{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,27]],"date-time":"2026-07-27T14:59:59Z","timestamp":1785164399354,"version":"3.55.0"},"reference-count":48,"publisher":"MDPI AG","issue":"15","license":[{"start":{"date-parts":[[2026,7,27]],"date-time":"2026-07-27T00:00:00Z","timestamp":1785110400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Ransomware detection remains challenging because modern variants exhibit diverse, elusive, and partly benign behaviors and can propagate rapidly across interconnected enterprises and sensor-enabled cyber-physical systems, causing cascading operational failures. These characteristics undermine signature-based and static-detection methods. Although machine learning has improved detection, many approaches still rely on fixed objectives that weight samples uniformly, limiting their adaptation to heterogeneity and overlaps between ransomware and benign activities. To address this challenge, we introduce TL-RL-FusionNet, a reinforcement learning (RL)-guided hybrid framework that combines dual transfer learning (TL) backbones, EfficientNetB0 and InceptionV3, with a lightweight residual multi-Layer perceptron (MLP) classifier. The framework converts sandbox reports into RGB grids, extracts features using frozen CNN backbone networks, and fuses embeddings for classification. Training is guided by a tabular Q-learning sample-weighting agent, formulated as a per-sample bandit over discrete weight actions. To prevent cross-fold information leakage, the Q-table is freshly initialized in each cross-validation fold and updated only using the fold-local training partition, whereas the held-out fold is used for the final evaluation. The framework was evaluated using two datasets. On our dataset, TL-RL-FusionNet achieved the best overall performance on Dataset 1, with 99.20% accuracy, 99.40% recall, and 99.84% AUC. On the public EldeRan benchmark, it achieved 90.36% accuracy using the full dynamic feature space and 92.08% using a Mutual Information-selected compact subset. Paired Wilcoxon tests across five folds were used to assess the RL contribution, while additional grid-order sensitivity analysis showed that the image-based representation remained robust under five random 10 \u00d7 10 feature-grid permutations. Interpretability analysis using t-distributed stochastic neighbor embedding (t-SNE) and gradient-weighted class activation mapping feature-grid mapping further showed that the model captured discriminative behavioral patterns. Overall, these results demonstrate that RL-guided sample reweighting improves adaptive ransomware detection while maintaining efficiency and interpretability. The dataset and supporting code are publicly available on GitHub.<\/jats:p>","DOI":"10.3390\/s26154775","type":"journal-article","created":{"date-parts":[[2026,7,27]],"date-time":"2026-07-27T14:08:14Z","timestamp":1785161294000},"page":"4775","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["TL-RL-FusionNet: Reinforcement Learning-Guided Residual MLP with Fused CNN Embeddings for Efficient and Adaptive Ransomware Detection"],"prefix":"10.3390","volume":"26","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-9612-0482","authenticated-orcid":false,"given":"Jannatul","family":"Ferdous","sequence":"first","affiliation":[{"name":"School of Computing, Mathematics and Engineering, Charles Sturt University, Wagga Wagga, NSW 2650, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8317-5727","authenticated-orcid":false,"given":"Rafiqul","family":"Islam","sequence":"additional","affiliation":[{"name":"School of Computing, Mathematics and Engineering, Charles Sturt University, Albury, NSW 2640, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0487-0615","authenticated-orcid":false,"given":"Arash","family":"Mahboubi","sequence":"additional","affiliation":[{"name":"School of Professional Studies, University of New South Wales (UNSW), Canberra, ACT 2600, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Md Zahidul","family":"Islam","sequence":"additional","affiliation":[{"name":"School of Computing, Mathematics and Engineering, Charles Sturt University, Bathurst, NSW 2795, Australia"},{"name":"AI and Cyber Futures Center, Charles Sturt University, Panorama Avenue, Bathurst, NSW 2795, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2026,7,27]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"136666","DOI":"10.1109\/ACCESS.2024.3461965","article-title":"AI-based Ransomware Detection: A Comprehensive Review","volume":"12","author":"Ferdous","year":"2024","journal-title":"IEEE Access"},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"16","DOI":"10.1186\/s40163-024-00212-y","article-title":"Conti Inc.: Understanding the internal discussions of a large ransomware-as-a-service operator with machine learning","volume":"13","author":"Ruellan","year":"2024","journal-title":"Crime Sci."