Content area
Problem statement
Ransomware attacks pose a severe threat to organizations by exploiting security weaknesses, most often leading to colossal economic and information loss. There is a growing need for efficient and accurate predictive models to detect and prevent such attacks in real-time cybersecurity applications.
Methodology
This paper utilizes the UGRansome dataset, which is a large-scale ransomware and zero-day attack detector. The F-measure method is employed in this paper as a novel method for enhancing model interpretability and preventing redundancy. The Histogram Gradient Boosting classifier, which is optimized, is subsequently enhanced with three advanced metaheuristic optimizers. Sensitivity analysis provides transparent insights into the effects of individual attributes through explainable AI. Finally, the Wilcoxon ranking test is applied to ensure the statistical significance of the performance gain, and K-fold cross-validation ensures robustness and generalizability of the reported models. In addition, Recursive Feature Elimination (RFE) is also applied to rank the features to identify the most important predictors methodically. Sensitivity analysis is also performed utilizing SHapley Additive exPlanations (SHAP) values to present explainable and transparent perspectives on individual feature impacts on the model’s output.
Results
The hybrid models proposed here exhibit significant gains in prediction accuracy, precision, and recall. The feature importance analysis indicates that economic and behavioral features of the network equally contribute to correct ransomware identification.
Contributions
This work introduces an evaluation of a strong and scalable model for ransomware forecasting that enables organizations to predict threats ahead of time and improve their general cybersecurity capabilities. The integration of cutting-edge feature selection with nature-inspired optimization enables the framework to create more accurate models while maintaining interpretability and efficiency. The method is directly translatable to real-world scenarios, including enhancing cloud security, detecting zero-day attacks, and supporting mass-scale automated threat scanning in fluctuating cybersecurity environments.
Introduction
Problem statement
Ransomware is an increasingly sophisticated malware that encrypts files with a monetary ransom for access restoration. The first appearance of ransomware was in 1989 with the release of the “AIDS Trojan.” However, its danger has increased significantly in recent times due to the emergence of a growing number of variants and a corresponding rise in potential targets. Additionally, the introduction of anonymous online payment systems has made it easier for perpetrators to profit from their criminal activities, thus making ransomware a very lucrative type of cybercrime. Traditional antivirus tools, which rely on signature-based detection techniques, are becoming less effective as attackers employ advanced packing and obfuscation methods to evade detection. In addition, ransomware-as-a-service (RaaS) platforms have dramatically lowered the barriers to entry, making it possible for even those without skills to launch attacks. According to Coveware, the average ransom payment increased by 33% from Q4 2019 to Q1 2020, reaching approximately USD 111,605 per incident. Modern ransomware also exploits multi-core Central Processing Unit (CPU) technologies and parallel computing to accelerate encryption processes, making attacks more efficient and damaging. Given that outdated detection methods are no longer sufficient, there is an urgent need to enhance or develop new approaches focused on identifying the most critical features that contribute to timely and accurate ransomware detection [1].
Ransomware attacks surged significantly during the COVID-19 pandemic due to the rise of work-from-home (WFH) arrangements and the increasing reliance on digital infrastructure. High-profile incidents like the Colonial Pipeline and JBS meat processor attacks broadened the threat landscape and elevated ransomware to a national security issue. Ransomware, initially predicted in the 1990s, has evolved into two major types: crypto-ransomware, which encrypts files, and locker-ransomware, which disables system access. As attackers develop more sophisticated and evasive tactics, defenders are challenged to keep pace [2].
A recent study of senior executives found that 46% of small firms have experienced ransomware attacks [3]. Additionally, nearly three-quarters (73%) of the businesses that were attacked by ransomware have paid a ransom. 13% of small firms paid ransomware attackers more than $100,000, while 43% paid between $10,000 and $50,000. However, just a portion of the company’s data was retrieved by 17% of those who paid. On the other hand, companies are increasingly utilizing cloud computing to streamline various business processes. According to industry studies, approximately 68% of firms currently utilize cloud computing, and 19% plan to do so in the future [4]. According to the 2020 Trustwave Global Security Report [5], the number of attacks against cloud services more than quadrupled in 2019, in tandem with the trend of businesses shifting more of their activities to the cloud. Ransomware protection in cloud and virtualized systems is therefore crucial, as cloud computing becomes increasingly common in businesses [6].
Rule-based systems and signature-based methods are insufficient for detecting ransomware due to its constantly evolving nature. The requirement for frequent signature and policy updates to keep pace with new versions can delay response, thus exposing systems to new threats. Traditional methods for the detection of ransomware attacks [7] are lacking, primarily due to the encrypted nature of cloud data, which makes it difficult to access and analyze. The growing number and severity of ransomware attacks in cloud environments were the main drivers of this research. Since traditional detection methods are identified as ineffective [8, 9] with the ongoing development of ransomware variants, it is crucial to investigate new methods for detecting ransomware attacks within this encrypted environment, as the encryption of cloud data further complicates detection [10].
A significant and groundbreaking contribution has been made through the utilization of transfer learning in the field of ransomware detection. The use of transfer learning helps to maximize the accuracy of ransomware detection, especially in situations where there is limited labeled data [11, 12]. In addition, a great advancement has been made through the establishment of a deep learning (DL) ensemble framework focused on the detection of ransomware [13, 14]. The ensemble setup enhances detection robustness and performance by combining different features from different deep learning models. This new strategy has potential for supporting the construction of more effective real-time systems for ransomware detection [15]. Additionally, the use of Machine Learning (ML) techniques, specifically classification methods, can enhance security by enabling the automatic detection of malware, such as ransomware, through its dynamic behavioral patterns [16, 17]. To assist in the classification and detection of ransomware, Decision Tree (DT), Random Forest (RF), Naive Bayes (NB), and Logistic Regression (LR) algorithms have been found effective [18].
Related works
Researchers provided groundbreaking insights into the status of ransomware threats and organizational responses, based on traditional survey and analysis methodologies. Malik et al. [19] provided a general review of evolving techniques and procedures (TTPs) employed in the ransomware arena, pointing out trends like Ransomware-as-a-Service (RaaS) and double extortion, and emphasized the need for real-time cybersecurity and international collaboration. Warkentin et al. [20] in surveying Canadian businesses, highlighted the real experience of the victims of ransomware, in this case small businesses, and showed that nearly one-third had been victimized, with little difference reported in insurance, reporting, and police response across firm sizes, and indicating the prevalence of the ransomware threat.
Current studies illustrate the increasing application of metaheuristic and nature-inspired hybrid algorithms for solving complexity in real-world prediction and classification issues across different disciplines. El-Sayed M. El-kenawy et al. [21], for instance, demonstrated how a modified grey wolf optimizer could enhance ensemble learning to forecast reference evapotranspiration daily with high accuracy in semi-arid conditions. Mizdrakovic et al. [22] combined variational mode decomposition and improved LSTM models, further described with Shapley values, to accurately forecast Bitcoin prices while illustrating how metaheuristic optimization enhances financial time series modeling.
Air quality prediction in urban zones now increasingly relies on advanced machine learning techniques that give sound, evidence-based advice to inform environmental and public health policy. Zaki and Mahmood [23] demonstrated the performance of the K-Nearest Neighbors (KNN) model in analyzing and forecasting air quality in Delhi, India, from a huge dataset spanning over two years. Their results showed that the KNN algorithm had remarkably low predictive errors with an MSE of just 0.0002, since it was a testament to its capability to sense local trends in air pollutants such as PM2.5, PM10, NO₂, SO₂, CO₂, and O₃. This application-based study was confirmed by El-kenawy [24] in his review of the machine learning, deep learning, and IoT-based frameworks for the urban air quality prediction frontier. The review points to the manner in which combining heterogeneous data sources—meteorological, pollutant concentration, and satellite imagery—with advanced neural architectures and IoT-facilitated sensors is transforming real-time monitoring and forecasting. Together, these push the enormous potential of machine learning methods such as KNN and hybrid AI platforms to support smart city initiatives and enable sustainable urban air quality management in the wake of ongoing challenges stemming from data sparsity and computational scalability.
New developments in medical diagnosis employed metaheuristic optimization algorithms together with machine learning models to maximize the accuracy of disease classification across various disciplines [25, 26]. For instance, Bacanin et al. [27] applied an enhanced metaheuristic optimized deep Long Short-Term Memory network for Parkinson’s disease diagnosis, showing the benefits of certain metaheuristics for neurodegenerative disease diagnosis. Elshewey et al. [28] proposed a hybrid model where the Greylag Goose Optimization (GGO) algorithm is combined with Long Short-Term Memory (LSTM) networks for heart disease classification with 99.58% accuracy in optimizing feature extraction and hyperparameters. Similarly, Tarek et al. [29] advanced a novel cardiovascular disease diagnosis model using Snake Optimization (SO) blended with five machine learning algorithms with a resultant accuracy of 99.9%. In EEG signal classification, Elshewey et al. [30] advanced a Modified Al-Biruni Earth Radius (MBER) algorithm to enhance eye state classification accuracy to 96.12% using K-Nearest Neighbors (KNN) as a fitness function. Furthermore, Elshewey and Osman [31] applied binary breadth-first search (BBFS) feature selection in orthopedic disease classification, combined with Random Forest (RF), and attained a 99.41% accuracy rate. Another critical healthcare application was demonstrated by El-Rashidy et al. [32], who employed a PSO-optimized multitask multilayer LSTM network to predict mechanical ventilation and mortality in ICU patients with high precision and recall. These studies demonstrate the significant role played by combining nature-inspired optimization methods with deep learning and machine learning classifiers for improved diagnostic performance and making robust platforms for early disease detection and prediction.
With a specific focus on ransomware detection, several studies have leveraged ML and hybrid AI techniques for improved detection, classification, and ransomware threat prevention. For instance, Wa Nkongolo [33] introduced a novel approach for detecting and analyzing ransomware within the cryptocurrency ecosystem by developing unique features that capture transaction behavior, ransom characteristics, and financial impacts. Using the UGRansome dataset, the study proposed the Ransomware Feature Selection Algorithm (RFSA), which leverages Gini Impurity and Mutual Information to identify key features distinguishing ransomware transactions in Bitcoin (BTC) and USD. Results showed that longer attack durations correlated with greater financial gains. The RFSA achieved strong performance metrics: 95% MI score, 93% accuracy, 92% recall, and 89% precision, outperforming existing methods and emphasizing the need for adaptive strategies in response to the evolving ransomware threat landscape. Davies et al. [34] proposed a new method for ransomware detection, which proved effective in identifying encrypted files regardless of the ransomware family being used. The method was created using a large dataset of more than 130,000 files that included modern Microsoft file types as well as samples of real ransomware attacks, including WannaCry, Ryuk, and Phobos. The main challenge for them was to differentiate between compressed and encrypted files since both of them have high Shannon entropy values. The approach they devised takes advantage of a unique property of entropy present in the header parts of the encrypted files and makes a comparison possible with profiles created randomly. The classifier had a remarkable accuracy rate of 99.96% in classifying files as either encrypted or not, using only the first 192 bytes, successfully distinguishing ransomware-encrypted files from other types of files with high entropy.
