{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,14]],"date-time":"2026-02-14T06:05:44Z","timestamp":1771049144751,"version":"3.50.1"},"reference-count":45,"publisher":"Springer Science and Business Media LLC","issue":"2","license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Neural Comput & Applic"],"published-print":{"date-parts":[[2026,1]]},"DOI":"10.1007\/s00521-025-11810-5","type":"journal-article","created":{"date-parts":[[2026,1,23]],"date-time":"2026-01-23T04:34:43Z","timestamp":1769142883000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["RanVisStat: a statistical feature engineering approach for ransomware binary and multiclass classification using machine learning"],"prefix":"10.1007","volume":"38","author":[{"given":"Syed Shakir Hameed","family":"Shah","sequence":"first","affiliation":[]},{"given":"Norziana","family":"Jamil","sequence":"additional","affiliation":[]},{"given":"Lariyah","family":"Mohd Sidek","sequence":"additional","affiliation":[]},{"given":"Atta ur Rehman","family":"Khan","sequence":"additional","affiliation":[]},{"given":"Ezedin","family":"Baraka","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2026,1,23]]},"reference":[{"issue":"5","key":"11810_CR1","doi-asserted-by":"publisher","first-page":"1984","DOI":"10.1016\/j.jksuci.2020.06.012","volume":"34","author":"S Kok","year":"2022","unstructured":"Kok S, Abdullah A, Jhanjhi N-C, Sciences I (2022) Early detection of crypto-ransomware using pre-encryption detection algorithm. J King Saud Univ-Comput Inf Sci 34(5):1984\u20131999","journal-title":"J King Saud Univ-Comput Inf Sci"},{"issue":"8","key":"11810_CR2","doi-asserted-by":"publisher","first-page":"3133","DOI":"10.1007\/s00521-020-05195-w","volume":"33","author":"K Bakour","year":"2021","unstructured":"Bakour K, \u00dcnver HMJNC (2021) VisDroid: android malware classification based on local and global image features, bag of visual words and machine learning techniques. Neural Comput Appl 33(8):3133\u20133153","journal-title":"Neural Comput Appl"},{"key":"11810_CR3","doi-asserted-by":"publisher","first-page":"131","DOI":"10.1016\/j.jksuci.2022.11.007","volume":"35","author":"SA Wagan","year":"2023","unstructured":"Wagan SA, Koo J, Siddiqui IF, Qureshi NMF, Attique M, Shin DRJJoKSUC (2023) Computer and information sciences. J King Saud Univ\u2013Comput Inf Sci 35:131\u2013144","journal-title":"J King Saud Univ\u2013Comput Inf Sci"},{"key":"11810_CR4","unstructured":"BlackFog. Ransomware Report. https:\/\/www.blackfog.com\/the-state-of-ransomware-in-2022\/ (Accessed 12th Dec, 2022)."},{"key":"11810_CR5","unstructured":"SOPHOS. Retail Industry Report. https:\/\/www.sophos.com\/en-us\/press-office\/press-releases\/2022\/09\/retail-industry-was-the-second-most-targeted-industry-by-ransomware-in-2021 (accessed 15th June, 2023)."},{"key":"11810_CR6","unstructured":"GlobleNewWire. Ransomware Government. https:\/\/www.globenewswire.com\/en\/news-release\/2022\/09\/28\/2524204\/0\/en\/Nearly-75-of-Local-and-State-Government-Organizations-Attacked-by-Ransomware-Had-Their-Data-Encrypted-Sophos-Survey-Finds.html (accessed)."},{"key":"11810_CR7","unstructured":"SOPHOS, Ransomware, 2022. [Online]. Available: https:\/\/news.sophos.com\/en-us\/2022\/06\/01\/the-state-of-ransomware-in-healthcare-2022\/."