Genshield AI: Intelligent Ransomware Detection and Prevention Using Generative AI

1. Al-rimy, B.A.S., Maarof, M.A. and Shaid, S.Z.M. (2018) 'Ransomware threat success factors, taxonomy, and countermeasures: A survey and research directions', Computers & Security, 74, pp. 144–166. Available at: https://doi.org/10.1016/j.cose.2018.01.001.
2. Alam, M.T., Bhusal, D., Nguyen, L. and Rastogi, N. (2024) 'CTIBench: A benchmark for evaluating LLMs in cyber threat intelligence', in Advances in Neural Information Processing Systems 37 (NeurIPS 2024), Datasets and Benchmarks Track, pp. 50805–50825. Available at: https://doi.org/10.52202/079017-1607.
3. Anderson, H.S. and Roth, P. (2018) 'EMBER: An open dataset for training static PE malware machine learning models', arXiv preprint, arXiv:1804.04637 [not peer reviewed]. Available at: https://arxiv.org/abs/1804.04637.
4. Arp, D., Quiring, E., Pendlebury, F., Warnecke, A., Pierazzi, F., Wressnegger, C., Cavallaro, L. and Rieck, K. (2024) 'Pitfalls in machine learning for computer security', Communications of the ACM, 67(11), pp. 104–112. Available at: https://doi.org/10.1145/3643456.
5. Ashwini, K. and Nagasundara, K.B. (2024) 'An intelligent ransomware attack detection and classification using dual vision transformer with Mantis Search Split Attention Network', Computers and Electrical Engineering, 119, 109509. Available at: https://doi.org/10.1016/j.compeleceng.2024.109509.
6. Barnes, G. and Ghafarian, A. (2026) 'Machine learning-based static ransomware detection using PE header features and SHAP interpretation', Journal of Cybersecurity and Privacy, 6(2), 58. Available at: https://doi.org/10.3390/jcp6020058.
7. Beaman, C., Barkworth, A., Akande, T.D., Hakak, S. and Khan, M.K. (2021) 'Ransomware: Recent advances, analysis, challenges and future research directions', Computers & Security, 111, 102490. Available at: https://doi.org/10.1016/j.cose.2021.102490.
8. Berrios Vasquez, S.I., Hermosilla Monckton, P.A., Leiva Muñoz, D.I. and Allende, H. (2025) 'Zero-day threat mitigation via deep learning in cloud environments', Applied Sciences, 15(14), 7885. Available at: https://doi.org/10.3390/app15147885.
9. Brown, T. et al. (2020) 'Language models are few-shot learners', in Advances in Neural Information Processing Systems 33 (NeurIPS 2020), pp. 1877–1901. Available at: https://proceedings.neurips.cc/paper/2020/hash/1457c0d6bfcb4967418bfb8ac142f64a-Abstract.html.
10. Capuano, N., Fenza, G., Loia, V. and Stanzione, C. (2022) 'Explainable artificial intelligence in cybersecurity: A survey', IEEE Access, 10, pp. 93575–93600. Available at: https://doi.org/10.1109/ACCESS.2022.3204171.
11. Carrier, T., Victor, P., Tekeoglu, A. and Lashkari, A. (2022) 'Detecting obfuscated malware using memory feature engineering', in Proceedings of the 8th International Conference on Information Systems Security and Privacy (ICISSP 2022). Setúbal: SciTePress, pp. 177–188. Available at: https://doi.org/10.5220/0010908200003120.
12. Cen, M., Deng, X., Jiang, F. and Doss, R. (2024b) 'Zero-Ran Sniff: A zero-day ransomware early detection method based on zero-shot learning', Computers & Security, 142, 103849. Available at: https://doi.org/10.1016/j.cose.2024.103849.
13. Cen, M., Jiang, F., Qin, X., Jiang, Q. and Doss, R. (2024a) 'Ransomware early detection: A survey', Computer Networks, 239, 110138. Available at: https://doi.org/10.1016/j.comnet.2023.110138.
14. Cevallos-Salas, D., Grijalva, F., Estrada-Jiménez, J., Benítez, D. and Andrade, R. (2024) 'Obfuscated privacy malware classifiers based on memory dumping analysis', IEEE Access, 12, pp. 17481–17498. Available at: https://doi.org/10.1109/ACCESS.2024.3358840.
15. Chainalysis (2025) 35% year-over-year decrease in ransomware payments, less than half of recorded incidents resulted in victim payments. Chainalysis Blog, 5 February. Available at: https://www.chainalysis.com/blog/crypto-crime-ransomware-victim-extortion-2025/ (Accessed: 1 November 2026).
