe the episode-level permutation mechanism (Section 3.2.8). This terminology may overstate the effect: random permutation removes order bias but does not explicitly weight difficult samples. The mechanism is better described as 'order randomization with implicit emphasis on high-penalty samples.'

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity detected: reward function defined independently, FNR measured on held-out data, SOMS is a selection rule not a derivation

full rationale

The paper's derivation chain is self-contained and non-circular. (1) The asymmetric reward R2 (Eq. 23: FN penalty -2.0, FP penalty -0.5) is defined independently from operational cost estimates cited from external sources (Sophos, Verizon DBIR), not from the experimental outcomes. The 4:1 ratio is acknowledged as a design choice, not a fitted parameter. (2) The within-DRL comparison (R2 vs R1, Table 11) measures FNR on held-out test folds and validates with Wilcoxon tests — the prediction (lower FNR under R2) is not forced by construction. (3) The SOMS criterion (Eq. 33) is a lexicographic selection rule applied to empirical results; it does not define or constrain the results it selects from. (4) The episode-level permutation mechanism (Section 3.2.8) is described as providing 'implicit adaptive sample weighting,' but this is an emergent-behavior claim verified empirically, not a definitional identity. (5) Self-citations (refs [13-16] by Ferdous et al.) appear in related-work and context sections, not as load-bearing mathematical premises. The confounded cross-method comparison (DRL 4:1 ratio vs supervised 5:1 ratio) is a methodological weakness — an uncontrolled variable — but it is not circularity: the output (DDQN's FNR=0.0080) is not defined in terms of the input (the reward function), and the comparison does not reduce to a tautology. The paper is an empirical study with independently defined components and externally measured outcomes.

Assumptions & free parameters 7 free parameters · 4 assumptions · 0 invented entities

The paper introduces no new entities, particles, or physical constructs. The free parameters are reward magnitudes and standard RL hyperparameters. The ad-hoc axioms concern the MDP formulation suitability and the 4:1 ratio choice, both of which are paper-specific design decisions rather than established domain facts.

free parameters (7)
  • FN penalty (R2) = -2.0
    Chosen to reflect operational cost asymmetry; described as 'deliberately conservative' relative to real-world estimates. Not fitted to data but selected by hand.
  • FP penalty (R2) = -0.5
    Set to create a 4:1 FN:FP ratio. The ratio is justified by operational cost arguments but not empirically optimized.
  • Correct classification reward = 1.0
    Standard positive reward for correct predictions in both R1 and R2.
  • Discount factors = {0.1, 0.5, 0.9, 0.99}
    Four values evaluated as a hyperparameter sweep; gamma=0.1 selected as optimal.
  • Total training timesteps = 10000
    Fixed across all experiments; no justification provided for this specific value.
  • Network architecture = 2x[64] ReLU
    Same architecture for all four DRL agents; no architecture search performed.
  • Learning rates = varies by agent
    DQN/DDQN: 1e-3, PPO: 3e-4, A2C: 7e-4. Standard values, not tuned.
assumptions (4)
  • domain assumption False negatives are operationally more costly than false positives in ransomware detection
    Core premise stated in Section 1 and 3.3; supported by operational cost estimates cited from industry reports.
  • ad hoc to paper A 4:1 FN:FP penalty ratio adequately captures this operational asymmetry
    Section 3.3.2 acknowledges the ratio is 'deliberately conservative' and not empirically derived; it is specific to this dataset and study.
  • ad hoc to paper Formulating independent sample classification as a sequential MDP is a valid and beneficial RL formulation
    Section 3.2 defines the MDP where transitions are deterministic (Eq. 14) and independent of actions. The advantage over standard supervised learning is assumed, not proven.
  • ad hoc to paper Episode-level random permutation provides implicit adaptive sample weighting
    Section 3.2.8 claims this mechanism resembles adaptive weighting without explicit computation, but the claim is theoretical and not empirically isolated from standard epoch shuffling.

how reviews work

0 comments
Cite this review

Pith. "Pith review of SA-DRL: Security-Aware Deep Reinforcement Learning for Ransomware Detection with Asymmetric Reward Design." pith.science (2026). https://pith.science/paper/CXAT6APW

@misc{pith2026260706880,
  author       = {Pith},
  title        = {Pith review of: SA-DRL: Security-Aware Deep Reinforcement Learning for Ransomware Detection with Asymmetric Reward Design},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/CXAT6APW}},
  note         = {Machine review of arXiv:2607.06880}
}
read the original abstract