},{"key":"11810_CR8","doi-asserted-by":"crossref","unstructured":"Shah SSH, Jamil N (2022) Performance comparison of visualization-based malware detection and classification techniques. In: 2022 17th International Conference on Emerging Technologies (ICET), IEEE, pp. 200\u2013205.","DOI":"10.1109\/ICET56601.2022.10004652"},{"key":"11810_CR9","doi-asserted-by":"crossref","unstructured":"Chanajitt R, Pfahringer B, Gomes HM (2021) Combining static and dynamic analysis to improve machine learning-based malware classification. In: 2021 IEEE 8th International Conference on Data Science and Advanced Analytics (DSAA), IEEE, pp. 1\u201310.","DOI":"10.1109\/DSAA53316.2021.9564144"},{"key":"11810_CR10","doi-asserted-by":"publisher","first-page":"793","DOI":"10.1007\/978-981-15-0029-9_62","volume-title":"First international conference on sustainable technologies for computational intelligence","author":"C Raghuraman","year":"2020","unstructured":"Raghuraman C, Suresh S, Shivshankar S, Chapaneri R (2020) Static and dynamic malware analysis using machine learning. First international conference on sustainable technologies for computational intelligence. Springer, pp 793\u2013806"},{"key":"11810_CR11","doi-asserted-by":"publisher","first-page":"96899","DOI":"10.1109\/ACCESS.2020.2995887","volume":"8","author":"J Jeon","year":"2020","unstructured":"Jeon J, Park JH, Jeong Y-SJIA (2020) Dynamic analysis for IoT malware detection with convolution neural network model. IEEE Access 8:96899\u201396911","journal-title":"IEEE Access"},{"key":"11810_CR12","doi-asserted-by":"publisher","first-page":"20325","DOI":"10.1109\/ACCESS.2020.2968916","volume":"8","author":"C Gan","year":"2020","unstructured":"Gan C, Feng Q, Zhang X, Zhang Z, Zhu QJIA (2020) Dynamical propagation model of malware for cloud computing security. IEEE Access 8:20325\u201320333","journal-title":"IEEE Access"},{"key":"11810_CR13","doi-asserted-by":"crossref","unstructured":"Alanazi MA, Siraj MM, Ghaleb FA (2021) Hybrid feature selection by combining wrapper and filter methods for malware detection. In: 2021 International Conference on Data Science and Its Applications (ICoDSA), IEEE, pp. 233\u2013239.","DOI":"10.1109\/ICoDSA53588.2021.9617521"},{"key":"11810_CR14","doi-asserted-by":"publisher","DOI":"10.1016\/j.dss.2020.113400","volume":"138","author":"G Ramesh","year":"2020","unstructured":"Ramesh G, Menen AJDSS (2020) Automated dynamic approach for detecting ransomware using finite-state machine. Decis Support Syst 138:113400","journal-title":"Decis Support Syst"},{"issue":"18","key":"11810_CR15","doi-asserted-by":"publisher","first-page":"11499","DOI":"10.1007\/s00521-021-05816-y","volume":"33","author":"K Bakour","year":"2021","unstructured":"Bakour K, \u00dcnver HMJNC (2021) DeepVisDroid: android malware detection by hybridizing image-based features with deep learning techniques. Neural Comput Appl 33(18):11499\u201311516","journal-title":"Neural Comput Appl"},{"key":"11810_CR16","doi-asserted-by":"publisher","first-page":"100478","DOI":"10.1016\/j.eij.2024.100478","volume":"26","author":"SSH Shah","year":"2024","unstructured":"Shah SSH, Jamil N, Sidek LM, Alturki N, Zain ZMJEIJ (2024) MalRed: an innovative approach for detecting malware using the red channel analysis of color images. Egypt Inform J 26:100478","journal-title":"Egypt Inform J"},{"issue":"5","key":"11810_CR17","doi-asserted-by":"publisher","first-page":"1968","DOI":"10.1016\/j.jksuci.2022.02.026","volume":"34","author":"OJ Falana","year":"2022","unstructured":"Falana OJ, Sodiya AS, Onashoga SA, Badmus BSJJOKSU-C, Sciences I (2022) Mal-Detect: an intelligent visualization approach for malware detection. J King Saud Univ-Comput Inf Sci 34(5):1968\u20131983","journal-title":"J King Saud Univ-Comput Inf Sci"},{"issue":"8","key":"11810_CR18","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1007\/s11227-025-07358-9","volume":"81","author":"SSH