16. Chandola, V., Banerjee, A. and Kumar, V. (2009) 'Anomaly detection: A survey', ACM Computing Surveys, 41(3), pp. 1–58. Available at: https://doi.org/10.1145/1541880.1541882.
17. Chen, T. and Guestrin, C. (2016) 'XGBoost: A scalable tree boosting system', in Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. New York: ACM, pp. 785–794. Available at: https://doi.org/10.1145/2939672.2939785.
18. CISA, MS-ISAC, NSA and FBI (2023) #StopRansomware guide. Washington, DC: Cybersecurity and Infrastructure Security Agency. Available at: https://www.cisa.gov/stopransomware/ransomware-guide (Accessed: 1 November 2026).
19. Continella, A., Guagnelli, A., Zingaro, G., De Pasquale, G., Barenghi, A., Zanero, S. and Maggi, F. (2016) 'ShieldFS: A self-healing, ransomware-aware filesystem', in Proceedings of the 32nd Annual Conference on Computer Security Applications (ACSAC '16). New York: ACM, pp. 336–347. Available at: https://doi.org/10.1145/2991079.2991110.
20. Davidian, M., Kiperberg, M. and Vanetik, N. (2024) 'Early ransomware detection with deep learning models', Future Internet, 16(8), 291. Available at: https://doi.org/10.3390/fi16080291.
21. Deldar, F. and Abadi, M. (2023) 'Deep learning for zero-day malware detection and classification: A survey', ACM Computing Surveys, 56(2), pp. 1–37. Available at: https://doi.org/10.1145/3605775.
22. Demetrio, L., Coull, S.E., Biggio, B., Lagorio, G., Armando, A. and Roli, F. (2021) 'Adversarial EXEmples: A survey andexperimental evaluation of practical attacks on machine learning for Windows malware detection', ACM Transactions on Privacy and Security, 24(4), pp. 1–31. Available at: https://doi.org/10.1145/3473039.
23. Dosovitskiy, A. et al. (2021) 'An image is worth 16x16 words: Transformers for image recognition at scale', in International Conference on Learning Representations (ICLR 2021). Available at: https://openreview.net/forum?id=YicbFdNTTy.
24. ENISA (2025) ENISA threat landscape 2025. Athens: European Union Agency for Cybersecurity. Available at: https://www.enisa.europa.eu/Publications/Enisa-Threat-Landscape-2025 (Accessed: 1 November 2026).
25. Ferdous, J., Islam, R., Mahboubi, A. and Islam, M.Z. (2024) 'AI-based ransomware detection: A comprehensive review', IEEE Access, 12, pp. 136666–136695. Available at: https://doi.org/10.1109/ACCESS.2024.3461965.
26. Fernando, D.W., Komninos, N. and Chen, T. (2020) 'A study on the evolution of ransomware detection using machine learning and deep learning techniques', IoT, 1(2), pp. 551–604. Available at: https://doi.org/10.3390/iot1020030.
27. Ferrag, M.A., Alwahedi, F., Battah, A., Cherif, B., Mechri, A., Tihanyi, N., Bisztray, T. and Debbah, M. (2025) 'Generative AI in cybersecurity: A comprehensive review of LLM applications and vulnerabilities', Internet of Things and Cyber-Physical Systems, 5, pp. 1–46. Available at: https://doi.org/10.1016/j.iotcps.2025.01.001.
28. Gazzan, M. and Sheldon, F.T. (2024) 'Novel ransomware detection exploiting uncertainty and calibration quality measures using deep learning', Information, 15(5), 262. Available at: https://doi.org/10.3390/info15050262.
29. Gemini Team, Google (2024) 'Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context', arXiv preprint, arXiv:2403.05530 [not peer reviewed]. Available at: https://arxiv.org/abs/2403.05530.
30. Ghourabi, A. and Chouaib, H. (2026) 'A ransomware detection approach based on LLM embedding and ensemble learning', Computers, Materials & Continua, 87(1), 98. Available at: https://doi.org/10.32604/cmc.2026.074505.
31. Gómez-Hernández, J.A., Álvarez-González, L. and García-Teodoro, P. (2018) 'R-Locker: Thwarting ransomware action through a honeyfile-based approach', Computers & Security, 73, pp. 389–398. Available at: https://doi.org/10.1016/j.cose.2017.11.019.
32. Google AI for Developers (2026) Gemini API: Deprecations. Last updated 22 October 2026. Available at: https://ai.google.dev/gemini-api/docs/deprecations (Accessed: 1 November 2026).