},{"key":"ref_3","unstructured":"Sgandurra, D., Mu\u00f1oz-Gonz\u00e1lez, L., Mohsen, R., and Lupu, E.C. (2016). Automated Dynamic Analysis of Ransomware: Benefits, Limitations and use for Detection. arXiv."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"108601","DOI":"10.1016\/j.compeleceng.2023.108601","article-title":"SINN-RD: Spline interpolation-envisioned neural network-based ransomware detection scheme","volume":"106","author":"Singh","year":"2023","journal-title":"Comput. Electr. Eng."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"15647","DOI":"10.1038\/s41598-022-19443-7","article-title":"Ransomware detection using deep learning based unsupervised feature extraction and a cost sensitive Pareto Ensemble classifier","volume":"12","author":"Zahoora","year":"2022","journal-title":"Sci. Rep."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"551","DOI":"10.3390\/iot1020030","article-title":"A Study on the Evolution of Ransomware Detection Using Machine Learning and Deep Learning Techniques","volume":"1","author":"Fernando","year":"2020","journal-title":"IoT"},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"84153","DOI":"10.1109\/ACCESS.2025.3569184","article-title":"Efficient Ransomware Detection in Resource-Constrained Environments Using Optimized Multi-Layer Perceptron Networks","volume":"13","author":"Lin","year":"2025","journal-title":"IEEE Access"},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"111543","DOI":"10.1016\/j.knosys.2024.111543","article-title":"CNN-LSTM and transfer learning models for malware classification based on opcodes and API calls","volume":"290","author":"Bensaoud","year":"2024","journal-title":"Knowl.-Based Syst."},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"101748","DOI":"10.1016\/j.cose.2020.101748","article-title":"Image-Based malware classification using ensemble of CNN architectures (IMCEC)","volume":"92","author":"Vasan","year":"2020","journal-title":"Comput. Secur."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"103265","DOI":"10.1016\/j.cose.2023.103265","article-title":"Improving ransomware detection based on portable executable header using xception convolutional neural network","volume":"130","author":"Moreira","year":"2023","journal-title":"Comput. Secur."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"107138","DOI":"10.1016\/j.comnet.2020.107138","article-title":"IMCFN: Image-based malware classification using fine-tuned convolutional neural network architecture","volume":"171","author":"Vasan","year":"2020","journal-title":"Comput. Netw."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"110676","DOI":"10.1016\/j.asoc.2023.110676","article-title":"SDIF-CNN: Stacking deep image features using fine-tuned convolution neural network models for real-world malware detection and classification","volume":"146","author":"Kumar","year":"2023","journal-title":"Appl. Soft Comput."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"879","DOI":"10.1007\/s11227-025-07358-9","article-title":"Transfer learning with dual-stage discrete wavelet transform for enhanced visual malware image compression and classification","volume":"81","author":"Shah","year":"2025","journal-title":"J. Supercomput."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"32","DOI":"10.1016\/j.jpdc.2022.10.001","article-title":"Bin Malware detection using image representation of malware data and transfer learning","volume":"172","author":"Rustam","year":"2023","journal-title":"J. Parallel Distrib. Comput."},{"key":"ref_15","first-page":"51","article-title":"Malicious Software Classification Using VGG16 Deep Neural Network\u2019s Bottleneck Features","volume":"738","author":"Rezende","year":"2018","journal-title":"Adv. Intell. Syst. Comput."},{"key":"ref_16","first-page":"103306","article-title":"Image-based malware representation approach with EfficientNet convolutional neural networks for effective malware classification","volume":"69","author":"Chaganti","year":"2022","journal-title":"J. Inf. Secur. Appl."