Ransomware detection is a security-critical task in which false negatives and false positives have unequal operational consequences. Conventional machine learning detectors often use symmetric objectives that penalize missed ransomware detections and benign false alarms equally, although a false negative can cause irreversible encryption, operational disruption, and high recovery cost, whereas a false positive is usually reversible. This study proposes a Security-Aware Deep Reinforcement Learning (SA-DRL) framework that embeds false-negative and false-positive cost asymmetry into the reinforcement learning reward signal to prioritize missed-detection reduction. The framework also introduces a Security-Optimal Model Selection (SOMS) criterion and an adaptive episode-level sample-ordering mechanism. Four deep reinforcement learning agents, DQN, DDQN, PPO, and A2C, were evaluated using a symmetric baseline reward (R1) and a security-aware asymmetric reward (R2). Experiments used four discount factors, five-fold cross-validation, and three random seeds, resulting in 480 training runs on a balanced ransomware detection dataset. The SOMS criterion selects models by prioritizing false-negative rate, followed by F1-score and training time. Results show that asymmetric reward shaping improves security-oriented detection performance. The SOMS-selected configuration, DDQN with R2 and gamma = 0.1, achieved a false-negative rate of 0.0080, an F1-score of 0.9915, and an AUC of 0.998, reducing missed detections by 67.6% compared with the best supervised baseline. Across all configurations, R2 reduced the mean false-negative rate by 43% relative to R1. These findings show that reward-function design is important for security-sensitive ransomware detection.

Figures

Figures reproduced from arXiv: 2607.06880 by the authors.

Figure 1
Figure 1. Workflow of the proposed SA-DRL framework for ransomware detection. The pipeline begins with balanced behavioral features, applies episode-level random permutation, constructs state representations, and trains DRL agents under symmetric and asymmetric reward settings. Following sequential state transitions and episode termination, model performance is evaluated, and the final configuration is selected using the prop… view at source ↗
Figure 3
Figure 3. Confusion matrix of the security-optimal DDQN [PITH_FULL_IMAGE:figures/full_fig_p014_3.png] view at source ↗
Figure 4
Figure 4. Score-based ROC curves for four DRL agents ( [PITH_FULL_IMAGE:figures/full_fig_p015_4.png] view at source ↗
Figures from the paper (4 more)
Figure 6
Figure 6. Figure 6: Training and inference time comparison on a logarithmic scale across all DRL agents and supervised baselines (𝑅2 , 𝛾 = 0.1). DRL models require 9.96–16.04 s training time, whereas LR and MLP are substantially faster but exhibit higher FNR, limiting their suitability fo…
Figure 7
Figure 7. Figure 7: compares the mean FNR of DDQN, DQN, PPO, and A2C under the symmetric reward function (𝑅1 ) and the security-aware asymmetric reward function (𝑅2 ), averaged across all seeds and 𝛾 values using the best configurations in Tables 1–3. The blue bars represent 𝑅1 , whereas …
Figure 8
Figure 8. Figure 8: Mean FNR across all 32 configurations (four agents × two rewards × four discount factors), averaged over five-fold cross￾validation and three seeds. Green cells indicate low missed-detection risk, whereas red cells indicate high risk. 𝑅2 configurations consistently pro…
Figure 9
Figure 9. Figure 9: Statistical validation of DRL agent performance. Panel (a) shows Wilcoxon signed-rank post-hoc comparisons plotted as − log10(𝑝) values for all six pairwise comparisons. The dashed vertical line indicates the 𝑝 = 0.001 significance threshold. Panel (b) summarizes the F…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

56 extracted references · 56 canonical work pages

  1. [1]

    ANY.RUNinteractivemalwarehuntingservice

    ,2025. ANY.RUNinteractivemalwarehuntingservice. URL:https: //anyrun.uk/. accessed: Dec. 28, 2025

    work page 2025

  2. [2]

    Narrowed sights, bigger payoffs: Ransomware in 2019

    A., J., Ang, M., 2019. Narrowed sights, bigger payoffs: Ransomware in 2019. Trend Micro. URL:https://www.trendmicro. com/vinfo/au/security/news/cybercrime-and-digital-threats/ narrowed-sights-bigger-payoffs-ransomware-in-2019. accessed: Oct. 01, 2024

    work page 2019

  3. [3]

    MalwareBazaar database

    abuse.ch, . MalwareBazaar database. URL:https://bazaar.abuse. ch/browse/. accessed: Jun. 02, 2024

    work page 2024

  4. [4]

