Browse Teach Curate

Batch-Based Incremental CNN-LSTM Ransomware Detection from Sysmon Logs

A real-time ransomware-detection architecture that classifies Windows Sysmon event streams with a hybrid Convolutional Neural Network and Long Short-Term Memory network plus an attention mechanism, and that uses batch-based incremental learning to adapt continuously to new ransomware variants without full retraining, targeting high recall on highly imbalanced data.

B9 Text

iCNN-LSTM: A batch-based incremental ransomware detection system using Sysmon Jamil Ispahanya,c, MD

A ransomware-detection system for Windows endpoints that turns Sysmon event logs into feature streams and classifies them with a hybrid Convolutional Neural Network and Long Short-Term Memory network…