Pith. sign in

REVIEW 3 major objections 5 minor 1 cited by

On the Generalizability of Machine Learning-based Ransomware Detection in Block Storage

T0 review · 3 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Storage-level ransomware detection generalizes only when training covers the target configurations, and a new 82-feature descriptor makes that coverage outperform prior feature sets.

desk verdict Useful empirical map of where storage-based ransomware detection generalizes, but the real-ransomware numbers are partly in-sample and need a zero-shot rerun. read the letter →

arxiv 2412.21084 v1 pith:R6TUXCFZ submitted 2024-12-30 cs.CR cs.LG

Nicolas Reategui , Roman Pletka , Dionysios Diamantopoulos This is my paper · ORCID
classification cs.CRcs.LG
keywords ransomwaredetectionblockstorageIOanalysisgeneralizabilitydecision-treeboostingfeatureengineeringfilesystemdiversitysecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Ransomware leaves a signature in the block IO stream it generates, which makes storage an appealing detection point that attackers cannot easily disable from inside the guest OS. This paper tries to establish how far storage-based, machine-learning detection can be pushed across realistic configurations: different filesystems, disk utilization and aging, benign database and compression workloads, copy-on-write VM images, and device encryption. The central finding is that models trained on one narrow setup fail on others, while training across a broad set of configurations restores dependable detection. Against the earlier storage feature set, the proposed 82-feature descriptor yields up to 12.8% higher median F1, 10.9% lower false negative rate, and 17.1% lower false positive rate. If the generalizability claim holds, storage vendors can deploy a single detection layer with manageable false alarms, provided training traces cover the configurations they operate.

What carries the argument

The load-bearing mechanism is the 82-feature descriptor computed from each fixed-time window of block IO: per-epoch entropy statistics and histograms, logical block address (LBA) read/write statistics and histograms, transfer-size statistics and histograms, a mean rewrite entropy over one epoch, and a one-hot encoding of the filesystem type. These features are light enough to be extracted inline by a kernel module and, in the target architecture, directly in computational storage hardware; classification is done by a gradient-boosted decision-tree model. The feature set is what lets a single model survive changes in volume utilization, filesystem, workload, copy-on-write virtualization, and encryption, whereas coarser metrics and smaller feature sets do not.

What would settle it

Hold out an entire ransomware family from training, one that the emulator does not mimic, run its traces through the trained model, and measure the false negative rate; if the rate reaches the 60% level the paper already reports for Lockbit, the deployment generalizability claim is falsified.

Watch

Extended reading notes

Core claim

The paper claims that a lightweight, 82-feature IO descriptor plus decision-tree boosting gives storage-level ransomware detectors the generalizability they lacked, and that this is demonstrated by a systematic sweep across volume states, filesystems, workloads, copy-on-write VM images, and device encryption. It reports that a single-configuration model is not portable: an XFS-trained model evaluated on NTFS falls to 51.79% F1 with a 64.01% false negative rate, and an unseen PostgreSQL workload can raise FPR to 55.21% on XFS. It further claims that including the problematic configuration in training, using file-system awareness, and using histograms of entropy, LBA, and transfer size rather than coarse aggregates is what restores accuracy. In its real-ransomware validation, median false negative rates are 0.9% on NTFS and 1.95% on XFS, with Lockbit remaining difficult at 19% to 65% FNR depending on setup.

Load-bearing premise

The load-bearing premise is that a model trained on traces from a configurable ransomware emulator plus one percent of traces from the same real ransomware families will still detect unseen ransomware when deployed; if the emulator's traces are not representative of new or future strains, the reported low false negative rates will not transfer to real attacks.

Editorial extensions

If this is right

  • A single-configuration model is unsafe in production: the paper measures an XFS-trained model at 51.79% F1 and 64.01% false negative rate on NTFS, so training must include the target filesystem.
  • Benign workload coverage is the main lever for false positives: adding MySQL traces to training brings FPR on unseen MySQL workloads below 1%, while an unseen PostgreSQL workload can still push FPR to 55.21% on XFS.
  • Copy-on-write VM images and device encryption alter IO patterns enough to break plain-device models, and adding those trace types to training restores accuracy, so virtualized and encrypted deployments need their own traces.
  • The proposed 82-feature set beats the prior storage feature set in cross-filesystem and cross-workload comparisons, with up to 12.8% higher median F1, 10.9% lower false negative rate, and 17.1% lower false positive rate.
  • Real-time detection is feasible at modest cost: feature derivation and inference finish in about 200 ms per epoch, the kernel collection adds 268 µs average latency, and detection completes within about 5.2 s under the tested settings.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • My inference: for storage vendors, the practical takeaway is to include deployment-specific traces (filesystem, volume age, workload mix, VM image format, encryption mode) in training rather than trusting a universal model.
  • My inference: the low real-ransomware FNRs should not be read as zero-shot performance, because one percent of traces from each tested family is part of the training set; a stronger evaluation would hold out entire families.
  • My inference: a natural next experiment is to measure how little per-configuration trace data is needed to restore accuracy, and whether incremental retraining on small samples of new environments is sufficient.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. This paper reports an empirical study of ML-based ransomware detection at the block-storage layer. The authors propose a device-mapper kernel module and a computational-storage-device architecture that extract windowed I/O features, and they evaluate an XGBoost classifier across volume-utilization states, filesystem types, benign workloads (file conversion, compression, OLTP), qcow2 copy-on-write images, LUKS/BitLocker encryption, and a set of real ransomware samples. The main claims are that models trained on a single configuration do not transfer (e.g., an XFS-trained model has 51.79% F1 on NTFS; unseen PostgreSQL traces produce FPR up to 55.21% on XFS), that including training data from the diverse configurations restores robustness, and that the proposed 82-feature set outperforms the Hirano feature set by up to 12.8 percentage points in median F1, 10.9 percentage points in FNR, and 17.1 percentage points in FPR. The real-ransomware validation in Section 6.2 reports low median FNRs (0.9% on NTFS, 1.95% on XFS) but trains the model on WannaLaugh emulator traces plus 1% of the same collected real-ransomware traces.