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"32342","DOI":"10.1038\/s41598-025-17647-1","article-title":"A novel technique for ransomware detection using image based dynamic features and transfer learning to address dataset limitations","volume":"15","author":"Ferdous","year":"2025","journal-title":"Sci. Rep."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"1867","DOI":"10.1007\/s10586-023-04043-5","article-title":"Ransomware early detection using deep reinforcement learning on portable executable header","volume":"27","author":"Deng","year":"2024","journal-title":"Clust. Comput."},{"key":"ref_19","first-page":"100095","article-title":"Leveraging Dynamic Embeddings and Reinforcement Learning with Bayesian Networks for Ransomware Resiliences","volume":"3","author":"Kumar","year":"2025","journal-title":"Cyber Secur. Appl."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"103950","DOI":"10.1016\/j.jnca.2024.103950","article-title":"Leveraging application permissions and network traffic attributes for Android ransomware detection","volume":"230","author":"Jeremiah","year":"2024","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"100360","DOI":"10.1016\/j.array.2024.100360","article-title":"DART: A Solution for decentralized federated learning model robustness analysis","volume":"23","author":"Feng","year":"2024","journal-title":"Array"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Ferdous, J., Islam, R., and Islam, Z. (2026). Privacy-Aware Machine Unlearning with SISA for Reinforcement Learning\u2014Based Ransomware Detection, Association for Computing Machinery.","DOI":"10.1145\/3774905.3794679"},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Manavi, F., and Hamzeh, A. (2021, January 3\u20134). Static Detection of Ransomware Using LSTM Network and PE Header. Proceedings of the 26th International Computer Conference, Computer Society of Iran (CSICC) 2021, Tehran, Iran.","DOI":"10.1109\/CSICC52343.2021.9420580"},{"key":"ref_24","first-page":"181","article-title":"Ransomware Detection Based on PE Header Using Convolutional Neural Networks","volume":"14","author":"Manavi","year":"2022","journal-title":"ISeCure"},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Qin, B., Wang, Y., and Ma, C. (2020). API Call Based Ransomware Dynamic Detection Approach Using TextCNN. Proceedings of the International Conference on Big Data, Artificial Intelligence and Internet of Things Engineering (ICBAIE), Fuzhou, China, 12\u201314 June 2020, IEEE.","DOI":"10.1109\/ICBAIE49996.2020.00041"},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"103703","DOI":"10.1016\/j.cose.2024.103703","article-title":"XRan: Explainable deep learning-based ransomware detection using dynamic analysis","volume":"139","author":"Gulmez","year":"2024","journal-title":"Comput. Secur."},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"120017","DOI":"10.1016\/j.eswa.2023.120017","article-title":"SwiftR: Cross-platform ransomware fingerprinting using hierarchical neural networks on hybrid features","volume":"225","author":"Karbab","year":"2023","journal-title":"Expert Syst. Appl."},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Almomani, I., Alkhayer, A., and El-Shafai, W. (2023). E2E-RDS: Efficient End-to-End Ransomware Detection System Based on Static-Based ML and Vision-Based DL Approaches. Sensors, 23.","DOI":"10.3390\/s23094467"},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Rezende, E., Ruppert, G., Carvalho, T., Ramos, F., and De Geus, P. (2017). Malicious software classification using transfer learning of ResNet-50 deep neural network. Proceedings of the 16th IEEE International Conference on Machine Learning and Applications (ICMLA), Cancun, Mexico, 18\u201321 December 2017, IEEE.","DOI":"10.1109\/ICMLA.2017.00-19"},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"265","DOI":"10.1007\/s11265-020-01588-1","article-title":"A Method for Windows Malware Detection Based on Deep Learning","volume":"93","author":"Huang","year":"2021","journal-title":"J. Signal Process. Syst."},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"4398","DOI":"10.1109\/TDSC.2025.3547005","article-title":"CyberForce: A Federated Reinforcement Learning Framework for Malware Mitigation","volume":"22","author":"Feng","year":"2025","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"ref_32","unstructured":"Abuse.ch (2024, June 02). MalwareBazaar Database. Available online: https:\/\/bazaar.abuse.ch\/browse\/."