{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,25]],"date-time":"2026-02-25T17:10:51Z","timestamp":1772039451180,"version":"3.50.1"},"reference-count":60,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"4","license":[{"start":{"date-parts":[[2025,7,1]],"date-time":"2025-07-01T00:00:00Z","timestamp":1751328000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,7,1]],"date-time":"2025-07-01T00:00:00Z","timestamp":1751328000000},"content-version":"am","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,7,1]],"date-time":"2025-07-01T00:00:00Z","timestamp":1751328000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,7,1]],"date-time":"2025-07-01T00:00:00Z","timestamp":1751328000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"National Science Foundation","award":["CNS-1947580"],"award-info":[{"award-number":["CNS-1947580"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Dependable and Secure Comput."],"published-print":{"date-parts":[[2025,7]]},"DOI":"10.1109\/tdsc.2025.3543268","type":"journal-article","created":{"date-parts":[[2025,2,18]],"date-time":"2025-02-18T13:27:39Z","timestamp":1739885259000},"page":"4160-4175","source":"Crossref","is-referenced-by-count":1,"title":["Sniper: Countering Locker Ransomware Attacks Through Natural Language Processing"],"prefix":"10.1109","volume":"22","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-6199-6468","authenticated-orcid":false,"given":"Abdulrahman Abu","family":"Elkhail","sequence":"first","affiliation":[{"name":"University of Michigan, Dearborn, MI, USA"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6711-1280","authenticated-orcid":false,"given":"Anys","family":"Bacha","sequence":"additional","affiliation":[{"name":"University of Michigan, Dearborn, MI, USA"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6006-3888","authenticated-orcid":false,"given":"Hafiz","family":"Malik","sequence":"additional","affiliation":[{"name":"University of Michigan, Dearborn, MI, USA"}]}],"member":"263","reference":[{"key":"ref1","article-title":"Number of mobile app downloads worldwide from 2016 to 2022,","author":"Ceci","year":"2023"},{"key":"ref2","article-title":"Mobile operating system market share worldwide","year":"2022"},{"key":"ref3","article-title":"Google kept over a million bad apps out of the play store last year","author":"Friedman","year":"2022"},{"key":"ref4","first-page":"468","article-title":"Androzoo: Collecting millions of Android apps for the research community","volume-title":"Proc. IEEE\/ACM 13th Work. Conf. Mining Softw. Repositories","author":"Allix"},{"key":"ref5","article-title":"Ransomware statistics in 2023: From random barrages to targeted hits","author":"Vijonivic","year":"2023"},{"key":"ref6","article-title":"CovidLock update: Deeper analysis of Coronavirus Android ransomware","author":"Anderson","year":"2020"},{"key":"ref7","first-page":"757","article-title":"$\\lbrace${UNVEIL$\\rbrace$}: A $\\lbrace${Large-Scale$\\rbrace$}, automated approach to detecting ransomware","volume-title":"Proc. 25th USENIX Secur. Symp.","author":"Kharaz","year":"2016"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA.2015.7056070"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.3233\/JCS-191346"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2018.07.052"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1155\/2016\/2946735"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-26362-5_18"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1145\/3019612.3019793"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.3390\/app10113706"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-60876-1_12"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134035"},{"key":"ref17","first-page":"599","volume-title":"Proc. ACM Asia Conf. Comput. Commun. Secur.","author":"Kolodenker"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/SSCI.2017.8280842"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/ISDFS.2018.8355317"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1145\/2991079.2991110"},{"key":"ref21","article-title":"PassMark performanceTest tool","year":"2023"},{"key":"ref22","article-title":"The rise of Android ransomware","author":"Lipovsky","year":"2016"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.03762"},{"key":"ref24","article-title":"BERT: Pre-training of deep bidirectional transformers for language understanding","author":"Devlin","year":"2018"},{"key":"ref25","first-page":"5753","article-title":"XLNet: Generalized autoregressive pretraining for language understanding","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Yang"},{"key":"ref26","article-title":"The evolution of a cybercrime: A timeline of ransomware advances","author":"Vanderburg","year":"2017"},{"key":"ref27","article-title":"LockerPin ransomware resets PIN and permanently locks your SmartPhones","author":"Khandelwal","year":"2015"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1145\/3579822"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.emnlp-demos.16"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1147\/rd.14.0309"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2003.1223656"},{"key":"ref32","article-title":"Benefits of deep NLP-based lemmatization for information retrieval","volume-title":"Proc. CLEF (Work. Notes)","author":"Hal\u00e1csy","year":"2006"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.3115\/v1\/D14-1181"},{"key":"ref34","first-page":"602","article-title":"Generalization of back propagation to recurrent and higher order neural networks","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Pineda"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1162\/neco.1997.9.8.1735"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.3115\/v1\/W14-4012"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.1310.4546"},{"key":"ref38","first-page":"8026","article-title":"PyTorch: An imperative style, high-performance deep learning library","volume-title":"Adv. Neural Inf. Process. Syst.","author":"Paszke","year":"2019"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2018.00016"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D18-1316"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/P19-1103"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1145\/3399670"},{"key":"ref47","article-title":"Google find my device","year":"2013"},{"key":"ref49","article-title":"EasyOCR","year":"2023"},{"key":"ref50","article-title":"Captcha dataset version 2","year":"2013"},{"key":"ref51","article-title":"OCR in 2024: Benchmarking text extraction\/capture accuracy","year":"2024"},{"key":"ref52","article-title":"Automated dynamic analysis of ransomware: Benefits, limitations and use for detection","author":"Sgandurra","year":"2016"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/ICCITECHN.2017.8281835"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2019.09.025"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-64701-2_14"},{"key":"ref57","article-title":"Contagio mobile malware mini-dump","year":"2016"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/BigData.2018.8622324"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2017.2787905"},{"key":"ref60","first-page":"1","article-title":"Enhancing ransomwareelite app for detection of ransomware in Android applications","volume-title":"Proc. 11th Int. Conf. Contemporary Comput.","author":"Sharma"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2016.2536605"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2015.02.007"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/LES.2020.3035875"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1145\/3196494.3196515"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2022.3214781"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/LOCS.2019.2918091"}],"container-title":["IEEE Transactions on Dependable and Secure Computing"],"original-title":[],"link":[{"URL":"https:\/\/ieeexplore.ieee.org\/ielam\/8858\/11077775\/10891891-aam.pdf","content-type":"application\/pdf","content-version":"am","intended-application":"syndication"},{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/8858\/11077775\/10891891.pdf?arnumber=10891891","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,7,11]],"date-time":"2025-07-11T22:48:31Z","timestamp":1752274111000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10891891\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,7]]},"references-count":60,"journal-issue":{"issue":"4"},"URL":"https:\/\/doi.org\/10.1109\/tdsc.2025.3543268","relation":{},"ISSN":["1545-5971","1941-0018","2160-9209"],"issn-type":[{"value":"1545-5971","type":"print"},{"value":"1941-0018","type":"electronic"},{"value":"2160-9209","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,7]]}}}