    The state of ransomware 2025

    Adam, S., 2025. The state of ransomware 2025. Sophos. URL: https://www.sophos.com/en-us/blog/the-state-of-ransomware-2025. accessed: May 02, 2026

    work page 2025

  5. [5]

    IEEE Access 13, 53159–53170

    AdnanAlvi,M.,Jalil,Z.,2025. Xrguard:Amodel-agnosticapproach to ransomware detection using dynamic analysis and explainable ai. doi:10.1109/ACCESS.2025.3553562

    work page doi:10.1109/access.2025.3553562 2025

  6. [6]

    Deep q- learningbasedreinforcementlearningapproachfornetworkintrusion detection

    Alavizadeh, H., Alavizadeh, H., Jang-Jaccard, J., 2022. Deep q- learningbasedreinforcementlearningapproachfornetworkintrusion detection. Computers 11, 41. doi:10.3390/computers11030041

    work page doi:10.3390/computers11030041 2022

  7. [7]

    Machine learning-based static ran- somware detection using pe header features and shap interpretation

    Barnes, G., Ghafarian, A., 2026. Machine learning-based static ran- somware detection using pe header features and shap interpretation. JournalofCybersecurityandPrivacy6. URL:https://www.mdpi.com/ 2624-800X/6/2/58, doi:10.3390/jcp6020058

    work page doi:10.3390/jcp6020058 2026

  8. [8]

    Reward shaping for hap- pier autonomous cyber security agents, Association for Computing Machinery, New York, NY, USA

    Bates, E., Mavroudis, V., Hicks, C., 2023. Reward shaping for hap- pier autonomous cyber security agents, Association for Computing Machinery, New York, NY, USA. URL:https://doi.org/10.1145/ 3605764.3623916, doi:10.1145/3605764.3623916

    work page doi:10.1145/3605764.3623916 2023

Show all 56 references
  1. [9]

    Ransoguard: A rnn-based framework leveraging pre-attack sensitive apis for early ransomware detection

    Cen, M., Jiang, F., Doss, R., 2025. Ransoguard: A rnn-based framework leveraging pre-attack sensitive apis for early ransomware detection. Computers& Security 150, 104293. URL:https: //www.sciencedirect.com/science/article/pii/S0167404824005996, doi:10.1016/j.cose.2024.104293

    2025 doi

  2. [10]

    Image-based malware rep- resentation approach with efficientnet convolutional neural networks for effective malware classification

    Chaganti, R., Ravi, V., Pham, T.D., 2022. Image-based malware rep- resentation approach with efficientnet convolutional neural networks for effective malware classification. Journal of Information Security and Applications 69, 103306. doi:10.1016/j.jisa.2022.103306

    2022 doi

  3. [11]

    Statistical comparisons of classifiers over multiple data sets

    Demšar, J., 2006. Statistical comparisons of classifiers over multiple data sets. Journal of Machine Learning Research 7, 1–30. URL: https://jmlr.org/papers/v7/demsar06a.html

    2006

  4. [12]

    Ransomwareearlydetec- tionusingdeepreinforcementlearningonportableexecutableheader

    Deng,X.,Cen,M.,Jiang,M.,Lu,M.,2024. Ransomwareearlydetec- tionusingdeepreinforcementlearningonportableexecutableheader. Cluster Computing 27, 1867–1881. doi:10.1007/s10586-023-04043-5

    2024 doi

  5. [13]

    Privacy-aware machine unlearning with sisa for reinforcement learning-based ransomware detection

    Ferdous, J., Islam, R., Islam, M.Z., 2026a. Privacy-aware machine unlearning with sisa for reinforcement learning-based ransomware detection

  6. [14]

    Anoveltech- nique for ransomware detection using image based dynamic features andtransferlearningtoaddressdatasetlimitations

    Ferdous,J.,Islam,R.,Mahboubi,A.,Islam,M.Z.,2025. Anoveltech- nique for ransomware detection using image based dynamic features andtransferlearningtoaddressdatasetlimitations. ScientificReports

    2025

  7. [15]

    doi:10.1038/s41598-025-17647-1

    doi

  8. [16]

    Tl-rl- fusionnet: An adaptive and efficient reinforcement learning-driven transfer learning framework for detecting evolving ransomware threats