33. Greshake, K., Abdelnabi, S., Mishra, S., Endres, C., Holz, T. and Fritz, M. (2023) 'Not what you've signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection', in Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security (AISec '23). New York: ACM, pp. 79–90. Available at: https://doi.org/10.1145/3605764.3623985.
34. Gulmez, S., Gorgulu Kakisim, A. and Sogukpinar, I. (2024) 'XRan: Explainable deep learning-based ransomware detection using dynamic analysis', Computers & Security, 139, 103703. Available at: https://doi.org/10.1016/j.cose.2024.103703.
35. Guo, C., Pleiss, G., Sun, Y. and Weinberger, K.Q. (2017) 'On calibration of modern neural networks', in Proceedings of the 34th International Conference on Machine Learning. Proceedings of Machine Learning Research, 70, pp. 1321–1330. Available at: https://proceedings.mlr.press/v70/guo17a.html.
36. Gupta, M., Akiri, C., Aryal, K., Parker, E. and Praharaj, L. (2023) 'From ChatGPT to ThreatGPT: Impact of generative AI in cybersecurity and privacy', IEEE Access, 11, pp. 80218–80245. Available at: https://doi.org/10.1109/ACCESS.2023.3300381.
37. Hendrycks, D. and Gimpel, K. (2017) 'A baseline for detecting misclassified and out-of-distribution examples in neural networks', in International Conference on Learning Representations (ICLR 2017). Available at: https://openreview.net/forum?id=Hkg4TI9xl.
38. Homayoun, S., Dehghantanha, A., Ahmadzadeh, M., Hashemi, S. and Khayami, R. (2020) 'Know abnormal, find evil: Frequent pattern mining for ransomware threat hunting and intelligence', IEEE Transactions on Emerging Topics in Computing, 8(2), pp. 341–351. Available at: https://doi.org/10.1109/TETC.2017.2756908.
39. Huang, L. et al. (2025) 'A survey on hallucination in large language models: Principles, taxonomy, challenges, and open questions', ACM Transactions on Information Systems, 43(2), pp. 1–55. Available at: https://doi.org/10.1145/3703155.
40. Hussain, A., Saadia, A., Alhussein, M., Gul, A. and Aurangzeb, K. (2024) 'Enhancing ransomware defense: Deep learning-based detection and family-wise classification of evolving threats', PeerJ Computer Science, 10, e2546. Available at: https://doi.org/10.7717/peerj-cs.2546.
41. Kapoor, S. and Narayanan, A. (2023) 'Leakage and the reproducibility crisis in machine-learning-based science', Patterns, 4(9), 100804. Available at: https://doi.org/10.1016/j.patter.2023.100804.
42. Kaur, R., Gabrijelčič, D. and Klobučar, T. (2023) 'Artificial intelligence for cybersecurity: Literature review and future research directions', Information Fusion, 97, 101804. Available at: https://doi.org/10.1016/j.inffus.2023.101804.
43. Kharraz, A., Arshad, S., Mulliner, C., Robertson, W. and Kirda, E. (2016) 'UNVEIL: A large-scale, automated approach to detecting ransomware', in Proceedings of the 25th USENIX Security Symposium. Austin, TX: USENIX Association. Available at: https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/kharaz.
44. Kharraz, A., Robertson, W., Balzarotti, D., Bilge, L. and Kirda, E. (2015) 'Cutting the Gordian knot: A look under the hood of ransomware attacks', in Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA 2015). Lecture Notes in Computer Science, vol. 9148. Cham: Springer, pp. 3–24. Available at: https://doi.org/10.1007/978-3-319-20550-2_1.
45. Kolodenker, E., Koch, W., Stringhini, G. and Egele, M. (2017) 'PayBreak: Defense against cryptographic ransomware', in Proceedings of the 2017 ACM Asia Conference on Computer and Communications Security (ASIA CCS '17). New York: ACM, pp. 599–611. Available at: https://doi.org/10.1145/3052973.3053035.
46. Kritika (2025) 'A comprehensive literature review on ransomware detection using deep learning', Cyber Security and Applications, 3, 100078. Available at: https://doi.org/10.1016/j.csa.2024.100078.
47. Liu, F.T., Ting, K.M. and Zhou, Z.-H. (2008) 'Isolation forest', in 2008 Eighth IEEE International Conference on Data Mining (ICDM). Pisa: IEEE, pp. 413–422. Available at: https://doi.org/10.1109/ICDM.2008.17.