Gurukala and Verma [35] proposed a ransomware detection framework based on machine learning to overcome the limitations of traditional detection techniques in dealing with the evolution of ransomware variants. The authors’ approach uses ensemble classifiers in conjunction with Particle Swarm Optimization (PSO) as a feature selection technique to increase accuracy while reducing false positives and false negatives. Two ensemble models were developed: a combined Random Forest (RF) and Support Vector Machine (SVM), and a combined Decision Tree (DT) and K-Nearest Neighbors (KNN). PSO was applied to select and rank the most relevant features for the two ensemble models. The results from the experiments were that the application of Particle Swarm Optimization (PSO) in feature selection significantly improved detection abilities. Specifically, the DT-KNN ensemble had an accuracy rate of 98.38% when using PSO, better than the performance of individual classifiers and setups without feature selection, thus highlighting the effectiveness of the proposed approach in improving ransomware classification. Mowri et al. [36] studied the effect of feature selection in the improvement of ransomware classification through the study of API calls and network-related features. Although previous studies had shown positive results without the addition of feature selection, this study focused on the benefits of using Recursive Feature Elimination with Cross-Validation (RFECV). Through the evaluation of the performance of different supervised machine learning algorithms with and without RFECV, the authors confirmed that feature selection helps avoid overfitting, enhances the accuracy of models, and reduces training time. The findings provide important information on the effectiveness of RFECV in optimizing ransomware classification models and guiding further research in the field.
Fernando and Komninos [37] presented a feature selection model called FeSA to improve the trustworthiness of machine learning classifiers in environments suffering from concept drift, which refers to unexpected changes in the underlying predictive model with time. Contrary to standard practice, FeSA is not dependent on the chosen classification model and aims at discovering subsets of features that lead to high detection rates, specifically in the case of ransomware malware. The study involved comparative studies of FeSA with other nature-inspired algorithms such as genetic search, evolutionary search, harmony search, best-first search, and greedy stepwise selection. The results reflected that FeSA suffered the smallest reduction in performance amid concept drift and always reported the highest ransomware detection rates. Additionally, it yielded competitive results in terms of recall, precision, and false positive rates, thus marking FeSA as an effective and strong feature selection technique in dynamically changing cybersecurity domains. Li et al. [38] conducted a comprehensive comparison of feature selection and feature extraction techniques for IoT network intrusion detection using machine learning models. Using the heterogeneous TON-IoT dataset, the study evaluated both binary and multiclass classification tasks, analyzing performance metrics such as accuracy, F1-score, and runtime. Results showed that feature extraction offered better detection performance and robustness to changes in feature number, while feature selection reduced model training and inference time. Feature selection also presented more potential for accuracy improvement when varying the number of features. The study offers actionable insights into the choice of suitable feature reduction methods specific to different scenarios about Internet of Things (IoT) intrusion detection, thus filling a lacuna in earlier evaluations based on the TON-IoT dataset. Salem et al. [39] performed an extensive review of more than sixty recent studies designed to evaluate the effectiveness of artificial intelligence (AI), particularly machine learning (ML), deep learning (DL), and metaheuristic algorithms, in identifying and preventing different types of cyberattacks, i.e., malware, network intrusions, and spam. The findings of the study reveal that the combination of machine learning and deep learning with metaheuristic approaches significantly enhances detection precision and responsiveness. By comparative study, the research established the pros and cons of current models and highlighted the requirement for smart and adaptive systems that could evolve according to emerging threats. In addition, the article proposes a systematic approach to evaluating AI-based systems for detecting cyber threats and emphasizes regular updates to meet the changing nature of cyber threats.
Nkongolo and Tokmak [40] presented a sophisticated framework developed for ransomware identification and classification, using a Stacked Autoencoder (SAE) to enable effective feature selection, in addition to a Long Short-Term Memory (LSTM) network to classify. Based on the UGRansome dataset, the study involved extensive preprocessing and applied the SAE in both unsupervised and supervised learning to improve feature extraction. The fine-tuning of features greatly enhanced the ability of the LSTM to distinguish between different ransomware families and other types of malware. A series of thorough experiments, including learning rate optimization and training of more than 400 epochs, resulted in a model with high efficiency. The SAE-LSTM model had outstanding performance, with a classification accuracy of 99%, thus outperforming the XGBoost algorithm. The model also attained an accuracy of 98% in signature-based attack detection, highlighting its efficacy and generalization capabilities across malware categories. Li et al. [41] presented a hybrid model for ransomware detection, which combines deep learning methods with Monte Carlo Tree Search (MCTS) to meet the increasing complexities involved with ransomware attacks. The use of MCTS enabled dynamic decision-making mechanisms by considering different detection strategies, thereby enabling the system to learn and respond to emerging threats in real time. Compared to traditional machine learning methods, this model significantly enhanced detection accuracy and reduced false positives, all while maintaining computational efficiency suitable for real-time commercial applications. The introduced framework showed great potential as an effective and scalable solution for addressing the complexities introduced by the evolution of ransomware threats.
Alohali et al. [42] proposed the Sine Cosine Algorithm with a deep learning framework tailored to the identification and classification of ransomware, known as SCADL-RWDC, to detect and classify ransomware in Internet of Things (IoT) environments. The framework effectively dealt with the rising difficulties presented by botnet-based malware with its variants Bashlite, Mirai, and Persirai. The SCADL-RWDC framework applies the Sine Cosine Algorithm (SCA) for selecting features to upgrade detection, supplemented by a hybrid Grey Wolf Optimizer (HGWO) paired with a Gated Recurrent Unit (GRU) model for classification activities. Designed for the adaptive and dynamic nature of IoT ransomware, the SCADL-RWDC underwent extensive testing and proved superior compared to modern models, as represented by its ability to perform the detection and classification tasks. Alzakari et al. [34] presented the MHARNN-EGTOCRD method intended for the detection and classification of ransomware attacks in Internet of Things (IoT) networks. This method involves the incorporation of multiple advanced methods in a unified framework, including min-max normalization for data preprocessing, dung beetle optimization (DBO) for the selection of relevant features, and a Multi-Head Attention-based Long Short-Term Memory (MHA-LSTM) network for the facilitation of detection. The Enhanced Gorilla Troops Optimization (EGTO) algorithm is utilized for the optimization of the hyperparameters of the MHA-LSTM. Empirical assessment of the method using a specific dataset for ransomware detection indicated the superior performance of the concerned model, having an accuracy rate of 98.53%, thus verifying its superiority over the current detection methods.
Research gaps
Research related to ransomware identification and mitigation has progressed significantly; however, there are many gaps that can be considered for future research.
A key shortcoming is a lack of generalizability across several categories of cyber attacks. Many of the current methods primarily focus on detecting specific versions of ransomware or rely on known characteristics, thus limiting their effectiveness at detecting new or mutating versions of ransomware. The development of models that can generalize over a broad range of ransomware types, both emerging and previously unknown ones, is of utmost significance. Such an improvement would be a huge leap forward in the development of detection systems that can remain effective with the constant evolution of attack techniques.
Another major shortcoming lies in the adaptability capacity in the face of evolving ransomware techniques. Ransomware techniques continuously evolve, and many current detection methods rely on static models and pre-determined sets of features. With evolving ransomware, detection models may see reduced effectiveness if they cannot adapt accordingly. Future research should focus on developing frameworks with the ability to learn continuously from newly developing attack techniques, hence the ability to mitigate risks from concept drift and enabling responses to new threats as they arise.
The combination of multiple data sources is an area that requires further research. Previous research has mainly focused on individual data sources, which include, but are not limited to, network activity, file system actions, and financial transaction patterns. However, there is a critical need for an end-to-end framework that combines heterogeneous data sources, such as network activity, file metadata, cryptocurrency transactions, and external threat feeds. Such integration has the potential to provide a more complete picture of ransomware activities while, at the same time, enhancing detection accuracy.
The issues related to scalability and real-time detection capability are significant. While many detection approaches can attain high accuracy levels, they often have high computational costs, which degrade their scalability and effectiveness in real-time use, particularly in large or very complex environments. Therefore, there is a need for detection methods that exhibit high efficiency, which can balance performance and resource consumption, thus allowing for seamless operation in large-scale systems while meeting the demands of real-time detection.
Handling imbalanced datasets remains a key challenge in the field. Datasets used for ransomware detection often have a high level of imbalance, where there is a much higher number of benign files compared to ransomware samples, which in turn leads to the creation of biased models. This kind of imbalance can adversely affect the overall effectiveness of detection systems. Future research efforts should be focused on the investigation of methods to alleviate class imbalance, such as synthetic data generation, advanced class balancing techniques, or methods that can neutralize the imbalance without sacrificing detection accuracy.
Finally, the evaluation of IoT and critical infrastructure environments is a comparatively overlooked field. While many studies focus on smaller-scale environments, research focusing on detecting ransomware in critical infrastructure environments in which the consequences are much more severe is necessary. It is important to come up with tailored detection methods for these environments, which face different challenges and security requirements, to strengthen resilience in high-risk sectors. More in-depth, context-specific approaches are urgently needed to ensure effective ransomware prevention in these environments.
Objectives and novelties
The main objective of this work is to design an accurate and interpretable machine learning system for ransomware detection, combining state-of-the-art feature selection, interpretability, and metaheuristic optimization. The novelties and contributions of the present study are emphasized below:
Integrated Feature Selection and Ranking: This paper employs the F-measure method for feature selection (reducing computational complexity to reach generalizable and straightforward prediction models) and Recursive Feature Elimination (RFE) to rank the most significant features.
Interpretable Sensitivity Analysis with SHAP: For preserving transparency and interpretability, in this research, a robust sensitivity analysis of the ranked features is performed by SHapley Additive exPlanations (SHAP) values. This ensures the identification of how an individual feature impacts the model predictions independently, solving the critical requirement of explainable AI in cybersecurity.
Construction of Hybrid Optimized HGBC Models: In this work, three new hybrid models are presented by combining the Histogram Gradient Boosting Classifier (HGBC) with three effective metaheuristic optimizers. These optimizers are used to optimize the parameters of the HGBC in order to improve accuracy and convergence.
