{"id":"W2989588798","doi":"10.3233/jcs-191346","title":"Multilayer ransomware detection using grouped registry key operations, file entropy and file signature monitoring","year":2019,"lang":"en","type":"article","venue":"Journal of Computer Security","topic":"Advanced Malware Detection Techniques","field":"Computer Science","cited_by":52,"is_retracted":false,"has_abstract":true,"ca_institutions":"University of Windsor; University of Victoria","funders":"","keywords":"Ransomware; Computer science; Encryption; Signature (topology); Data mining; Entropy (arrow of time); Key (lock); Computer security; Malware; Mathematics","routes":{"ca_aff":true,"ca_fund":false,"ca_venue":false,"about_ca":false,"invisible_to_affiliation_only":false},"retraction":null,"screen":null,"direct_labels":[],"prediction":{"model_version":"codex-gemma-dda1882f352a","candidate_categories":[],"consensus_categories":[],"category_scores_codex":[0.000229177,0.0001839487,0.0002861109,0.0001951738,0.0001539827,0.0002479808,0.0004607265,0.0001489967,0.0001215164],"category_scores_gemma":[0.00004811216,0.0001725735,0.0001126053,0.0002476546,0.000024574,0.001676173,0.0002048401,0.0005974017,0.000004282672],"about_ca_system_candidate":false,"about_ca_system_consensus":false,"about_ca_system_score_codex":0.00009603784,"about_ca_system_score_gemma":0.0000535861,"about_ca_topic_candidate":false,"about_ca_topic_consensus":false,"about_ca_topic_score_codex":0.00001679847,"about_ca_topic_score_gemma":0.000003495985,"domain_scores_codex":[0.9986285,0.0001185173,0.0004270499,0.000281596,0.000338237,0.0002061211],"domain_scores_gemma":[0.9986876,0.0001461611,0.0003212267,0.0003535951,0.0003737475,0.0001176632],"domain_codex":null,"domain_gemma":null,"domain_candidate":null,"domain_consensus":null,"study_design_codex":"bench_or_experimental","study_design_gemma":"simulation_or_modeling","study_design_scores_codex":[0.000801237,0.001369876,0.008026424,0.001037146,0.000762033,0.0009627287,0.01817716,0.07966322,0.5045874,0.002383871,0.02513122,0.3570977],"study_design_scores_gemma":[0.001451398,0.0006562238,0.006849092,0.0005062291,0.00002534627,0.001423384,0.00008905522,0.8161023,0.1579913,0.002024879,0.01228577,0.0005949446],"study_design_candidate":"simulation_or_modeling","study_design_consensus":null,"genre_codex":"methods","genre_gemma":"empirical","genre_scores_codex":[0.2444475,0.0001948004,0.7539642,0.00005393737,0.001039869,0.0001535383,0.0000276741,0.0001101455,0.000008274636],"genre_scores_gemma":[0.6792296,0.00003054312,0.3201813,0.00005478362,0.0004665414,0.000003297829,0.000002381937,0.00001151248,0.00002006984],"genre_candidate":"methods","genre_consensus":null,"teacher_disagreement_score":0.7364391,"threshold_uncertainty_score":0.7037345,"prediction_status":"machine_predicted_unvalidated"},"machine_scores":{"provisional":true,"baseline":true,"maturity_gate_passed":false,"score_opus":0.007981079758762184,"score_gpt":0.2453106957023075,"score_spread":0.2373296159435453,"validation_status":"score_only:v0-immature-baseline","note":"Baseline scores from an immature model (maturity gate not passed). Scores rank; they never assert a category."}}