Ransomware Detection on Various Ransomware Datasets
99.69AccuracyETW file I/O patterns + model-agnostic ML
Evaluation results
| Method | Links | |||
|---|---|---|---|---|
| ETW file I/O patterns + model-agnostic MLFeatures=ETW file I/O patterns + model-agnostic ML, Unlearning Support=No2026.07 | 99.69 | — | — | |
| Memory-forensics features + PSO-based ensembleFeatures=Memory-forensics features + PSO-based ensemble, Unlearning Support=No2026.07 | 99 | — | — | |
| API, DLL, and mutex traces + CNNFeatures=API, DLL, and mutex traces + CNN, Unlearning Support=No2026.07 | 98.2 | — | — | |
| System-call groups + RLR/RFFeatures=System-call groups + RLR/RF, Unlearning Support=No2026.07 | 97.48 | — | — | |
| Android permissions/network traffic + DRLFeatures=Android permissions/network traffic + DRL, Unlearning Support=No2026.07 | — | 91.2 | — | |
| DDQN-SISAFeatures=Dynamic behavioral features, Unlearning Support=Yes: Unlearning + Oracle + MIA2026.07 | — | 99.25 | — | |
| Dynamic behavioral features + CVAE-1D CNNFeatures=Dynamic behavioral features + CVAE-1D CNN, Unlearning Support=No2026.07 | — | 94.62 | — | |
| PE-header features + deep RLFeatures=PE-header features + deep RL, Unlearning Support=No2026.07 | — | 97.7 | — |