Data compilation and analysis
Dataset source and description
The dataset compiled for this study is the UGRansome dataset, an open-access dataset from Kaggle [43], a specialized cybersecurity benchmark specifically designed for detecting and analyzing ransomware incidents and zero-day cyberattacks. This dataset has been widely adopted in academic and industry research for tasks such as anomaly detection, ransomware family classification, and the identification of previously unseen (zero-day) threats [44, 45, 46, 47–48]. Before use in this study, the raw UGRansome data were deduplicated to remove redundant events and transformed to ensure consistency between feature formats, and the final sample size of the utilized dataset was 149,043.
Key features and correlation
The UG Ransom dataset used in this study includes various features that define the network, transactional, and behavioral aspects relevant to ransomware attacks. The features outlined serve as input variables for predictive modeling and are important in understanding attack patterns as well as improving classification effectiveness. The following is an in-depth description of each feature, as shown in Fig. 1:
Protocol: Specifies the specific type of communication protocol, for example, TCP or UDP, utilized within the network flow. Some protocols can have an increased vulnerability to exploitation or can be associated with specific types of ransomware activity. This property makes it easier to analyze attack vectors.
Flag: Refers to control signals used in packet transmission, which indicate the status or purpose of network communications. These metrics can also point out unusual behavior, such as SYN floods or unauthorized resets.
Clusters: Uses clustering algorithms to represent pre-defined sets of data points. Clusters help in grouping similar types of ransomware attacks, thus improving the effectiveness of models intended for class-specific predictions.
Seed Address: Denotes the cryptographic seed used to generate cryptocurrency wallets for ransom payments. Repeated or linked seed addresses can reveal organized or recurring attack campaigns.
Exploited Address (Exp Address): Refers to the specific place or terminus of the system that was compromised during the occurrence. This helps identify systems or users that are targeted repeatedly.
Bitcoin (BTC): Refers to the total ransom asked in Bitcoin. This feature is critical to determine financial risk and is closely associated with the anonymity techniques used by the perpetrator.
USD: Specifies the ransom amount in United States dollars. It provides a logical economic justification for the attendant risk and has proven effective as a strong predictive variable in the context of the model.
IP Address: Records the source or destination IP address related to the ransomware attack. Geographic and ISP analysis of IPs can help trace the source of attacks or detect proxy usage.
Threats: Classifies the level or type of threat embodied by the ransomware sample. This may be based on severity, behavior, or associated malware family, and is vital for prioritizing incidents.
Port: Specifies the network port used for communication. Specific ports, like 445 used for SMB, are often associated with known vulnerabilities and the lateral spread that comes with ransomware attacks.
Netflow_bytes: Refers to the total number of bytes passed through over the network stream during the event. Anomalously high or low values can signal malicious data exfiltration or command-and-control activity.
Time: Tracks the length or severity of the attack event. Temporal patterns can support time-series analysis and help detect coordinated campaigns or zero-day threats.
Classification Target: The predicted variable is the label for classification of every network flow or event in the UGRansome dataset. It is the output of an anomaly detection of zero-day attacks and ransomware events. The variable has three categorical classes:
S (Safe): Normal or benign network activity (66,380 instances).
SS (Suspicious): Potentially anomalous or suspicious activity, not confirmed to be an attack (40,102 instances).
A (Attack): Confirmed ransomware or zero-day attack activity (42,561 incidents).
Figure 1 illustrates the correlation matrix showing the strength and direction of relationships between the input features and the output variable in the UG Ransom dataset. A higher correlation coefficient indicates a stronger relationship between a given feature and the ransomware classification label. Notably, financial indicators such as “USD” and structural features like “Port” and “Threats” demonstrate stronger correlations, suggesting their potential as high-impact predictors. This matrix was used to inform the feature selection process, guiding the application of the F-statistic and Recursive Feature Elimination (RFE) in the subsequent analysis.
[See PDF for image]
Fig. 1
The correlation matrix between input and output variables
The role of clustering in enhancing predictions of ransom attacks
Clustering algorithms have played a crucial role in revealing hidden patterns and clustering data into meaningful subcategories, and hence significantly enhanced the predictive ability in terms of ransomware attacks. By dividing similar observations based on common properties, clustering allowed the identification of high-risk as well as low-risk behavioral patterns within the complex dataset.
Different clustering methods were used to enable this analysis. K-means clustering divided the dataset into separate clusters by reducing intra-cluster variance, thus proving effective in identifying distinct attack pattern clusters. Hierarchical clustering produced a dendrogram of hierarchical clusters by repeatedly merging or splitting clusters, allowing for a multi-faceted analysis of ransomware behavior. In addition, Density-Based Spatial Clustering of Applications with Noise (DBSCAN) was used to identify clusters with non-linear arrangements and to find outliers, which often indicated the occurrence of new ransomware tactics.
Clustering has become a critical building block in the detection of abnormal behavior, with outlier detection being a core aspect of adaptive modeling. Anomaly detection often leads to the updating of predictive models or the triggering of alerts for new and previously unseen attack patterns or newly emerging vulnerabilities. Apart from its application in anomaly detection, clustering has been used to classify ransomware attacks according to key features like the ransom value demanded, attack duration, and type of threat. This classification enabled priority-based modeling through the grouping of high-severity attacks into separate sub-models, enhancing the accuracy of risk assessments.
In addition, the application of clustering greatly enhanced the process of anomaly detection by allowing comparisons between newly created data points and the predefined behavioral norms typical of well-defined clusters. The effectiveness of clustering depended on its combination with relevant feature selection methods and careful parameter tuning. The application of features selected through Recursive Feature Elimination (RFE) greatly improved the performance of clustering algorithms by reducing levels of noise and enhancing intra-cluster consistency. Overall, clustering was a core component in both the initial and subsequent analytical stages of the ransomware prediction model, thus allowing for the creation of more advanced, interpretable, and informative results that support cybersecurity efforts.
Feature selection
To enhance the effectiveness of the model and forecasting, the feature importance was determined using the F-statistic method, which ranks features according to their contribution to the performance of the model. This process allows for the detection of important variables with reduced occurrence of irrelevant or redundant information. Figure 2 shows the results of the F-statistic test performed on each feature in the dataset.
The feature “Port” showed the highest variability, as attested by an F-statistic of over 15,000, signifying a strong correlation with the dependent variable. On the other hand, the attribute labeled as “USD” had a maximum overall F-statistic value of around 19,254, thus highlighting its strong influence on predicting financial trends related to ransomware. Additionally, the feature labeled “Threats” revealed a strong influence, having an F-statistic value of close to 4,303, thus emerging as one of the key predictors of the accuracy of the model. On the other hand, the features “Flag” and “Clusters” reflected a moderate influence, suggesting their contribution towards improved predictive strength, though not to the extent of the network-level and financial features. The features “Protocol” and “BTC” achieved the lowest values, reflecting significantly poor F-statistics and thus indicating their limited predictive strength. The analysis showed that many features considerably increased the model’s overall predictive ability.“Clusters”, “SeddAddress”, “ExpAddress”, “USD”, and “Port” variables were finally utilized as predictors in this study.
[See PDF for image]
Fig. 2
Feature selection ranking based on F-statistic method
Methodology
Histogram gradient boosting classification (HGBC)
The HGB method uses the well-known gradient boosting (GB) [49] methodology, which is widely applied to various machine-learning issues, such as regression and classification. AdaBoost is one of several techniques that belong to a family of models called boosting algorithms, which are mostly focused on turning weak learners into strong ones. The foundation of boosting techniques is the progressive introduction and training of new weak learners to make up for the shortcomings of the previous poor learners. Every weak learner after them is told to steer clear of the errors committed by the learner before them. Decision trees are the poor learners that occur most frequently. The GB algorithm’s primary flaw, its protracted training period on big datasets was addressed by the HGB approach, a boosting strategy. The continuous input parameters are divided or binned into a few hundred different values to overcome this difficulty. In this case, the learning rate of the algorithm is the most important hyperparameter. Numerous repetitions of adjusting hyper-parameters allowed for considerable optimization of the approach.
Optimization algorithms
While optimization and modeling target various aspects, both are typically required in order to tackle real-world problems. Modeling is required to ensure that objective functions are evaluated by a correct mathematical or numerical model of the system under study, while optimization defines the optimum set of design parameters. Herein lies the choice of effective optimization algorithms at the core of the success of the optimization exercise [50, 51]. Three nature-based metaheuristic algorithms, the Bonobo Optimization Algorithm (BOA) [52], the Tunicate Swarm Algorithm (TSA) [53], and the Gorilla Troops Optimizer (GTO) [54], are used in this study to tune the hyperparameters of the Histogram Gradient Boosting Classifier (HGBC) as they demonstrated successful applications earlier but their performance did not compared [55, 56–57]. The BOA is inspired by the cooperative and adaptive social behavior of bonobos to enable effective balancing of global exploration versus local exploitation. Similarly, the TSA mimics the swarming and propulsive behavior of tunicates to enhance convergence rate and solution quality in a high-dimensional search space. The GTO is inspired by the hierarchical leadership and collaborative foraging nature of gorilla troops, ensuring population diversity and robustness of search capability. Their application significantly improves the overall generalization ability and prediction accuracy of the classifier, which is crucial for overcoming the non-linearity and high dimensionality of the data. To understand explicit mathematical derivation steps for these algorithms, refer to Appendix II.
Performance evaluation metrics
To evaluate the performance of the classification models, a set of standard evaluation metrics was employed that consisted of accuracy, precision, recall, and F1-score.
They provide a comprehensive overview of the performance of a model, particularly for imbalanced or critical classification tasks such as ransomware detection. The definitions of these metrics are as follows:
Accuracy: Measures the proportion of correctly classified instances (both positive and negative) out of the total number of cases.
Precision: Indicates the proportion of true positive predictions among all positive predictions made by the model. High precision reflects a low false-positive rate.
Recall (Sensitivity): This measure determines the proportion of true positives that the model correctly identifies. In the case of cybersecurity, failure to identify an attack (a false negative) could lead to serious financial consequences, making this measure critical.
F1-Score: This is the harmonic mean of precision and recall that gives a balanced measure that includes both false negatives and false positives. Its importance is especially evident in datasets that have imbalanced class distributions.
1
2
3
4
In these equations:
TP (True Positive): Correctly predicted ransomware incidents.
FP (False Positive): Benign cases wrongly flagged as ransomware.
TN (True Negative): Correctly identified non-ransomware cases.
FN (False Negative): Missed ransomware predictions.