48. Lundberg, S.M. and Lee, S.-I. (2017) 'A unified approach to interpreting model predictions', in Advances in Neural Information Processing Systems 30 (NIPS 2017). Available at: https://proceedings.neurips.cc/paper/2017/hash/8a20a8621978632d76c43dfd28b67767-Abstract.html.
49. Lundberg, S.M. et al. (2020) 'From local explanations to global understanding with explainable AI for trees', Nature Machine Intelligence, 2(1), pp. 56–67. Available at: https://doi.org/10.1038/s42256-019-0138-9.
50. McIntosh, T., Kayes, A.S.M., Chen, Y.-P.P., Ng, A. and Watters, P. (2021) 'Ransomware mitigation in the modern era: A comprehensive review, research challenges, and future directions', ACM Computing Surveys, 54(9), pp. 1–36. Available at: https://doi.org/10.1145/3479393.
51. Microsoft (2026) PE format. Microsoft Learn, updated 10 September 2026. Available at: https://learn.microsoft.com/en-us/windows/win32/debug/pe-format (Accessed: 1 November 2026).
52. Mirsky, Y., Doitshman, T., Elovici, Y. and Shabtai, A. (2018) 'Kitsune: An ensemble of autoencoders for online network intrusion detection', in Proceedings of the Network and Distributed System Security Symposium (NDSS 2018). San Diego, CA: Internet Society. Available at: https://doi.org/10.14722/ndss.2018.23204.
53. MITRE (2026) Data encrypted for impact, technique T1486 – Enterprise (version 1.5). MITRE ATT&CK. Available at: https://attack.mitre.org/techniques/T1486/ (Accessed: 1 November 2026).
54. Moussaileb, R., Cuppens, N., Lanet, J.-L. and Le Bouder, H. (2021) 'A survey on Windows-based ransomware taxonomy and detection mechanisms', ACM Computing Surveys, 54(6), pp. 1–36. Available at: https://doi.org/10.1145/3453153.
55. Nelson, A., Rekhi, S., Souppaya, M. and Scarfone, K. (2025) Incident response recommendations and considerations for cybersecurity risk management: A CSF 2.0 community profile. NIST Special Publication 800-61r3. Gaithersburg, MD: National Institute of Standards and Technology. Available at: https://doi.org/10.6028/NIST.SP.800-61r3.
56. NIST (2024a) Artificial intelligence risk management framework: Generative artificial intelligence profile. NIST AI 600-1. Gaithersburg, MD: National Institute of Standards and Technology. Available at: https://doi.org/10.6028/NIST.AI.600-1.
57. NIST (2024b) The NIST cybersecurity framework (CSF) 2.0. NIST Cybersecurity White Paper 29. Gaithersburg, MD: National Institute of Standards and Technology. Available at: https://doi.org/10.6028/NIST.CSWP.29.
58. OWASP (2025) 2025 top 10 risk and mitigations for LLMs and Gen AI apps. OWASP GenAI Security Project. Available at: https://genai.owasp.org/llm-top-10/ (Accessed: 1 November 2026).
59. Oz, H., Aris, A., Levi, A. and Uluagac, A.S. (2022) 'A survey on ransomware: Evolution, taxonomy, and defense solutions', ACM Computing Surveys, 54(11s), pp. 1–37. Available at: https://doi.org/10.1145/3514229.
60. Pang, G., Shen, C., Cao, L. and van den Hengel, A. (2021) 'Deep learning for anomaly detection: A review', ACM Computing Surveys, 54(2), pp. 1–38. Available at: https://doi.org/10.1145/3439950.
61. Paszke, A. et al. (2019) 'PyTorch: An imperative style, high-performance deep learning library', in Advances in Neural Information Processing Systems 32 (NeurIPS 2019). Available at: https://proceedings.neurips.cc/paper/2019/hash/bdbca288fee7f92f2bfa9f7012727740-Abstract.html.
62. Patsakis, C., Casino, F. and Lykousas, N. (2024) 'Assessing LLMs in malicious code deobfuscation of real-world malware campaigns', Expert Systems with Applications, 256, 124912. Available at: https://doi.org/10.1016/j.eswa.2024.124912.
63. Pedregosa, F. et al. (2011) 'Scikit-learn: Machine learning in Python', Journal of Machine Learning Research, 12(85), pp. 2825–2830. Available at: https://jmlr.org/papers/v12/pedregosa11a.html.
64. Pendlebury, F., Pierazzi, F., Jordaney, R., Kinder, J. and Cavallaro, L. (2019) 'TESSERACT: Eliminating experimental bias in malware classification across space and time', in Proceedings of the 28th USENIX Security Symposium. Santa Clara, CA: USENIX Association, pp. 729–746. Available at: https://www.usenix.org/conference/usenixsecurity19/presentation/pendlebury.