    Ferdous, J., Islam, R., Mahboubi, A., Islam, M.Z., 2026b. Tl-rl- fusionnet: An adaptive and efficient reinforcement learning-driven transfer learning framework for detecting evolving ransomware threats

  9. [17]

    Ai- based ransomware detection: A comprehensive review

    Ferdous, J., Islam, R., Mahboubi, A., Zahidul Islam, M., 2024. Ai- based ransomware detection: A comprehensive review. IEEE Access 12, 136666–136695. doi:10.1109/ACCESS.2024.3461965

    2024 doi

  10. [18]

    Xran: Explainable deep learning-based ransomware detection using dynamic analysis

    Gulmez, S., Gorgulu Kakisim, A., Sogukpinar, I., 2024. Xran: Explainable deep learning-based ransomware detection using dynamic analysis. Computers & Security 139, 103703. URL:https: //www.sciencedirect.com/science/article/pii/S016740482400004X, doi:10.1016/j.cose.2024.103703

    2024 doi

  11. [19]

    React-d3qn: resilientadaptiveconcept-drift-awareduelingdoubledeepq-network for robust edge-centric intrusion detection

    Haddane, I., Hirchoua, B., Moutachaouik, H., 2026. React-d3qn: resilientadaptiveconcept-drift-awareduelingdoubledeepq-network for robust edge-centric intrusion detection. Cybersecurity 9, 130. doi:10.1186/s42400-026-00558-7

    2026 doi

  12. [20]

    Ransomware behavioural analysis on windows platforms

    Hampton, N., Baig, Z., Zeadally, S., 2018. Ransomware behavioural analysis on windows platforms. Journal of Information Security and Applications 40, 44–51. URL:https://www.sciencedirect. Ferdous et al.:Preprint submitted to ElsevierPage 21 of 22 SA-DRL for Ransomware Detectio...

    2018

  13. [21]

    Dynamic feature dataset for ransomware detection using machine learning algorithms

    Herrera-Silva, J.A., Hernández-Álvarez, M., 2023. Dynamic feature dataset for ransomware detection using machine learning algorithms. Sensors 23, 1053. doi:10.3390/s23031053

    2023 doi

  14. [22]

    Hsu, C.M., Yang, C.C., Cheng, H.H., Setiasabda, P.E., Leu, J.S.,

  15. [23]

    IEEE Access 9, 138345–138351

    Enhancing file entropy analysis to improve machine learning detection rate of ransomware. IEEE Access 9, 138345–138351. doi:10.1109/ACCESS.2021.3114148

    2021 doi

  16. [24]

    Ransomware detection and family classification using fine-tuned bert and roberta models

    Hussain, A., Saadia, A., Alserhani, F.M., 2025. Ransomware detection and family classification using fine-tuned bert and roberta models. Egyptian Informatics Journal 30, 100645. URL:https: //www.sciencedirect.com/science/article/pii/S1110866525000386, doi:https://doi.org/10.10...

    2025 doi

  17. [25]

    Two-stage ransomware detection using dynamic analysis and machine learning techniques

    Hwang, J., Kim, J., Lee, S., Kim, K., 2020. Two-stage ransomware detection using dynamic analysis and machine learning techniques. Wireless Personal Communications 112, 2597–2609. doi:10.1007/ s11277-020-07166-9

    2020

  18. [26]

    Ibrahim, S., Mostafa, M., Jnadi, A., Salloum, H., Osinenko, P.,

  19. [27]

    IEEE Access 12, 175473–175500

    Comprehensive overview of reward engineering and shaping in advancing reinforcement learning applications. IEEE Access 12, 175473–175500. doi:10.1109/ACCESS.2024.3504735

    2024 doi

  20. [28]

    DikeDataset

    Iosifache, 2023. DikeDataset. URL:https://github.com/iosifache/ DikeDataset/tree/main/files/benign. accessed: Jul. 16, 2024

    2023

  21. [29]

    Beyond reinforcement learning for network security: A comprehen- sive survey and tutorial

    Javadpour, A., Ja’fari, F., Taleb, T., Turkmen, F., Benzaïd, C., 2026. Beyond reinforcement learning for network security: A comprehen- sive survey and tutorial. Journal of Information Security and Appli- cations 96, 104294. doi:10.1016/j.jisa.2025.104294

    2026 doi

  22. [30]

    A digital dna sequencing engine for ransomware detection using machine learning

    Khan, F., Ncube, C., Ramasamy, L.K., Kadry, S., Nam, Y., 2020. A digital dna sequencing engine for ransomware detection using machine learning. IEEE Access 8, 119710–119719. doi:10.1109/ ACCESS.2020.3003785