Cross-validation and train-test split
The data-splitting technique (train-test split) is used in machine learning to divide the dataset into two parts: one for training the model and the other for testing its performance. In this study, 80/20 was utilized for the train-test split, as it was suggested by researchers [58]. Cross-validation methods can be delineated broadly as exhaustive or non-exhaustive. Exhaustive ones take into account all feasible ways of splitting the original dataset into a training and a validation subset; typical examples are leave-p-out cross-validation and leave-one-out cross-validation. Even though they provide extensive testing, they are computationally intensive. On the other hand, non-exhaustive strategies approximate the same test by attempting only a subset of possible data splits, using techniques such as k-fold cross-validation, the holdout approach, or repeated random subsampling. Of these, k-fold cross-validation is a machine learning researcher and practitioner’s favorite since it is simple to apply and has been empirically proven to be successful at approximating the predictive accuracy of classification models [59, 60].In this study, 5-fold cross-validation was conducted in 5 iterations to further determine the single and hybrid models’ predictive power and stability. Table 1 presents the results for the HGBC single model, indicating uniform performance by fold and iteration. Additionally, the results for the hybrid models, HGBO, HGTS, and HGGT, are presented in Table 2, with the improved and stable accuracy that is achieved through the combination of optimization and hybridization strategies.
Table 1. 5-fold cross-validation results for the HGBC single model
Models | Iteration | Test fold number | ||||
|---|---|---|---|---|---|---|
K1 | K2 | K3 | K4 | K5 | ||
HGBC | 1 | 0.908 | 0.905 | 0.911 | 0.919 | 0.920 |
2 | 0.916 | 0.911 | 0.921 | 0.924 | 0.927 | |
3 | 0.908 | 0.903 | 0.907 | 0.903 | 0.909 | |
4 | 0.894 | 0.906 | 0.909 | 0.911 | 0.912 | |
5 | 0.891 | 0.897 | 0.900 | 0.893 | 0.901 | |
Table 2. 5-fold cross-validation results for hybrid models
Models | Iteration | Test fold number | ||||
|---|---|---|---|---|---|---|
K1 | K2 | K3 | K4 | K5 | ||
HGBO | 1 | 0.965 | 0.965 | 0.968 | 0.967 | 0.970 |
2 | 0.973 | 0.970 | 0.973 | 0.976 | 0.977 | |
3 | 0.978 | 0.975 | 0.979 | 0.974 | 0.979 | |
4 | 0.971 | 0.978 | 0.978 | 0.976 | 0.980 | |
5 | 0.961 | 0.969 | 0.962 | 0.964 | 0.969 | |
HGTS | 1 | 0.955 | 0.954 | 0.957 | 0.956 | 0.958 |
2 | 0.960 | 0.962 | 0.964 | 0.965 | 0.966 | |
3 | 0.953 | 0.950 | 0.954 | 0.957 | 0.959 | |
4 | 0.948 | 0.947 | 0.949 | 0.949 | 0.950 | |
5 | 0.940 | 0.947 | 0.943 | 0.949 | 0.950 | |
HGGT | 1 | 0.924 | 0.927 | 0.929 | 0.923 | 0.929 |
2 | 0.916 | 0.917 | 0.918 | 0.919 | 0.921 | |
3 | 0.908 | 0.910 | 0.910 | 0.914 | 0.916 | |
4 | 0.920 | 0.917 | 0.918 | 0.921 | 0.923 | |
5 | 0.925 | 0.925 | 0.927 | 0.924 | 0.928 | |
Results
Convergence behavior and hyperparameter tuning
Figures 3 and 4 show the convergence behaviors and hyperparameter configuration exhibited by the HGBO, HGTS, and HGGT methods during the execution of training iterations. The horizontal axis in the convergence plot indicates the iteration numbers, and the vertical axis indicates the corresponding accuracy achieved. Also, in box plots range of hyperparameter values and the optimal value reached in iterations are determined:
HGBO reached the highest terminal accuracy of 0.975 and had good convergence, indicative of its efficacy and stability.
HGTS had a marginally lower final accuracy value of 0.959, reflecting a steady and uniform trend in convergence.
HGGT showed the worst and slowest convergence, with the final highest accuracy of 0.929.
[See PDF for image]
Fig. 3
Convergence behavior of HGBO, HGTS, and HGGT models
[See PDF for image]
Fig. 4
Hyperparameter configuration of hybrid models
ROC curve evaluation
The Receiver Operating Characteristic (ROC) curve is an important tool for the assessment of classification models, as it graphically displays the relationship between the True Positive Rate (TPR) and the False Positive Rate (FPR) at different levels of thresholds. A good model is reflected by a curve that moves towards the upper left, which represents high values for both sensitivity and specificity.
Figure 5 displays the ROC curves of four models: HGBC, HGBO, HGTS, and HGGT.
HGBO demonstrated the best classification performance, consistently achieving the highest TPR across most FPR values.
HGTS followed a very close-to-path traced by HGBO and ranked just below it, denoting strong performance slightly below it.
HGGT showed a moderate efficacy, with sporadic overlaps with HGTS and HGBO, but mostly lagging behind their performance.
HGBC exhibited the weakest performance, producing the lowest TPR for any given FPR.
The Area Under the Curve (AUC) measure was utilized to examine the above observations and found the highest score to be by HGBO, followed by HGTS, HGGT, and HGBC. The observations validate the claim that the balance between the highest sensitivity and highest specificity is provided by HGBO through both visual analysis and quantitative analysis.
[See PDF for image]
Fig. 5
ROC curves for HGBC and hybrid models
Quantitative performance comparison
Table 3 summarizes the Accuracy, Precision, Recall, F1-score, and AUC for each model during the training and testing phases.
HGBO outperformed all other models, achieving nearly identical training and testing metrics (~ 0.976), indicating excellent generalization.
HGTS achieved strong results (~ 0.960), validating its consistency across data partitions.
HGGT showed moderate accuracy (~ 0.930), with stable yet suboptimal performance.
HGBC ranked lowest, with accuracy and precision around 0.914.
These results establish HGBO as the most resilient and accurate model, while HGTS offers a solid middle ground and HGGT outpaces HGBC but lacks robustness.
Table 3. Performance metrics of HGBC and hybrid models on train, test, and all data
Model | Section | Metric values | ||||
|---|---|---|---|---|---|---|
Accuracy | Precision | Recall | F1-Score | AUC | ||
HGBC | Train | 0.914 | 0.914 | 0.914 | 0.914 | 0.935 |
Test | 0.913 | 0.914 | 0.913 | 0.913 | ||
All | 0.914 | 0.914 | 0.914 | 0.914 | ||
HGBO | Train | 0.975 | 0.975 | 0.975 | 0.975 | 0.982 |
Test | 0.976 | 0.976 | 0.976 | 0.976 | ||
All | 0.975 | 0.976 | 0.975 | 0.975 | ||
HGTS | Train | 0.959 | 0.960 | 0.959 | 0.960 | 0.969 |
Test | 0.959 | 0.960 | 0.959 | 0.959 | ||
All | 0.959 | 0.960 | 0.959 | 0.960 | ||
HGGT | Train | 0.929 | 0.930 | 0.929 | 0.929 | 0.947 |
Test | 0.932 | 0.933 | 0.932 | 0.932 | ||
All | 0.930 | 0.930 | 0.930 | 0.930 | ||
Figure 6 presents the confusion matrices of the HGBC single model and hybrid counterparts, respectively, which provide a detailed overview of the classification performance for each class. Although the HGBC accurately classified a large number of samples in every class (e.g., 36,535 for SS, 38,911 for A, and 60,716 for S), some confusion was present, with considerable confusion between neighboring classes. By contrast, confusion matrices of HGBO, HGTS, and HGGT hybrid models reveal dramatic improvements in classification accuracy. Improvements of HGGT were less than those of the other two hybrid models. For HGBO, the correctly classified instances of SS, A, and S increased to 39,107, 41,484, and 64,795, respectively, and the misclassified figures in off-diagonal cells decreased considerably, indicating greater accuracy and lower false negatives and positives. Similarly, HGTS also performs well with high true positives (38,423 for SS, 40,846 for A, and 63,735 for S) and comparatively lower misclassification rates than the standalone HGBC model. These results confirm that hybrid models effectively improve discrimination power for all classes, reducing overlap and improving overall model reliability.
[See PDF for image]
Fig. 6
Confusion matrix for HGBC and Hybrid Models
Sensitivity analysis for explainable AI
Sensitivity analysis techniques aim to quantify the magnitude of changes in model outputs resulting from variations in inputs, thereby providing insight into the uncertainty and effects of input variables. Sensitivity analysis is crucial for gaining a deeper understanding of feature importance and uncertainty in machine learning models, simulators, and other systems of interest. Because of its ability to describe how inputs affect predictions, sensitivity analysis is a model-agnostic method within the wider explanatory artificial intelligence (XAI) paradigm. As a reaction to the growing need for transparency in AI deployment, simply offering predictions is no longer enough; stakeholders now increasingly expect to receive explanations on model behavior, prediction parameters, and uncertainty sources before AI systems can be deployed [61]. sensitivity analysis significantly contributes to XAI by answering these questions irrespective of specific models or sampling designs, which is particularly handy when confronted with high-dimensional input spaces. By identifying the most influential variables, sensitivity analysis informs priorities of data collection and aids effective data-driven modeling [62].
SHAP is employed in this study as an explanation methodology derived from the Shapley value concept in cooperative game theory. The method provides both a broad estimate of how important each feature is and a high-resolution explanation of how an individual input affects the model output. Specifically, Shapley values quantify the fair contribution of each input to the prediction by allocating the output additively among features. In the SHAP method, the model prediction takes the form of the sum of the prediction’s expected value and the Shapley values of single input features, with the presence or absence of features when computing their marginal contributions represented by the coalition vector [63].
For the three top-ranked variables based on Recursive Feature Elimination (RFE) in Fig. 7-left, SHAP values are presented in Fig. 7-right. Cluster, ExpAddress, and USD as the three important variables have SHAP values of 0.210, 0.169, and 0.066, respectively. Cluster groups similar patterns of attacks together, and by this, the model is able to differentiate various families of ransomware, as well as enhance class-specific predictions. ExpAddress identifies the targeted system endpoints that attackers leverage and reveals frequent targets and makes tracing recurring threats more possible or vulnerabilities. USD, the dollar value of the ransom, calculates the monetary impact directly and strongly relates to verified cases of attacks, giving a clean economic indicator for measuring risk. Used together, these features include behavior, structure, and economy aspects of ransomware activities, significantly improving the model to forecast danger and offer appropriate cybersecurity enforcement.