Shah","year":"2025","unstructured":"Shah SSH, Jamil NJTJoS (2025) Transfer learning with dual-stage discrete wavelet transform for enhanced visual malware image compression and classification. J Supercomput 81(8):1\u201330","journal-title":"J Supercomput"},{"key":"11810_CR19","doi-asserted-by":"crossref","unstructured":"Scaife N, Carter H, Traynor P, Butler KR (2016) Cryptolock (and drop it): stopping ransomware attacks on user data. In: 2016 IEEE 36th international conference on distributed computing systems (ICDCS), IEEE, pp. 303\u2013312.","DOI":"10.1109\/ICDCS.2016.46"},{"key":"11810_CR20","unstructured":"Feng Y, Liu C, Liu B (2017) Poster: a new approach to detecting ransomware with deception. In: 38th IEEE Symposium on Security and Privacy"},{"key":"11810_CR21","unstructured":"Paik JY, Shin K, Cho ES (2016) Poster: self-defensible storage devices based on flash memory against ransomware. In: Proceedings of IEEE Symposium on Security and Privacy"},{"key":"11810_CR22","doi-asserted-by":"crossref","unstructured":"Moore C (2016) Detecting ransomware with honeypot techniques.","DOI":"10.1109\/CCC.2016.14"},{"issue":"4","key":"11810_CR23","doi-asserted-by":"publisher","first-page":"2597","DOI":"10.1007\/s11277-020-07166-9","volume":"112","author":"J Hwang","year":"2020","unstructured":"Hwang J, Kim J, Lee S, Kim KJWPC (2020) Two-stage ransomware detection using dynamic analysis and machine learning techniques. Wirel Pers Commun 112(4):2597\u20132609","journal-title":"Wirel Pers Commun"},{"key":"11810_CR24","doi-asserted-by":"publisher","DOI":"10.1016\/j.asoc.2022.108744","volume":"121","author":"MS Abbasi","year":"2022","unstructured":"Abbasi MS, Al-Sahaf H, Mansoori M, Welch IJASC (2022) Behavior-based ransomware classification: a particle swarm optimization wrapper-based approach for feature selection. Appl Soft Comput 121:108744","journal-title":"Appl Soft Comput"},{"key":"11810_CR25","volume":"37","author":"S Sharma","year":"2021","unstructured":"Sharma S, Krishna CR, Kumar RJFSIDI (2021) RansomDroid: forensic analysis and detection of Android Ransomware using unsupervised machine learning technique. Forensic Sci Int Digit Investig 37:301168","journal-title":"Forensic Sci Int Digit Investig"},{"key":"11810_CR26","doi-asserted-by":"publisher","first-page":"107903","DOI":"10.1016\/j.compeleceng.2022.107903","volume":"100","author":"U Ahmed","year":"2022","unstructured":"Ahmed U, Lin JC-W, Srivastava GJC, Engineering E (2022) Mitigating adversarial evasion attacks of ransomware using ensemble learning. Comput Electr Eng 100:107903","journal-title":"Comput Electr Eng"},{"key":"11810_CR27","doi-asserted-by":"publisher","first-page":"102691","DOI":"10.1016\/j.cose.2022.102691","volume":"117","author":"J Zhu","year":"2021","unstructured":"Zhu J, Jang-Jaccard J, Singh A, Welch I, Al-Sahaf H, Camtepe S (2021) A few-shot meta-learning based siamese neural network using entropy features for ransomware classification. Comput Secur 117:102691","journal-title":"Comput Secur"},{"key":"11810_CR28","doi-asserted-by":"publisher","DOI":"10.1016\/j.conbuildmat.2021.124370","volume":"302","author":"O Furat","year":"2021","unstructured":"Furat O, Baldermann A, Baldermann C, Dietzel M, Schmidt VJC, Materials B (2021) Quantitative assessment of microstructural changes of hydrated cement blends due to leaching and carbonation, based on statistical analysis of image data. Constr Build Mater 302:124370","journal-title":"Constr Build Mater"},{"key":"11810_CR29","doi-asserted-by":"publisher","first-page":"59","DOI":"10.1016\/j.inffus.2020.01.007","volume":"59","author":"M