},{"key":"ref_33","unstructured":"(2024, June 07). VirusShare.com\u2014Because Sharing Is Caring. Available online: https:\/\/virusshare.com\/."},{"key":"ref_34","unstructured":"(2024, July 06). SnapFiles. Popular Freeware Categories. Available online: https:\/\/www.snapfiles.com\/freeware\/."},{"key":"ref_35","unstructured":"(2024, July 10). Portableapps. Portable App Directory. Available online: https:\/\/portableapps.com\/apps."},{"key":"ref_36","unstructured":"(2024, July 16). DikeDataset. Available online: https:\/\/github.com\/iosifache\/DikeDataset\/tree\/main\/files\/benign."},{"key":"ref_37","unstructured":"Agcaoili, J., and Ang, M. (2024, October 01). Narrowed Sights, Bigger Payoffs: Ransomware in 2019. TREND. Available online: https:\/\/www.trendmicro.com\/vinfo\/au\/security\/news\/cybercrime-and-digital-threats\/narrowed-sights-bigger-payoffs-ransomware-in-2019."},{"key":"ref_38","unstructured":"Palo Alto Networks (2024, September 10). Unit 42 Ransomware Threat Report. Available online: https:\/\/start.paloaltonetworks.com\/unit-42-ransomware-threat-report.html."},{"key":"ref_39","doi-asserted-by":"crossref","unstructured":"(2024, October 12). Zscaler: 2022 ThreatLabz State of Ransomware Report. Available online: https:\/\/www.zscaler.com\/resources\/industry-reports\/2022-threatlabz-ransomware-report.pdf.","DOI":"10.12968\/S1361-3723(22)70581-7"},{"key":"ref_40","unstructured":"(2023). Maturing Criminal Marketplaces Present New Challenges to Defenders, Sophos. Available online: https:\/\/www.scribd.com\/document\/628559505\/Sophos-Threat-Report-2023."},{"key":"ref_41","unstructured":"Calder, A. (2023). The Ransomware Threat Landscape: Prepare for, Recognise and Survive Ransomware Attacks, IT Governance Publishing."},{"key":"ref_42","unstructured":"TREND (2024, October 12). Phobos Emerges as a Formidable Threat in Q1 2024, LockBit Stays in the Top Spot. Available online: https:\/\/www.trendmicro.com\/vinfo\/au\/security\/news\/ransomware-by-the-numbers\/phobos-emerges-as-a-formidable-threat-in-q1-2024-lockbit-stays-in-the-top-spot."},{"key":"ref_43","unstructured":"(2025, December 28). Cuckoo Sandbox-Automated Malware Analysis. Available online: https:\/\/cuckoosandbox.org\/download."},{"key":"ref_44","doi-asserted-by":"crossref","first-page":"100458","DOI":"10.1016\/j.array.2025.100458","article-title":"A reinforcement learning based fuzzing technique for binary programs vulnerabilities detection","volume":"27","author":"Cao","year":"2025","journal-title":"Array"},{"key":"ref_45","first-page":"100076","article-title":"Towards superior android ransomware detection: An ensemble machine learning perspective","volume":"3","author":"Hossain","year":"2025","journal-title":"Cyber Secur. Appl."},{"key":"ref_46","doi-asserted-by":"crossref","first-page":"100306","DOI":"10.1016\/j.array.2023.100306","article-title":"Ensuring network security with a robust intrusion detection system using ensemble-based machine learning","volume":"19","author":"Hossain","year":"2023","journal-title":"Array"},{"key":"ref_47","doi-asserted-by":"crossref","first-page":"9122","DOI":"10.1038\/s41598-025-93447-x","article-title":"Enhancing malware detection with feature selection and scaling techniques using machine learning models","volume":"15","author":"Hasan","year":"2025","journal-title":"Sci. Rep."},{"key":"ref_48","doi-asserted-by":"crossref","unstructured":"Abdel-Wahab, M.S., Neil, A.M., and Atia, A. (2020). A Comparative Study of Machine Learning and Deep Learning in Network Anomaly-Based Intrusion Detection Systems. Proceedings of the 15th International Conference on Computer Engineering and Systems (ICCES), Cairo, Egypt, 15\u201316 December 2020, IEEE.","DOI":"10.1109\/ICCES51560.2020.9334553"}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/15\/4775\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,27]],"date-time":"2026-07-27T14:09:12Z","timestamp":1785161352000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/15\/4775"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,7,27]]},"references-count":48,"journal-issue":{"issue":"15","published-online":{"date-parts":[[2026,8]]}},"alternative-id":["s26154775"],"URL":"https:\/\/doi.org\/10.3390\/s26154775","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,7,27]]}}}