[See PDF for image]
Fig. 7
RFE ranking and SHAP sensitivity results
Discussion
Ransomware attacks constitute a serious threat in modern cybersecurity environments. They are marked by increasing complexity, scale, and frequency, aiming to compromise target infrastructure, organizations, and end-users by encrypting vital information and extorting financial payments. The impact of such intrusions is far-reaching, including data loss, operational disruption, and reputational damage, in addition to an increasing dependence on cryptocurrencies that provide anonymity and frustrate tracking attempts. Due to the limitations of conventional security solutions, there is an immediate need for advanced, intelligent, and scalable detection systems. Machine learning technologies, especially those capable of handling high-volume and high-velocity data streams, offer a solid foundation for strengthening defenses against ransomware intrusions. This study adds to the growing body of research literature by introducing hybrid machine learning frameworks that utilize biologically inspired optimization techniques to improve predictive performance and enhance system resilience.
The current study’s methodology mainly entails the use of F-measure to select and keep the most important features, hence dimensionality reduction and improving the model’s performance. Subsequently, three metaheuristic algorithms, Bonobo Optimization Algorithm (BOA), Tunicate Swarm Algorithm (TSA), and Gorilla Troop Optimization (GTO), were used to optimize the Histogram Gradient Boosting Classification (HGBC) model. This resulted in three hybrid models: HGBO (the combination of HGBC and BOA), HGTS (the combination of HGBC and TSA), and HGGT (the combination of HGBC and GTO). Evaluation was conducted based on standard measures (Accuracy, Precision, Recall, F1-score, and AUC) combined with an analysis of the ROC curve, convergence over 200 iterations, and classification performance for SS, A, and S classes.
All model training for this work was conducted in Google Colab, which typically provides a cloud-based runtime environment with an Intel Xeon CPU with two virtual CPUs, approximately 13 GB of system RAM, and sufficient local disk capacity to allow notebooks, data sets, and trained models to be stored. For rapid calculation, an NVIDIA Tesla T4 GPU was utilized, which is designed on the NVIDIA Turing architecture with 2,560 CUDA cores, 320 Tensor cores, and 16 GB of GDDR6 memory, delivering up to 8.1 TFLOPS in single precision and up to 65 TFLOPS for mixed-precision calculations. This setup has high memory bandwidth (up to 320 GB/s) and is planned to speed up today’s machine learning workloads with CUDA, NVIDIA TensorRT, and ONNX APIs.
The Wilcoxon test, in particular the Wilcoxon Rank-Sum test, is a powerful non-parametric method for comparing prediction models [64]. The test is beneficial in assessing the performance difference between different predictive models, depending on whether their output is significantly different [65, 66]. Table 4 presents the outcome of the Wilcoxon Rank-Sum tests for models HGBC, HGBO, HGTS, and HGGT. It is apparent from the table that all models yield very small p-values (e.g., 5.96E-77 for HGBC and 9.80E-78 for HGGT), indicating with high confidence that the null hypothesis of no difference can be rejected. The respective test statistics from 2,732,949 for HGBO to 33,959,724 for HGBC again verify noteworthy ranking differences between models under consideration. These results obviously determine that differences in performance between the tested models are statistically significant and do not occur due to random variation. The models can therefore be comfortably differentiated based on predictiveness, thereby determining the comparative strength of analysis.
Among the models evaluated here, HGBO consistently ranked highest in every evaluative measure. It had a training accuracy and test accuracy of 0.975 and 0.976, and precision, recall, and F1-scores of 0.976 on the test dataset. Its closest competitor was the HGTS with a test accuracy and F1-score of 0.960, while the HGGT achieved a test accuracy of 0.932. The lowest performance was recorded in the baseline model, the HGBC, with both test accuracy and F1-score equal to 0.913. Evaluations conducted on the ROC curve further supported the dominance of the HGBO since it consistently had the highest true positive rate (TPR) for every level of false positive rate (FPR) and the highest area under the curve (AUC). On the issue of convergence, not only did the HGBO achieve optimal accuracy faster, but it consistently improved throughout the iterations during training. Lastly, the grading-based evaluation found the F1-scores of the HGBO on the SS level and the A level, and the S level to be 0.971 and 0.973, and 0.980, respectively, and it correctly predicted 41,484 and 42,561 instances in the A-grade class.
In computational efficiency terms, the baseline HGBC model required 60 s to execute, and incorporating optimization techniques dramatically contributed to this: HGBO required 450 s, HGTS required 385 s, and HGGT required 392 s. Notably, HGBO, being the most accurate prediction model in the current study, had a relatively high computational cost, reflecting the trade-off between predictive power and running time in applying advanced hybrid optimization techniques.
Table 4. Wilcoxon Rank-Sum test result
Models | P Value | Stat |
|---|---|---|
HGBC | 5.96E-77 | 33,959,724 |
HGBO | 2.18E-23 | 2,732,949 |
HGTS | 1.11E-32 | 7,569,011 |
HGGT | 9.80E-78 | 21,780,207 |
Table 5 clearly shows that the current study differs by including sophisticated elements not present in previous research. Unlike Emari and Yaghi, Urooj et al., and Mercaldo et al., who employed mostly plain classifiers such as Random Forest, Naive Bayes, Decision Tree, and KNN without feature selection and explainable AI in their studies, here the study employs an optimized Histogram Gradient Boosting model with nature-inspired optimizers and F-measure strategy towards robust feature selection and sensitivity analysis through SHAP-based interpretability. Additionally, the current work ensures statistical validity by employing the Wilcoxon test and K-fold cross-validation and achieves a higher accuracy (~ 97.6%) than similar research activities.
Table 5. Comparison table
Aspect | Current Study | Emari and Yaghi (17) | Urooj et al. (6) | Mercaldo et al. (67) |
|---|---|---|---|---|
Algorithms Used | Optimized Histogram Gradient Boosting (HGBC), (HGBO, HGTS, HGGT) | RF, NB, LR, DT | RF, DT, KNN, NB, LR | RF, NB, DT, KNN, GBDT |
Feature Selection | F-measure method | None | None | None |
Explainable AI | SHAP for feature impact, Sensitivity Analysis | None | None | None |
Statistical Validation | Wilcoxon ranking test, K-fold CV | None | None | None |
Accuracy Achieved | ~ 97.6% (HGBO) | Up to 94% | Up to 94.6% | 97% |
The empirical significance of these results is considerable since they demonstrate that the combination of feature selection with high-level metaheuristic optimization methods can make machine learning models in cybersecurity highly resilient, interpretable, and accurate. The reliable and optimal functioning of HGBO, for example, indicates the possibilities of learning inherent behavioral heuristics, such as the social dynamics of bonobos, to resolve challenging classification problems considerably. This hybrid framework is not just computationally efficient and scalable but also adaptive and portable, with high potential for expansion to other cybersecurity tasks like intrusion detection, phishing, anomaly detection, malware detection, and insider threat evaluation. By achieving high accuracy and recall, such optimized models are effective in reducing false positives and false negatives, enabling security professionals to focus on genuine threats and thus improve detection rates and proactive actions. In organizational and cloud computing settings involving huge, dynamic, and exposed datasets, the application of such strong, biologically motivated algorithms retains its performance even as threats evolve, minimizing constant retraining. Lastly, the proposed methodology gives an exhaustive, consistent framework for creating intelligent security systems that can be deployed in real-time, big-scale, and dynamic settings to boost the digital resilience of modern firms against sophisticated cyberattacks such as ransomware attacks.
Limitations and future directions
Though the results are promising, there are a number of important caveats to this research that need to be overcome. Firstly, the experiments are conducted on the UGRansome dataset, and so the model might not generalize as effectively to other settings and new or unknown ransomware families with different behavior patterns. Deployment operationally would entail large-scale real-time testing on heterogeneous, dynamic traffic to ascertain robustness in deployment scenarios. Theoretically, our suggested model may not be able to react to drastically new attack patterns without recurrent retraining. Practically, computational overhead for performing high-end metaheuristic optimization and multi-cross-validation may be prohibitive for very large-scale or time-critical security systems. There is also an opportunity in future research to contrast the proposed models with other newer deep learning approaches, such as Long Short-Term Memory (LSTM) networks, Convolutional Neural Networks (CNN), Stacked Autoencoders (SAE), or transformer-based models that are now being increasingly used for real-time intrusion detection. Coupling these cutting-edge deep learning methods can determine if hybrid metaheuristic tuning brings the same or complementary benefits as deep neural models for complex, dynamic ransomware behavior. There should be future research in such bridging of gaps by carrying out evaluation on other heterogeneous datasets, with additional streaming data pipelines for real-time detection, along with the development of model lightweight versions to trade off detection performance and resource consumption. Furthermore, to minimize potential biases in training data and improve adversarial resistance, adversarial training techniques as well as continual learning need to be explored. Finally, the proposed approach undoubtedly has policy implications: through its enhanced predictive capability and interpretability, it facilitates proactive countermeasures, improved resource planning, and informed policy-making for threat prevention at both organizational and national levels.
Conclusion
This study proposed a hybrid machine learning framework to improve the predictive power for the detection of ransomware attacks by the integration of Feature selection, Recursive Feature Elimination (RFE), sensitivity analysis, and metaheuristic optimization techniques. The use of feature selection enabled the refinement of the dataset by eliminating redundant features, which further resulted in better interpretability of the model, reduced dimensionality, and the retention of only the most influential predictors. This process not only helped achieve better computational efficiency and generalizability but also helped reduce noise and lower the risk of overfitting. With the complex nature and high dimensionality of ransomware datasets, the use of F-measure as a feature selection method was instrumental in improving the model’s ability to handle high-dimensional data without compromising its performance levels. However, the effectiveness of feature selection is partly dependent on the quality of the base model and can be computationally expensive, especially when dealing with large datasets. This study mitigated these drawbacks by improving the model by incorporating biologically inspired metaheuristic algorithms—namely, the Bonobo Optimizer (BO), Tunicate Swarm Algorithm (TSA), and Gorilla Troop Optimization (GTO)—in combination with the Histogram Gradient Boosting Classification (HGBC) baseline. The hybrid models created—HGBO, HGTS, and HGGT—showed substantial improvements compared to the baseline model. Of these, HGBO performed the best with a training accuracy of 0.975 and a test accuracy of 0.976, thus proving itself to be the most reliable model. HGTS ranked second with a test accuracy of 0.960, thus verifying the effectiveness of swarm-based optimization for enhancing the performance of models. On the other hand, HGGT showed moderate improvements, while the baseline model, HGBC, showed poor performance on all evaluation measures with a test accuracy of 0.913. SHAP sensitivity analysis highlighted “Clusters” as the strongest predictor, followed by “USD” and “ExpAddress,” indicating that both financial indicators and structural network variables are important in the correct classification of threats.
These findings validate that the careful choice of features, combined with appropriate optimization strategies, significantly improves the accuracy of ransomware predictions. Pragmatically, the suggested approach yields a scalable, computationally friendly framework for the detection of ransomware. On top of this, it may be applied across other cybersecurity problem areas, ranging from phishing attacks to malware analysis and intrusion identification. Lastly, its ability to learn evolving patterns of attack makes it suitable for deployment in volatile environments, for example, in cloud computing, as well as widespread cybersecurity networks.