Significance. Assuming the central results are reproducible, the paper's contribution is a useful and unusually broad generalizability map of storage-based ransomware detection. The evaluation has several genuine strengths: it tests many configurations on the same underlying traces, compares the proposed feature set against the Hirano features on identical data, validates the volume-aging procedure with Geriatrix, uses real malware samples in isolated VMs, and measures detection overhead. The comparative advantage over the Hirano features, if confirmed under a fair protocol, is practically relevant. The main weakness is that the deployment-facing claims in the abstract and introduction are supported by an evaluation protocol in which the model is trained on 1% of the same ransomware strains it is then scored on, so the reported real-world FNRs are not evidence of detection of unseen families. This does not invalidate the comparative or generalizability results, but it does require reframing and additional zero-shot numbers.

major comments (3)
  1. [Section 6.2, Tables 2 and 3] Section 6.2 states that the model used for Tables 2 and 3 is trained on samples from all previous traces, from the WannaLaugh ransomware emulator, and using 1% from collected real ransomware traces. Because the real-ransomware test set is drawn from the same collected traces, the low median FNRs (0.9% on NTFS, 1.95% on XFS) are not zero-shot results and do not by themselves support the abstract's claim of remarkable effectiveness for deployment against unseen ransomware. This point is load-bearing because Lockbit, an intermittent-encryption strain that the WannaLaugh emulator was designed to mimic, already shows 19.0-65.1% FNR even with the 1% in-family training. I ask the authors to (a) report the evaluation with no real-ransomware training data, (b) state exactly how the 1% was selected and how much of each strain's trace data was used for training versus testing, and (c) separate in-family from out-of-family results in the abstract and in Section 6.2.
  2. [Sections 2.4, 3.1, 3.2, and 6.2] The central comparative claim against Hirano's features is stated as a difference in median F1/FNR/FPR, but the manuscript does not say whether the same hyperparameters, feature-window sizes, and train/test splits were used for the Hirano-feature models as for the proposed-feature models. Section 2.4 says XGBoost hyperparameters were optimized and used for all results; if those optimized hyperparameters were not separately tuned for the baseline feature set, part of the reported 12.8%/10.9%/17.1% gains could be an artifact of the tuning protocol. Please state explicitly that the comparison is apples-to-apples, or adjust the claim if the baseline models were not tuned in the same way.
  3. [Sections 3.1-3.3 and 6.2] Most headline results are single point estimates without a measure of uncertainty. For example, Section 3.2 reports F1: 51.79%, FPR: 3.01%, FNR: 64.01% for an XFS-trained model on NTFS, and Section 3.1 reports a 15.0% F1 drop as evidence of volume-state sensitivity. The manuscript gives no confidence intervals, standard deviations (except the Geriatrix runs), or number of independent trace repetitions behind these values. Since several conclusions depend on differences of only a few percentage points (e.g., the up-to-2% improvement from file-system awareness and the 1.67% versus 6.14% F1 differences against Hirano features), I ask for error bars or a statement of variance over repeated training runs and evaluation folds.
minor comments (5)
  1. [Section 2.4] The feature count is not self-consistent: 19 entropy features plus 18 LBA features for each of read and write (36) plus 17 transfer-size features for each IO type (34) does not sum to the stated 79/82 features. Please provide a complete feature-count breakdown or correct the text.
  2. [Table 1] Table 1 would benefit from a caption stating which benign workloads and training traces were used for the motivational NTFS model and the number of traces in each cell, so the reader can see whether the NTFS and Linux rows are directly comparable.
  3. [Section 6.1] The sentence 'we detect an attack after at most 5.2 s from the start of the ransomware encryption' appears to assume that the first feature window begins at the attack start; please clarify whether this is a worst-case bound over arbitrary phase alignment of the encryption start within an epoch.
  4. [Throughout] There are several typos and grammatical errors, including 'similiar' in Section 3.1, 'efficent' in Section 3.3, 'studiy' in Section 6.1, and 'filesytem' in the Introduction; these should be corrected.
  5. [General] The paper would be substantially easier to verify if the traces, feature-extraction scripts, and model configuration were released or referenced as an artifact; at minimum, please add a data-availability statement.