65. Razaulla, S., Fachkha, C., Markarian, C., Gawanmeh, A., Mansoor, W., Fung, B.C.M. and Assi, C. (2023) 'The age of ransomware: A survey on the evolution, taxonomy, and research directions', IEEE Access, 11, pp. 40698–40723. Available at: https://doi.org/10.1109/ACCESS.2023.3268535.
66. Ribeiro, M.T., Singh, S. and Guestrin, C. (2016) '"Why should I trust you?": Explaining the predictions of any classifier', in Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. New York: ACM, pp. 1135–1144. Available at: https://doi.org/10.1145/2939672.2939778.
67. Rjoub, G., Bentahar, J., Abdel Wahab, O., Mizouni, R., Song, A., Cohen, R., Otrok, H. and Mourad, A. (2023) 'A survey on explainable artificial intelligence for cybersecurity', IEEE Transactions on Network and Service Management, 20(4), pp. 5115–5140. Available at: https://doi.org/10.1109/TNSM.2023.3282740.
68. Saqib, M., Mahdavifar, S., Fung, B.C.M. and Charland, P. (2024) 'A comprehensive analysis of explainable AI for malware hunting', ACM Computing Surveys, 56(12), 314. Available at: https://doi.org/10.1145/3677374.
69. Scaife, N., Carter, H., Traynor, P. and Butler, K.R.B. (2016) 'CryptoLock (and drop it): Stopping ransomware attacks on user data', in 2016 IEEE 36th International Conference on Distributed Computing Systems (ICDCS). Nara: IEEE, pp. 303–312. Available at: https://doi.org/10.1109/ICDCS.2016.46.
70. Seneviratne, S., Shariffdeen, R., Rasnayaka, S. and Kasthuriarachchi, N. (2022) 'Self-supervised vision transformers for malware detection', IEEE Access, 10, pp. 103121–103135. Available at: https://doi.org/10.1109/ACCESS.2022.3206445.
71. Souppaya, M., Barker, W., Fisher, W. and Kent, K. (2026) Ransomware risk management: A cybersecurity framework 2.0 community profile. NIST Internal Report 8374r1. Gaithersburg, MD: National Institute of Standards and Technology. Available at: https://doi.org/10.6028/NIST.IR.8374r1.
72. Ucci, D., Aniello, L. and Baldoni, R. (2019) 'Survey of machine learning techniques for malware analysis', Computers & Security, 81, pp. 123–147. Available at: https://doi.org/10.1016/j.cose.2018.11.001.
73. Urooj, U., Al-rimy, B.A.S., Zainal, A., Ghaleb, F.A. and Rassam, M.A. (2022) 'Ransomware detection using the dynamic analysis and machine learning: A survey and research directions', Applied Sciences, 12(1), 172. Available at: https://doi.org/10.3390/app12010172.
74. Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A.N., Kaiser, Ł. and Polosukhin, I. (2017) 'Attention is all you need', in Advances in Neural Information Processing Systems 30 (NIPS 2017). Available at: https://proceedings.neurips.cc/paper/2017/hash/3f5ee243547dee91fbd053c1c4a845aa-Abstract.html.
75. Xu, H. et al. (2024) 'Large language models for cyber security: A systematic literature review', arXiv preprint, arXiv:2405.04760 [not peer reviewed; version 5, 2025]. Available at: https://arxiv.org/abs/2405.04760.
76. Yang, L., Ciptadi, A., Laziuk, I., Ahmadzadeh, A. and Wang, G. (2021) 'BODMAS: An open dataset for learning based temporal analysis of PE malware', in 2021 IEEE Security and Privacy Workshops (SPW). San Francisco, CA: IEEE, pp. 78–84. Available at: https://doi.org/10.1109/SPW53761.2021.00020.
77. Yao, Y., Duan, J., Xu, K., Cai, Y., Sun, Z. and Zhang, Y. (2024) 'A survey on large language model (LLM) security and privacy: The good, the bad, and the ugly', High-Confidence Computing, 4(2), 100211. Available at: https://doi.org/10.1016/j.hcc.2024.100211.
78. Zhu, J., Jang-Jaccard, J., Singh, A., Welch, I., Al-Sahaf, H. and Camtepe, S. (2022) 'A few-shot meta-learning based siamese neural network using entropy features for ransomware classification', Computers & Security, 117, 102691. Available at: https://doi.org/10.1016/j.cose.2022.102691.