From a policy perspective, the proposed approach provides an effective analytical tool that can support evidence-based decision-making in cybersecurity governance. By enabling more accurate and adaptive recognition of ransomware threats, this model can inform the development of proactive cybersecurity policy, improve incident response protocols, and direct regulatory measures for the protection of critical infrastructure and sensitive data. Consequently, its utilization by policymakers, regulatory agencies, and industry stakeholders could enhance resilience against upcoming cyber threats and guide the creation of more successful national and organizational cybersecurity strategies.
Appendix I
List of abbreviations
Abbreviation | Definition | Abbreviation | Definition |
|---|---|---|---|
AES | Advanced Encryption Standard | LSTM | Long Short-Term Memory |
KNN | K-Nearest Neighbors | MCTS | Monte Carlo Tree Search |
AI | Artificial Intelligence | MHA-LSTM | Multi-Head Attention-based Long Short-Term Memory |
API | Application Programming Interface | MI | Mutual Information |
AUC | Area Under the Curve | ML | Machine Learning |
XGBoost | eXtreme Gradient Boosting | OS | Operating System |
BOA | Bonobo Optimization Algorithm | PSO | Particle Swarm Optimization |
BTC | Bitcoin | RaaS | Ransomware-as-a-Service |
CPU | Central Processing Unit | RF | Random Forest |
DBSCAN | Density-Based Spatial Clustering of Applications with Noise | RFE | Recursive Feature Elimination |
DBO | Dung Beetle Optimization | RFECV | Recursive Feature Elimination with Cross-Validation |
DL | Deep Learning | RFSA | Ransomware Feature Selection Algorithm |
DT | Decision Tree | ROC | The Receiver Operating Characteristic |
SVM | Support Vector Machine | RSA | Rivest–Shamir–Adleman (Asymmetric Encryption Algorithm) |
F1-score | Harmonic Mean of Precision and Recall | SAE | Stacked Autoencoder |
FeSA | Feature Selection Architecture | SCA | Sine Cosine Algorithm |
FN | False Negative | SCADL-RWDC | Sine Cosine Algorithm with Deep Learning-based Ransomware Detection and Classification |
FP | False Positive | TP | True Positive |
GB | Gradient boosting | TN | True Negative |
GRU | Gated Recurrent Unit | TSA | Tunicate Swarm Algorithm |
GTO | Gorilla Troop Optimization | TTPs | Tactics, Techniques, and Procedures |
HGWO | Hybrid Grey Wolf Optimizer | USD | United States Dollar |
IDS | Intrusion Detection System | WFH | Work from Home |
IoT | Internet of Things |
Appendix II
Bonobo optimization algorithm (BOA)
The Bonobo Optimization Algorithm (BOA) is a bio-inspired metaheuristic that mimics bonobos’ complex social behavior and mating habits to solve challenging optimization problems. In the current study, BOA was hybridized with Histogram Gradient Boosting Classification (HGBC) to develop the hybrid HGBO model, aiming to improve predictive power in ransomware detection [68]. The algorithm is designed based on the fission-fusion social structure observed in bonobos, where the population fluctuates between dividing into smaller subgroups and subsequently reassembling, thereby promoting the investigation of the solution space [69]. These subgroups partake in various simulated interactions—including consortship, sexual relations, extra-group mating, and restrictive mating—which play an important role in enhancing both the diversification and intensification of the search process. The most fit member of the population, known as the alpha bonobo, controls the creation of new solutions and guides the search towards optimal areas. Important parameters like phase change probability and directional probability control changes between exploration (promiscuous phase) and exploitation (restrictive phase). The offspring are accepted if they are better than their parents or the alpha ; otherwise, parameter updates are initiated to prevent stagnation. A flowchart outlines the iterative framework of the algorithm. In combination with HGBC, the ensuing HGBO hybrid enjoyed excellent performance in convergence speed and predictive power, surpassing other models equipped with optimization techniques [70].
Initialization of the undefined BOA parameters
Phase shift (cp.), extra-group mating chance (), stage probability (), short-term sub-group sizing aspect (), positive phase count (), negative phase count (), and probability of directional () were the two-phase conditions in the BO. The setup began as follows: The BO’s two-phase conditions are the following: positive phase count (), negative phase count (), phase change (), short-term sub-group sizing factor (tsgs factor), phase chance (), extra-group mating probability (), and probability of directed (). The setup began as follows:
1
The primary values of and were, respectively, f actor- initial and - initial.
The positive and negative phases
The illness progressed in two stages. It was calculated using phase possibility, which was established by either population diversity or alternative limitation.
The Bonobo selection using fission–fusion strategy
The BOA is described as a vast civilization that is briefly split up into smaller groups based on size. After a while, they return to their community. Initially, the maximum size of a temporary sub-group (referred to as ) is determined by the size of the whole population (). It is chosen in the following way as the greatest value between 2 and ():
2
Through trait exchange with the , the ability to produce a new bonobo is determined by the size factor of the transitory sub-group, . When the values are more than or equal to one, except for the ith-bonobo, the pth-bonobo is chosen at random from the whole population.
New Bonobo creation using various mating strategies
Four different mating strategies are employed by bonobos: consort ship, sexual activity, extra-group mating, and restrictive mating [71]. Bonobos employ social methods known as fission-fusion, which involve dispersing into smaller groups (fission) then reorganizing to perform specialized duties, such sharing a bed, through a range of activities (fusion) [72]. If the other random number () generated in the range of 0 to 1 is less than or equal to the chance of extra-group mating (), the outcome is modified using the extra-group mating approach described below:
Promiscuous and restrictive mating strategies
Using the alternative, the mating procedure is defined. The following is a new bonobo in Eq. (3):
3
) And () are the variables for the alpha bonobo and the new offspring, respectively. The alpha bonobo and the selected pth bonobo have participation scores of and scsb, respectively, whereas is a random number between and and is the range of 1 to all the components. Flags that indicate limited or sexually aberrant mating may have two values: or .
The strategies of consort ship and extra-group mating
The random creation of courtier ships and mating strategies according to stage () is represented by the extra mating possibility ().
4
5
6
7
8
9
10
Maximum and minimum border values are and , the random value is nonzero, and the influence of transformational leadership factors is and . The companion ship mating strategy produces more offspring when is greater than pxgm, as demonstrated in Eq. (11).
11
Variable boundary limiting conditions
To regulate pregnancy levels that beyond the limit, set upper and lower limits.
Offspring acceptance criteria
To restrict pregnancy levels that exceed the limit, provide minimum and maximum amounts. The worth of the new bonobo is determined by whether or not its fitness value is higher than that of the alpha and the bonobo it has supplanted in the general population.
Parameters’ updating
There are two instances. A new alpha bonobo in the current repeat is a better answer, and the variables are altered as follows in the first iteration compared to the previous one.
12
The alpha bonobo’s value stays the same from the previous iteration, while the other variables are modified in the way described below. The process of BOA is represented in the flowchart shown in Fig. 1-AII.
13
14
Here, and refer to the rate of phase probability change of rate and degree of phase change, respectively. The phase probability is initially assigned a neutral value of 0.5 so that there is an equal priority for both phases, but this probability dynamically changes during the iterations as per the behavior of the objective function and the optimization process. The maximum value of the temporary social group size factor () is specified by the user at the initial step, and the initial values of the extra-group mating probability () and the temporary sub-group size factor () are also calculated accordingly. That is, is calculated as half of . Moreover, if there is no improvement in the fitness of the alpha bonobo at an iteration, its corresponding parameters are updated adaptively based on pre-established rules to enhance the search capability of the algorithm and maintain diversity.
[See PDF for image]
Fig. 1-AII
The flowchart of the Bonobo model
Tunicate swarm algorithm (TSA)
The Tunicate Swarm Algorithm is an optimization technique based on natural phenomena, namely the movement and behavioral patterns of tunicates. These marine animals employ jet propulsion for movement in water. TSA is based on the behavior of creatures called tunicates, which are a few millimeters in size and resemble closed cylinders at one end. These tunicates’ bright bioluminescence, which emits a gentle blue-green light, makes them noticeable from a great distance [53]. Each tunicate’s gelatinous coating serves as a link between them all. However, each tunicate absorbs water from its surroundings and uses jet propulsion to move ahead by releasing water via the atrial siphons at its open end. The mathematical model for tunicates’ jet propulsion operations takes into account elements like avoiding collisions between possible solutions, getting closer to the best solution, and staying close to the ideal solution [73].
The research combines the Tabu Search Algorithm (TSA) and Histogram Gradient Boosting Classification (HGBC) to create the HGTS hybrid for enhancing the efficiency of ransomware detection. TSA has proven efficient in solving high-dimensional optimization problems, making it specifically suitable for the optimization of complex machine learning models. Its basic framework involves mechanisms for collision prevention, thus avoiding the clustering of solutions and maintaining diversity during the search process. It also allows for directional search towards optimal solutions, thus boosting convergence while reducing the tendency for premature optimization. The principles governing jet propulsion are expressed through differential equations that control velocity variations and positional changes, thus affecting the exploration phases of the search algorithm. In addition, the algorithm incorporates mathematical abstractions like gravitational forces, advection flows, and social weights to mimic the effect of environmental and social factors on agent motion.The introduction of an element of randomness is necessary if the algorithm is to deal adequately with biological variability and enhance its global search ability. The TSA update mechanism allows agents to move towards areas of optimality while retaining enough diversity to avoid becoming trapped in local optima. A flowchart of the TSA process provides an exhaustive overview of the process in its entirety. The hybrid model with HGTS showed impressive effectiveness when combined with HGBC, achieving a very good balance between convergence efficiency and the capacity for model generalization.
Preventing collisions between candidate solutions
Initialization is required for the gravitational force , constant parameter , social force , deep ocean water flow advection , and maximum iteration count .
15
16
17
18
is the gravitational force, and is the water flow advection in the deep ocean. is the social interaction forces among search agents. and are set at and, respectively, while , , and are random numbers that fall between and .
Taking more steps towards the location of the best solution
The search agents are directed toward their closest neighbors after successfully avoiding conflicts with nearby entities.
19
represents the current iteration in progress, indicates the position of the tunicates, represents the cumulative distance between the search agent and the food source, rand is a random value falling between and , and indicates the location of the source of food.
Remaining close to the best solution
The search agent may even become the most prominent search agent by solidifying its position.
20
The search agent may even become the most prominent search agent by solidifying its position.
21
Here, the tunicate’s updated position presents . The process of TSA is represented in the flowchart shown in Fig. 2-AII.
