# POSSE: Patterns of Systems During Software Encryption

arXiv: https://arxiv.org/abs/2109.12162 · HTML: https://mlsanity.com/paper/2109.12162/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 1 of its 26 references that are in the map.
- First posted on arXiv 24 Sep 2021.

## Builds on (most cited first, 1 of 1)

- [Real time Detection of Spectre and Meltdown Attacks Using Machine Learning](https://mlsanity.com/paper/2006.01442/) (2020)

## Built on by (most cited first, 1 of 1)

- [A Survey of Machine Learning Algorithms for Detecting Ransomware Encryption Activity](https://mlsanity.com/paper/2110.07636/) (2021)

## Abstract (arXiv)

This research recasts ransomware detection using performance monitoring and statistical machine learning. The work builds a test environment with 41 input variables to label and compares three computing states: idle, encryption and compression. A common goal of this behavioral detector seeks to anticipate and short-circuit the final step of hard-drive locking with encryption and the demand for payment to return the file system to its baseline. Comparing machine learning techniques, linear regression outperforms random forest, decision trees, and support vector machines (SVM). All algorithms classified the 3 possible classes (idle, encryption, and compression) with greater than 91% accuracy.