    2020

  23. [31]

    Adversarial robustness of deep reinforcement learning-based intrusion detection

    Merzouk, M.A., Neal, C., Delas, J., Yaich, R., Boulahia-Cuppens, N., Cuppens, F., 2024. Adversarial robustness of deep reinforcement learning-based intrusion detection. International Journal of Informa- tion Security 23, 3625–3651. doi:10.1007/s10207-024-00903-2

    2024 doi

  24. [32]

    Deep sarsa-based reinforcement learning approach for anomaly network intrusion detection system

    Mohamed, S., Ejbali, R., 2023. Deep sarsa-based reinforcement learning approach for anomaly network intrusion detection system. International Journal of Information Security 22, 235–247. doi:10. 1007/s10207-022-00634-2

    2023

  25. [33]

    de Sales Jr., C., 2023

    Moreira, C.C., Moreira, D.C., de S. de Sales Jr., C., 2023. Improving ransomware detection based on portable executable header using xception convolutional neural network. Computers & Security 130, 103265. URL:https://www.sciencedirect.com/science/article/pii/ S016740482300175...

    2023 doi

  26. [34]

    A comprehen- sive analysis combining structural features for detection of new ran- somware families

    Moreira, C.C., Moreira, D.C., Sales Jr, C., 2024. A comprehen- sive analysis combining structural features for detection of new ran- somware families. Journal of Information Security and Applications 81, 103716

    2024

  27. [35]

    Cybersecurity ventures 2025 ransomware report

    Morgan, S., 2025. Cybersecurity ventures 2025 ransomware report. Cybersecurity Ventures. URL:https://cybersecurityventures.com/ global-ransomware-damage-costs-predicted-to-reach-250-billion-usd-by-2031/. accessed: May 02, 2026

    2025

  28. [36]

    Limits of static analysis for malware detection, in: Twenty-third annual computer security applications conference (ACSAC 2007), IEEE

    Moser, A., Kruegel, C., Kirda, E., 2007. Limits of static analysis for malware detection, in: Twenty-third annual computer security applications conference (ACSAC 2007), IEEE. pp. 421–430. doi:10. 1109/ACSAC.2007.21

    2007

  29. [37]

    A State-of-the- Art Survey on Ransomware Detection using Machine Learning and Deep Learning

    Moujoud, L., Ayache, M., Belmekki, A., 2023. A State-of-the- Art Survey on Ransomware Detection using Machine Learning and Deep Learning. Springer Nature Switzerland. doi:10.1007/ 978-3-031-33309-5_15

    2023

  30. [38]

    Deep reinforcement learning for cyber security

    Nguyen, T.T., Reddi, V.J., 2023. Deep reinforcement learning for cyber security. IEEE Transactions on Neural Networks and Learning Systems 34, 3779–3795. doi:10.1109/TNNLS.2021.3121870

    2023 doi

  31. [39]

    Ml- ran: A behavioural dataset for ransomware analysis and detec- tion

    Onwuegbuche, F.C., Adelodun, S.O., Jurcut, A.D., 2026. Ml- ran: A behavioural dataset for ransomware analysis and detec- tion. Journal of Network and Computer Applications 250, 104475. URL:https://www.sciencedirect.com/science/article/pii/ S1084804526000500, doi:10.1016/j.jnca...

    2026 doi

  32. [40]

    A survey on ransomware: Evolution, taxonomy, and defense solutions

    Oz, H., Aris, A., Levi, A., Uluagac, A.S., 2022. A survey on ransomware: Evolution, taxonomy, and defense solutions. ACM Computing Surveys (CSUR) 54, 1–37. URL:https://doi.org/10. 1145/3514229, doi:10.1145/3514229

    2022 doi

  33. [41]

    Unit 42 ransomware threat report

    Palo Alto Networks, 2020. Unit 42 ransomware threat report. URL:https://start.paloaltonetworks.com/ unit-42-ransomware-threat-report.html. accessed: Sep. 10, 2024

    2020

  34. [42]

    Portable app directory

    PortableApps, 2024. Portable app directory. URL:https:// portableapps.com/apps. accessed: Jul. 10, 2024

    2024

  35. [43]