[See PDF for image]
Fig. 2-AII
The flowchart of the TSA model
Gorilla troops optimizer (GTO)
Gorilla Troops Optimizer (GTO) is a swarm metaheuristic inspired by the foraging behavior and collective social interactions of social gorillas. Gorillas, the largest living primates, are described as having strong family ties and close-knit troop structures typically led by a mature male ‘silverback’. This leader defends the group, dictates movement patterns, and guides members to valuable sources of food such as fruit and leaves. Migration is essential in the society of gorillas, with both males and females preferentially leaving their natal societies to join existing or form new troops. The silverback’s leadership and female bonds maintain groups and foster stability. The GTO algorithm simulates this process naturally through two primary phases: exploration and exploitation. The exploration phase employs three operators simulating moving to unknown locations, gorilla interaction, and relocation to familiar locations. The exploitation phase further refines the search process through operators that simulate following the silverback and fighting for females, thereby balancing the diversification and intensification of the search process [54]. The process of GTO is represented in the flowchart shown in Fig. 3-AII.
Exploration phase
A behavioral study of gorillas indicates that the primates typically live in groups under one silverback who leads them, although occasionally, people disperse and relocate to new areas. They encounter known and unknown gorillas. In GTO, each gorilla is a candidate solution, where the best-known solution in the population is the silverback. Each candidate gorilla’s (GX) is successively refreshed according to a given equation. A random parameter P, initially in the range [0, 1], governs the migration policy. If a random number is less than P, the gorilla migrates to an unfamiliar area; if the random value is greater than or equal to 0.5, it moves towards other gorillas; otherwise, it migrates to a familiar area by calling the third search mechanism.
22
Here, represents the position vector of an arbitrary candidate gorilla in the next iteration, while represents its current position. The values and specify the lower and upper limits of the decision variables. The expressions , , , are random numbers between [0, 1]. Furthermore, and represent the position vector of an arbitrary randomly selected gorilla. The constants , , and are computed according to specific equations to regulate the search behavior.
23
24
25
Where,
26
27
denotes the present iteration, and specifies the total allowable iterations. Additionally, is a random variable uniformly distributed in the range , and is randomly sampled from the interval .
Exploitation phase
The exploitation phase of the GTO algorithm exhibits two major behaviors: following the Silverback and Competing for Adult Females. In this phase, the silverback gorilla is the group leader, who makes all the decisions, chooses the direction of movement, and leads the group toward the food, and also safeguards the group from injury and keeps the group members together. All the other gorillas follow the orders of the silverback. But in the group, a blackback or other males may challenge and even take over the role of the silverback as it ages and weakens. In adult females, the algorithm applies either the Follow the Silverback or Competition mechanism, depending on the control parameter . Specifically, when , the gorillas will follow the silverback; otherwise, competition among adult females occurs.
Following the silverback.
When they are young, the silverback and other gorillas perform their duties effectively, with the males following the leader quite easily. Each member is also able to sway others, as mathematically formulated below:
28
Here, is the position vector of silverback (optimal solution so far).
29
30
is the total number of gorillas and is each gorilla’s position vector at iteration .
Competing for adult females.
A key maturity stage for young gorillas is competing with other males for females, often involving intense, multi-day rivalry that affects the whole group.
31
32
33
34
is the force effect and is a random variable in . is a coefficient vector that quantifies the severity of conflict in terms of a given parameter and . The parameter mimics the manner violence constrains the solution boundary through a threshold of : if , it is assigned random values based on the problem dimensions and a normal distribution; otherwise, has an arbitrary value within the normal distribution.
[See PDF for image]
Fig. 3-AII
The flowchart of the GTO model
Acknowledgements
I would like to take this opportunity to acknowledge that there are no individuals or organizations that require acknowledgment for their contributions to this work.
Author contributions
Kun Zhang: Supervision, Conceptualization, Project administration, Writing – Reviewing and Editing, Funding acquisition. Yetong Wang: Methodology, Investigation, Validation, Writing – Reviewing and Editing. Uzair Aslam Bhatti: Software, Data curation, Formal analysis, Writing – Reviewing and Editing. Yu Zhou: Resources, Visualization, Writing – Reviewing and Editing. Ming Jin: Data curation, Investigation, Writing – Original draft preparation, Writing – Reviewing and Editing.
Funding
This work was supported by the Hainan Province Science and Technology Special Fund (Fund No. ZDYF2024GXJS034, ZDYF2021GXJS032); Hainan Engineering Research Center for Virtual Reality Technology and Systems (Fund No. Qiong fa Gai gao ji [2023] 818); Hainan Engineering Research Center for Smart Education Technology (Fund No. Qiong fa Gai gao ji [2023] 818); the Innovation Platform for Academicians of Hainan Province (Fund No. YSPTZX202036); the Sanya Science and Technology Special Fund (Fund No. 2022KJCX30).
Data availability
No datasets were generated or analysed during the current study.
Declarations
Ethical approval
The research paper has received ethical approval from the institutional review board, ensuring the protection of participants’ rights and compliance with the relevant ethical guidelines.
Competing interests
The authors declare no competing interests.
Publisher’s note
Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.
References
1. Malik S, Shanmugam B, Kannorpatti K, Azam S. Critical feature selection for machine learning approaches to detect ransomware. Int J Comput Digit Syst. 2022;11(1).
2. Alqahtani, A; Sheldon, FT. A survey of Crypto ransomware attack detection methodologies: an evolving outlook. Sensors; 2022; 22,
3. Tang, F; Ma, B; Li, J; Zhang, F; Su, J; Ma, J. RansomSpector: an introspection-based approach to detect Crypto ransomware. Comput Secur; 2020; 97, 101997. [DOI: https://dx.doi.org/10.1016/j.cose.2020.101997]
4. Pestovska Z, ІІІ., Changes in the financial services market under the influence of AI. Artificial Intelligence as a basis for the development of the digital economy. 2021;85.
5. Gupta A, Sharma V, Srivastava R. BISRAC Banking Information Security Risk Assessment and Compliance Model. In: 2021 3rd International Conference on Advances in Computing, Communication Control and Networking (ICAC3N). IEEE; 2021. pp. 1447–52.
6. Urooj, U; Al-rimy, BAS; Zainal, A; Ghaleb, FA; Rassam, MA. Ransomware detection using the dynamic analysis and machine learning: A survey and research directions. Appl Sci; 2021; 12,
7. Horduna M, Lăzărescu SM, Simion E. A note on machine learning applied in ransomware detection. Cryptol ePrint Archive. 2023.
8. Smith, D; Khorsandroo, S; Roy, K. Machine learning algorithms and frameworks in ransomware detection. IEEE Access; 2022; 10, pp. 117597-610. [DOI: https://dx.doi.org/10.1109/ACCESS.2022.3218779]
9. Cohen, A; Nissim, N. Trusted detection of ransomware in a private cloud using machine learning methods leveraging meta-features from volatile memory. Expert Syst Appl; 2018; 102, pp. 158-78. [DOI: https://dx.doi.org/10.1016/j.eswa.2018.02.039]
10. Bae, S; Il, Lee, G; Bin, Im, EG. Ransomware detection using machine learning algorithms. Concurr Comput; 2020; 32,
11. Kapoor, A; Gupta, A; Gupta, R; Tanwar, S; Sharma, G; Davidson, IE. Ransomware detection, avoidance, and mitigation scheme: a review and future directions. Sustainability; 2021; 14,
12. Al-Fawa’reh, M; Ashi, Z; Jafar, MT. Detecting malicious Dns queries over encrypted tunnels using statistical analysis and bi-directional recurrent neural networks. Karbala Int J Mod Sci; 2021; 7,
13. Fernando, DW; Komninos, N; Chen, T. A study on the evolution of ransomware detection using machine learning and deep learning techniques. IoT; 2020; 1,
14. Hsu, CM; Yang, CC; Cheng, HH; Setiasabda, PE; Leu, JS. Enhancing file entropy analysis to improve machine learning detection rate of ransomware. IEEE Access; 2021; 9, pp. 138345-51. [DOI: https://dx.doi.org/10.1109/ACCESS.2021.3114148]
15. Yamany, B; Elsayed, MS; Jurcut, AD; Abdelbaki, N; Azer, MA. A new scheme for ransomware classification and clustering using static features. Electron (Basel); 2022; 11,
16. Adamu U, Awan I. Ransomware prediction using supervised learning algorithms. In: 2019 7th International Conference on Future Internet of Things and Cloud (FiCloud). IEEE; 2019. pp. 57–63.
17. El Emary, IMM; Yaghi, KA. Machine learning classifier algorithms for ransomware lockbit prediction. J Appl Data Sci; 2024; 5,
18. Savage, K; Coogan, P; Lau, H. The evolution of ransomware; 2015; Mountain View, Symantec:
19. Malik V, Khanna A, Sharma N. Trends in ransomware attacks: analysis and future predictions. Int J Global Innovations Solutions (IJGIS). 2024.
20. Warkentin N, Zhang Y, Frank R. The business of ransomware and its effects on business. J Cyber Secur Technol. 2025;1–31.
21. El-Kenawy, ESM; Zerouali, B; Bailek, N; Bouchouich, K; Hassan, MA; Almorox, J et al. Improved weighted ensemble learning for predicting the daily reference evapotranspiration under the semi-arid climate conditions. Environ Sci Pollut Res; 2022; 29,
22. Mizdrakovic, V; Kljajic, M; Zivkovic, M; Bacanin, N; Jovanovic, L; Deveci, M et al. Forecasting bitcoin: decomposition aided long short-term memory based time series modeling and its explanation with Shapley values. Knowl Based Syst; 2024; 299, 112026. [DOI: https://dx.doi.org/10.1016/j.knosys.2024.112026]
23. Mohamed A, Mahmood S. K-Nearest neighbors approach to analyze and predict air quality in Delhi. J Artif Intell Metaheuristics. 2025;no.:34–43.
24. El-kenawy, EM. A review of machine learning models for predicting air quality in urban areas. Metaheuristic Optim Rev; 2025; 3,
25. Samee NA, El-Kenawy ESM, Atteia G, Jamjoom MM, Ibrahim A, Abdelhamid AA, et al. Metaheuristic optimization through deep learning classification of COVID-19 in chest X-Ray images. Computers Mater Continua. 2022;73(2).
26. El-Kenawy, ESM; Khodadadi, N; Mirjalili, S; Abdelhamid, AA; Eid, MM; Ibrahim, A. Greylag Goose optimization: nature-inspired optimization algorithm. Expert Syst Appl; 2024; 238, 122147. [DOI: https://dx.doi.org/10.1016/j.eswa.2023.122147]
27. Bacanin N, Jovanovic L, Zivkovic M, Zivkovic T, Bisevac P, Dobrojevic M, et al. Parkinson’s disease detection with deep long Short-term memory networks optimized by modified metaheuristic algorithm. Collective intelligence. CRC; 2024. pp. 204–29.