Imani","year":"2020","unstructured":"Imani M, Ghassemian HJIf (2020) An overview on spectral and spatial information fusion for hyperspectral image classification: current trends and challenges. Inf Fusion 59:59\u201383","journal-title":"Inf Fusion"},{"key":"11810_CR30","doi-asserted-by":"publisher","first-page":"110784","DOI":"10.1016\/j.ymssp.2023.110784","volume":"204","author":"S Bi","year":"2023","unstructured":"Bi S, Beer M, Cogan S, Mottershead JJMS, Processing S (2023) Stochastic model updating with uncertainty quantification: an overview and tutorial. Mech Syst Signal Process 204:110784","journal-title":"Mech Syst Signal Process"},{"key":"11810_CR31","doi-asserted-by":"publisher","first-page":"351","DOI":"10.1007\/978-3-030-58452-8_21","volume-title":"Computer Vision\u2013ECCV 2020: 16th European Conference, Glasgow, UK, August 23\u201328, 2020, Proceedings, Part I 16","author":"D Bau","year":"2020","unstructured":"Bau D, Liu S, Wang T, Zhu J-Y, Torralba A (2020) Rewriting a deep generative model. Computer Vision\u2013ECCV 2020: 16th European Conference, Glasgow, UK, August 23\u201328, 2020, Proceedings, Part I 16. Springer, pp 351\u2013369"},{"issue":"9","key":"11810_CR32","doi-asserted-by":"publisher","first-page":"1401","DOI":"10.1049\/iet-ipr.2018.6440","volume":"13","author":"B Khaldi","year":"2019","unstructured":"Khaldi B, Aiadi O, Kherfi MLJIIP (2019) Combining colour and grey\u2010level co\u2010occurrence matrix features: a comparative study. IET Image Process 13(9):1401\u20131410","journal-title":"IET Image Process"},{"issue":"1","key":"11810_CR33","doi-asserted-by":"publisher","first-page":"161","DOI":"10.1080\/0952813X.2020.1735530","volume":"33","author":"Y Kaya","year":"2021","unstructured":"Kaya Y, Kuncan M, Kaplan K, Minaz MR, Ertun\u00e7 HMJJOE, Intelligence TA (2021) A new feature extraction approach based on one dimensional gray level co-occurrence matrices for bearing fault classification. J Exp Theor Artif Intell 33(1):161\u2013178","journal-title":"J Exp Theor Artif Intell"},{"key":"11810_CR34","doi-asserted-by":"publisher","DOI":"10.1016\/j.ecolind.2019.105802","volume":"109","author":"Y Park","year":"2020","unstructured":"Park Y, Guldmann J-MJEI (2020) Measuring continuous landscape patterns with gray-level co-occurrence matrix (GLCM) indices: an alternative to patch metrics? Ecol Indic 109:105802","journal-title":"Ecol Indic"},{"issue":"19","key":"11810_CR35","doi-asserted-by":"publisher","first-page":"7611","DOI":"10.3390\/s22197611","volume":"22","author":"SSH Shah","year":"2022","unstructured":"Shah SSH, Jamil N, Khan AUR (2022) Memory visualization-based malware detection technique. Sensors 22(19):7611","journal-title":"Sensors"},{"issue":"16","key":"11810_CR36","doi-asserted-by":"publisher","first-page":"2579","DOI":"10.3390\/electronics11162579","volume":"11","author":"SSH Shah","year":"2022","unstructured":"Shah SSH, Ahmad AR, Jamil N, Khan AUR (2022) Memory forensics-based malware detection using computer vision and machine learning. Electronics 11(16):2579","journal-title":"Electronics"},{"key":"11810_CR37","doi-asserted-by":"publisher","first-page":"102166","DOI":"10.1016\/j.cose.2020.102166","volume":"103","author":"AS Bozkir","year":"2021","unstructured":"Bozkir AS, Tahillioglu E, Aydos M, Kara IJC (2021) Catch them alive: a malware detection approach through memory forensics, manifold learning and computer vision. Comput Secur 103:102166","journal-title":"Comput Secur"},{"key":"11810_CR38","unstructured":"Victoria UO (2022) ISOT Ransomware Dataset. Accessed 15th Jun, https:\/\/www.uvic.ca\/ecs\/ece\/isot\/datasets\/botnet-ransomware\/index.php."