    Automateddynamicanalysisofransomware:Benefits,limitationsand use for detection

    Sgandurra, D., Muñoz-González, L., Mohsen, R., Lupu, E.C., 2016. Automateddynamicanalysisofransomware:Benefits,limitationsand use for detection. arXiv preprint. URL:http://arxiv.org/abs/1609. 03020. online; accessed via arXiv link

    2016

  36. [44]

    Sharmeen, S., Ahmed, Y.A., Huda, S., Koçer, B.Ş., Hassan, M.M.,

  37. [45]

    IEEE Access 8, 24522–24534

    Avoiding future digital extortion through robust protection against ransomware threats using deep learning based adaptive ap- proaches. IEEE Access 8, 24522–24534. doi:10.1109/ACCESS.2020. 2970466

    2020 doi

  38. [46]

    What is cuckoo sandbox? URL:https:// cuckoosandbox.org/about.html

    Sick, T.P., 2024. What is cuckoo sandbox? URL:https:// cuckoosandbox.org/about.html. accessed: Dec. 28, 2025

    2024

  39. [47]

    Popular freeware categories

    SnapFiles, 1997. Popular freeware categories. URL:https://www. snapfiles.com/freeware/. accessed: Jul. 06, 2024

    1997

  40. [48]

    Maturing criminal marketplaces present new chal- lenges to defenders

    Sophos, 2023. Maturing criminal marketplaces present new chal- lenges to defenders. Sophos 2023 Threat Report. URL:https:// www.scribd.com/document/628559505/Sophos-Threat-Report-2023. ac- cessed: Sep. 21, 2024

    2023

  41. [49]

    The Ransomware Threat Landscape

    Symantec, 2023. The Ransomware Threat Landscape. doi:10.2307/ j.ctv1f8xc7v

    2023

  42. [50]

    Phobos emerges as a formidable threat in Q1 2024, LockBit stays in the top spot

    Trend Micro, 2024. Phobos emerges as a formidable threat in Q1 2024, LockBit stays in the top spot. URL:https://www. trendmicro.com/vinfo/au/security/news/ransomware-by-the-numbers/ phobos-emerges-as-a-formidable-threat-in-q1-2024-lockbit-stays-in-the-top-spot. accessed: Oct. 12, 2024

    2024

  43. [51]

    2025 Data Breach Inves- tigations Report

    Verizon Data Team, 2025. 2025 Data Breach Inves- tigations Report. Technical Report. Verizon. URL: https://www.verizon.com/business/resources/T16f/reports/ 2025-dbir-data-breach-investigations-report.pdf. accessed: May 02, 2026

    2025

  44. [52]

    VirusShare.com — because sharing is caring

    VirusShare, 2025. VirusShare.com — because sharing is caring. URL:https://virusshare.com/. accessed: Jun. 07, 2024

    2025

  45. [53]

    Ransomware detection using deep learning based unsuper- visedfeatureextractionandacostsensitiveparetoensembleclassifier

    Zahoora, U., Khan, A., Rajarajan, M., Khan, S.H., Asam, M., Jamal, T., 2022. Ransomware detection using deep learning based unsuper- visedfeatureextractionandacostsensitiveparetoensembleclassifier. Scientific reports 12, 15647. doi:10.1038/s41598-022-19443-7

    2022 doi

  46. [54]

    Classification of ransomware families with machine learning based onn-gram of opcodes

    Zhang, H., Xiao, X., Mercaldo, F., Ni, S., Martinelli, F., Sangaiah, A.K., 2019. Classification of ransomware families with machine learning based onn-gram of opcodes. Future Generation Computer Systems 90, 211–221. doi:10.1016/j.future.2018.07.052

    2019 doi

  47. [55]

    Exploringtheransomwareecosystemandtheactivedefenseconcept: Review of attacks and defense

    Zhao, L., Wang, Z., Wang, S., Zhang, Y., Hou, R., Meng, D., 2025. Exploringtheransomwareecosystemandtheactivedefenseconcept: Review of attacks and defense. Journal of Information Security and Applications 94, 104171. doi:10.1016/j.jisa.2025.104171

    2025 doi

  48. [56]

    Zscaler: 2022 ThreatLabz state of ransomware re- port

    Zscaler, 2022. Zscaler: 2022 ThreatLabz state of ransomware re- port. URL:https://www.zscaler.com/resources/industry-reports/ 2022-threatlabz-ransomware-report.pdf. accessed: Oct. 12, 2024. Ferdous et al.:Preprint submitted to ElsevierPage 22 of 22

    2022

Pith tools

Reviewed July 9, 2026 · model on record in the stance chip above.