{"id":"W2989588798","doi":"10.3233/jcs-191346","title":"Multilayer ransomware detection using grouped registry key operations, file entropy and file signature monitoring","year":2019,"lang":"en","type":"article","venue":"Journal of Computer Security","topic":"Advanced Malware Detection Techniques","field":"Computer Science","cited_by":52,"is_retracted":false,"has_abstract":true,"ca_institutions":"University of Windsor; University of Victoria","funders":"","keywords":"Ransomware; Computer science; Encryption; Signature (topology); Data mining; Entropy (arrow of time); Key (lock); Computer security; Malware; Mathematics","routes":{"ca_aff":true,"ca_fund":false,"ca_venue":false,"about_ca":false,"invisible_to_affiliation_only":false},"retraction":null,"screen":null,"direct_labels":[],"prediction":{"model_version":"metacan-v3-hybrid-931329e0061c","candidate_categories":[],"consensus_categories":[],"category_scores_codex":[0.0006151171,0.001065116,0.0008978068,0.002754186,0.0002783291,0.0008644167,0.0007163826,0.0005454143,0.0007795101],"category_scores_gemma":[0.003068247,0.000211142,0.000673895,0.001332845,0.000413171,0.001858997,0.0008462314,0.00053804,0.0007525707],"about_ca_system_candidate":false,"about_ca_system_consensus":false,"about_ca_system_score_codex":0.0004683162,"about_ca_system_score_gemma":0.0004295732,"about_ca_topic_candidate":false,"about_ca_topic_consensus":false,"about_ca_topic_score_codex":0.002617462,"about_ca_topic_score_gemma":0.003249463,"domain_scores_codex":[0.9989597,0.0001137074,0.00008563103,0.0002446283,0.0004331679,0.000163278],"domain_scores_gemma":[0.9983719,0.0002684285,0.000590796,0.0003085347,0.0003730392,0.00008743119],"domain_codex":null,"domain_gemma":null,"domain_candidate":null,"domain_consensus":null,"study_design_codex":"design_other","study_design_gemma":"simulation_or_modeling","study_design_scores_codex":[0.001103515,0.0005622921,0.1381564,0.0001964411,0.0002285473,0.001115342,0.0003295969,0.1144946,0.0539707,0.002988583,0.004710278,0.6821437],"study_design_scores_gemma":[0.000008301985,0.0002414516,0.04706631,0.00002432352,0.000050311,0.0008913192,0.0001393026,0.9220191,0.0264339,0.001348732,0.001724811,0.00005213458],"study_design_candidate":"simulation_or_modeling","study_design_consensus":null,"genre_codex":"empirical","genre_gemma":"empirical","genre_scores_codex":[0.5900947,0.0006537472,0.4003686,0.0002493986,0.00009150622,0.0001908372,0.001131553,0.004477453,0.002742164],"genre_scores_gemma":[0.9481311,0.0002213516,0.04913412,0.00004150618,0.00003763981,0.0000594915,0.001036387,0.0000486772,0.001289641],"genre_candidate":"empirical","genre_consensus":"empirical","teacher_disagreement_score":0.002754186,"threshold_uncertainty_score":0.005204499,"prediction_status":"machine_predicted_unvalidated"},"machine_scores":{"provisional":true,"baseline":true,"maturity_gate_passed":false,"score_opus":0.007981079758762184,"score_gpt":0.2453106957023075,"score_spread":0.2373296159435453,"validation_status":"score_only:v0-immature-baseline","note":"Baseline scores from an immature model (maturity gate not passed). Scores rank; they never assert a category."}}