28. Elshewey, AM; Abed, AH; Khafaga, DS; Alhussan, AA; Eid, MM; El-Kenawy, ESM. Enhancing heart disease classification based on Greylag Goose optimization algorithm and long short-term memory. Sci Rep; 2025; 15,
29. Tarek, Z; Alhussan, AA; Khafaga, DS; El-Kenawy, ESM; Elshewey, AM. A snake optimization algorithm-based feature selection framework for rapid detection of cardiovascular disease in its early stages. Biomed Signal Process Control; 2025; 102, 107417. [DOI: https://dx.doi.org/10.1016/j.bspc.2024.107417]
30. Elshewey, AM; Alhussan, AA; Khafaga, DS; Elkenawy, ESM; Tarek, Z. EEG-based optimization of eye state classification using modified-BER metaheuristic algorithm. Sci Rep; 2024; 14,
31. Elshewey, AM; Osman, AM. Orthopedic disease classification based on breadth-first search algorithm. Sci Rep; 2024; 14,
32. El-Rashidy, N; Tarek, Z; Elshewey, AM; Shams, MY. Multitask multilayer-prediction model for predicting mechanical ventilation and the associated mortality rate. Neural Comput Appl; 2025; 37,
33. Wa Nkongolo MN. RFSA: A Ransomware feature selection algorithm for multivariate analysis of malware behavior in cryptocurrency. 2024.
34. Davies SR, Macfarlane R, Buchanan WJ. Differential area analysis for ransomware attack detection within mixed file datasets. Comput Secur [Internet]. 2021;108:102377. Available from: https://www.sciencedirect.com/science/article/pii/S0167404821002017
35. Gurukala, NKY; Verma, DK. Feature selection using particle swarm optimization and Ensemble-based machine learning models for ransomware detection. SN Comput Sci; 2024; 5,
36. Mowri RA, Siddula M, Roy K. A comparative performance analysis of explainable machine learning models with and without Rfecv feature selection technique towards ransomware classification. ArXiv Preprint arXiv:221204864. 2022.
37. Fernando, DW; Komninos, N. FeSA: feature selection architecture for ransomware detection under concept drift. Comput Secur; 2022; 116, 102659. [DOI: https://dx.doi.org/10.1016/j.cose.2022.102659]
38. Li, J; Othman, MS; Chen, H; Yusuf, LM. Optimizing IoT intrusion detection system: feature selection versus feature extraction in machine learning. J Big Data; 2024; 11,
39. Salem AH, Azzam SM, Emam OE, Abohany AA. Advancing cybersecurity: a comprehensive review of AI-driven detection techniques. J Big Data. 2024;11(1):105. Available from: https://doi.org/10.1186/s40537-024-00957-y
40. Nkongolo M, Tokmak M. Ransomware detection using stacked autoencoder for feature selection. ArXiv Preprint arXiv:240211342. 2024.
41. Li G, Wang S, Chen Y, Zhou J, Zhao Q. A hybrid framework for ransomware detection using deep learning and Monte Carlo tree search. 2024.
42. Alohali MA, Elsadig M, Al-Wesabi FN, Al Duhayyim M, Hilal AM, Motwakel A. Optimal deep learning based ransomware detection and classification in the internet of things environment. Comput Syst Sci Eng. 2023;46(3).
43. UGRansome dataset [Internet]. Available from: https://www.kaggle.com/datasets/nkongolo/ugransome-dataset
44. Zahra SR, UGRansome. Optimal Approach for Anomaly Intrusion Detection and Zero-day Threats using Cloud Environment.
45. Igugu A. Evaluating the Effectiveness of AI and Machine Learning Techniques for Zero-Day Attacks Detection in Cloud Environments. 2024.
46. Su, R. Generative mathematical models for ransomware attack prediction using Chi-Square feature selection for enhanced accuracy. Signal Image Video Process; 2025; 19,
47. Rios-Ochoa E, Pérez-Díaz JA, Garcia-Ceja E, Rodriguez-Hernandez G. Ransomware family attribution with ML: A comprehensive evaluation of datasets quality, models comparison and a simulated deployment. IEEE Access. 2025.
48. Torky B. Ensemble methods for the anomaly detection in enterprise systems. 2023.
49. Mondal, S; Ghosh, S; Nag, A. Brain stroke prediction model based on boosting and stacking ensemble approach. Int J Inform Technol; 2024; 16,
50. Gandomi AH, Yang XS, Talatahari S, Alavi AH. Metaheuristic algorithms. Metaheuristic applications in structures and infrastructures. Elsevier Waltham; 2013. pp. 1–24.
51. Benaissa B, Kobayashi M, Al Ali M, Khatir T, Elmeliani MEAE. Metaheuristic optimization algorithms: an overview. HCMCOU J Science–Advances Comput Struct. 2024;33–61.
52. Das AK, Pratihar DK. A new bonobo optimizer (BO) for real-parameter optimization. In: 2019 IEEE region 10 symposium (TENSYMP). IEEE; 2019. pp. 108–13.
53. Kaur, S; Awasthi, LK; Sangal, AL; Dhiman, G. Tunicate swarm algorithm: A new bio-inspired based metaheuristic paradigm for global optimization. Eng Appl Artif Intell; 2020; 90, 103541. [DOI: https://dx.doi.org/10.1016/j.engappai.2020.103541]
54. Abdollahzadeh, B; Soleimanian Gharehchopogh, F; Mirjalili, S. Artificial Gorilla troops optimizer: a new nature-inspired metaheuristic algorithm for global optimization problems. Int J Intell Syst; 2021; 36,
55. Wang, Y; Xu, S. 28-day compressive strength prediction utilizing a radial basis function model incorporating meta-heuristic algorithms. Multiscale Multidisciplinary Model Experiments Des; 2024; 7,
56. Zheng R, Hussien AG, Bouaouda A, Zhong R, Hu G. A comprehensive review of the tunicate swarm algorithm: variations, applications, and results. Arch Comput Methods Eng. 2025;1–70.
57. Zhang, H; Razmjooy, N. Optimal Elman neural network based on improved Gorilla troops optimizer for short-term electricity price prediction. J Electr Eng Technol; 2024; 19,
58. Bichri H, Chergui A, Hain M. Investigating the impact of train/test split ratio on the performance of Pre-Trained models with custom datasets. Int J Adv Comput Sci Appl. 2024;15(2).
59. Tamilarasi P, Rani RU. Diagnosis of crime rate against women using k-fold cross validation through machine learning. In: 2020 fourth international conference on computing methodologies and communication (ICCMC). IEEE; 2020. pp. 1034–8.
60. Marcot, BG; Hanea, AM. What is an optimal value of k in k-fold cross-validation in discrete bayesian network analysis?. Comput Stat; 2021; 36,
61. Van Stein, B; Raponi, E; Sadeghi, Z; Bouman, N; Van Ham, RCHJ; Bäck, T. A comparison of global sensitivity analysis methods for explainable AI with an application in genomic prediction. IEEE Access; 2022; 10, pp. 103364-81. [DOI: https://dx.doi.org/10.1109/ACCESS.2022.3210175]
62. Iooss, B; Lemaître, P. A review on global sensitivity analysis methods. Uncertain Manage simulation-optimization Complex Systems: Algorithms Appl; 2015; 101, 22.
63. Granados GE, Miorelli R, Gatti F, Clouteau D. A deep learning framework for efficient global sensitivity analysis and shap values calculations applied to eddy current testing problems. In: 50th annual review of progress in quantitative nondestructive evaluation. American Society of Mechanical Engineers; 2023. p. V001T10A001.
64. Derrac J, García S, Molina D, Herrera F. A practical tutorial on the use of nonparametric statistical tests as a methodology for comparing evolutionary and swarm intelligence algorithms. Swarm Evol Comput. 2011;1(1):3–18. Available from: https://www.sciencedirect.com/science/article/pii/S2210650211000034
65. Flores, BE. The utilization of the Wilcoxon test to compare forecasting methods: A note. Int J Forecast; 1989; 5,
66. Biju, VG; Prashanth, CM. Friedman and Wilcoxon evaluations comparing SVM, bagging, boosting, K-NN and decision tree classifiers. J Appl Comput Sci Methods; 2017; 9, pp. 23-47. [DOI: https://dx.doi.org/10.1515/jacsm-2017-0002]
67. Zhang, H; Xiao, X; Mercaldo, F; Ni, S; Martinelli, F; Sangaiah, AK. Classification of ransomware families with machine learning based onN-gram of opcodes. Future Generation Comput Syst; 2019; 90, pp. 211-21. [DOI: https://dx.doi.org/10.1016/j.future.2018.07.052]
68. Das AK, Pratihar DK. Optimal preventive maintenance interval for a Crankshaft balancing machine under reliability constraint using Bonobo Optimizer. In: Advances in Mechanism and Machine Science: Proceedings of the 15th IFToMM World Congress on Mechanism and Machine Science 15. Springer; 2019. pp. 1659–68.
69. Farh HMH, Al-Shamma’a AA, Al-Shaalan AM, Alkuhayli A, Noman AM, Kandil T. Technical and Economic Evaluation for Off-Grid Hybrid Renewable Energy System Using Novel Bonobo Optimizer. Sustainability 2022, 14, 1533. s Note: MDPI stays neu-tral with regard to jurisdictional claims in …. 2022.
70. Farh, HMH; Al-Shamma’a, AA; Al-Shaalan, AM; Alkuhayli, A; Noman, AM; Kandil, T. Technical and economic evaluation for off-grid hybrid renewable energy system using novel Bonobo optimizer. Sustainability; 2022; 14,
71. Smith, JE; von Rueden, CR; van Vugt, M; Fichtel, C; Kappeler, PM. An evolutionary explanation for the female leadership paradox. Front Ecol Evol; 2021; 9, 676805. [DOI: https://dx.doi.org/10.3389/fevo.2021.676805]
72. Das, AK; Nikum, AK; Krishnan, SV; Pratihar, DK. Multi-objective Bonobo optimizer (MOBO): an intelligent heuristic for multi-criteria optimization. Knowl Inf Syst; 2020; 62,
73. Sharma, A; Dasgotra, A; Tiwari, SK; Sharma, A; Jately, V; Azzopardi, B. Parameter extraction of photovoltaic module using tunicate swarm algorithm. Electron (Basel); 2021; 10,
© The Author(s) 2025. This work is published under http://creativecommons.org/licenses/by-nc-nd/4.0/ (the “License”). Notwithstanding the ProQuest Terms and Conditions, you may use this content in accordance with the terms of the License.