},{"issue":"3","key":"11810_CR39","doi-asserted-by":"publisher","DOI":"10.3390\/ijerph16030368","volume":"16","author":"Y Wang","year":"2019","unstructured":"Wang Y et al (2019) Optimizing the predictive ability of machine learning methods for landslide susceptibility mapping using SMOTE for Lishui City in Zhejiang Province, China. Int J Environ Res Public Health 16(3):368","journal-title":"Int J Environ Res Public Health"},{"key":"11810_CR40","unstructured":"P. Script. Binary to Images Transformation. Accessed 10th Jan, 2022. https:\/\/github.com\/ncarkaci\/binary-to-image"},{"key":"11810_CR41","doi-asserted-by":"crossref","unstructured":"Nataraj L, Karthikeyan S, Jacob G, Manjunath BS (2011) Malware images: visualization and automatic classification. In: Proceedings of the 8th international symposium on visualization for cyber security, pp. 1\u20137.","DOI":"10.1145\/2016904.2016908"},{"key":"11810_CR42","first-page":"353","volume-title":"International conference on data science and applications","author":"S Virmani","year":"2024","unstructured":"Virmani S, Bhushan K, Rehman MZU (2024) Multi-head attention-aware deep ensemble learning for IoT malware detection. International conference on data science and applications. Springer, pp 353\u2013369"},{"key":"11810_CR43","doi-asserted-by":"publisher","first-page":"211","DOI":"10.1016\/j.future.2018.07.052","volume":"90","author":"H Zhang","year":"2019","unstructured":"Zhang H, Xiao X, Mercaldo F, Ni S, Martinelli F, Sangaiah AKJFGCS (2019) Classification of ransomware families with machine learning based onN-gram of opcodes. Future Gener Comput Syst 90:211\u2013221","journal-title":"Future Gener Comput Syst"},{"key":"11810_CR44","doi-asserted-by":"publisher","first-page":"708","DOI":"10.1016\/j.future.2019.09.025","volume":"110","author":"B Zhang","year":"2020","unstructured":"Zhang B, Xiao W, Xiao X, Sangaiah AK, Zhang W, Zhang JJFGCS (2020) Ransomware classification using patch-based CNN and self-attention network on embedded N-grams of opcodes. Future Gener Comput Syst 110:708\u2013720","journal-title":"Future Gener Comput Syst"},{"issue":"9","key":"11810_CR45","doi-asserted-by":"publisher","DOI":"10.3390\/app10093210","volume":"10","author":"H Zuhair","year":"2020","unstructured":"Zuhair H, Selamat A, Krejcar OJAS (2020) A multi-tier streaming analytics model of 0-day ransomware detection using machine learning. Appl Sci 10(9):3210","journal-title":"Appl Sci"}],"container-title":["Neural Computing and Applications"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s00521-025-11810-5.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s00521-025-11810-5","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s00521-025-11810-5.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,2,14]],"date-time":"2026-02-14T05:19:49Z","timestamp":1771046389000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s00521-025-11810-5"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,1]]},"references-count":45,"journal-issue":{"issue":"2","published-print":{"date-parts":[[2026,1]]}},"alternative-id":["11810"],"URL":"https:\/\/doi.org\/10.1007\/s00521-025-11810-5","relation":{},"ISSN":["0941-0643","1433-3058"],"issn-type":[{"value":"0941-0643","type":"print"},{"value":"1433-3058","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,1]]},"assertion":[{"value":"11 April 2024","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"2 October 2025","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"23 January 2026","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}}],"article-number":"14"}}