Circularity Check

2 steps flagged · score 4.0 of 10

Real-ransomware validation is partially in-family: models train on 1% of the same evaluated strains plus a self-authored emulator, so the headline FNRs are not zero-shot; the cross-setup empirical maps and Hirano comparisons remain independent.

  1. fitted input called prediction [Section 6.2 (Real ransomware validation), Tables 2 and 3]
    "We train a model using samples from all previous traces from benign workloads and from the aforementioned WannaLaugh ransomware emulator as well as using1 % from collected real ransomware traces."

    The model whose FNRs are reported in Tables 2 and 3 is trained on 1% of the collected real ransomware traces from the same families it is then scored on. The resulting low median FNRs (0.9% on NTFS, 1.95% on XFS) are therefore in-family measurements, not zero-shot detection of unseen or evolving ransomware. Presenting these as "inference results on real ransomware traces" and building the paper's "accurately detect ransomware in most setups" framing on them makes the headline real-world FNRs partially self-referential: the target families were already present in the training input. This does not invalidate the cross-setup generalizability maps, but it means the real-ransomware validation does not measure generalization to unseen strains.

  2. self citation load bearing [Section 2.6 (Benign and ransomware workloads), reference [19]]
    "For security reasons and to enhance scalability for automated IO trace collection, we decided to use WannaLaugh, a ransomware emulator capable of creating a variety of ransomware-like IO patterns [19]."

    The emulator provides the bulk of the ransomware training traces, and its ability to closely mimic Black Basta, Conti, Lockbit, Lockfile, and WannaCry is asserted by citing [19], which is co-authored by two of the present authors (Diamantopoulos and Pletka). Because the only real-ransomware validation in this paper adds 1% of the same strains into training, it cannot independently confirm the emulator's fidelity. The training-signal premise thus rests on a self-citation rather than on an external, falsifiable check within the present study.

full rationale

The paper is primarily an empirical mapping study. Its cross-volume-state, cross-filesystem, cross-workload, copy-on-write, and device-encryption results are obtained from hold-out test traces (Section 2.5 states that specific trace sections are used for training or testing) and are compared against an external, fixed feature set from Hirano et al. These comparisons are self-contained and not circular. The greedy feature removal is explicitly framed as a first evaluation, not as a derivation. The load-bearing circularity is concentrated in the real-ransomware validation: the model is trained on 1% of the same real strains it is then scored on, and the main emulator supplying training data is the authors' own prior work. Consequently, the low median FNRs in the abstract and introduction are partially in-family numbers rather than evidence of detection of unseen ransomware families. The broader generalizability landscape, and the claimed advantage over Hirano's features, does not reduce to a fit or to the self-citation chain, so the overall circularity is moderate rather than total.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

No new physical or conceptual entities are postulated; the dm-entropy kernel module, the 82-feature set, and the WannaLaugh emulator are engineering artifacts, not invented entities requiring independent falsifiable evidence. The CSD hardware implementation is asserted (Sections 2.2 and 6.1) with minimal measured detail, which is a reporting gap rather than an invented entity. The main ledger entries are the hand-chosen experimental parameters and the domain assumptions about workload and emulator representativeness.

free parameters (4)
  • XGBoost hyperparameters = not reported in paper
    Section 2.4: 'hyper-parameter optimization for the XGBoost model improves F1 scores by up to 2%. We use these optimized parameters for all results presented.' The values are never listed, so the exact model configuration is unrecoverable and the distance to the reported numbers is unknown.
  • Real-ransomware training fraction = 1%
    Section 6.2: training includes '1% from collected real ransomware traces.' This hand-chosen ratio directly inflates the FNRs in Tables 2 and 3 relative to a zero-shot deployment, where the strain would be unseen.
  • Feature window size T = seconds range; T=5 s used in Section 6.1
    Window length is a design choice in the 'seconds range' (Section 2.4); the specific window used for most reported analyses is not stated, and the latency-accuracy trade-off is cited from prior work rather than measured here.
  • Classification threshold = not reported
    The decision threshold of the XGBoost classifier is not stated. FPR/FNR trade-offs in Tables 1-3 depend on it, and no ROC or threshold-sweep analysis is provided, so the reported operating points are not independently reproducible.
assumptions (5)
  • ad hoc to paper WannaLaugh emulator traces are representative of real ransomware IO behavior
    Section 2.6: most ransomware training data comes from the authors' own emulator [19] mimicking Black Basta, Conti, Lockbit, Lockfile, and WannaCry patterns. Partial validation in Section 6.2 uses 1% of real traces in training, so the representativeness of the emulator is load-bearing and only weakly independently checked.
  • domain assumption Balanced training data mirrors deployment conditions
    Section 2.5: 'All training and test data is balanced w.r.t. the number of ransomware and benign labels.' Real deployments face rare attacks and highly diverse benign IO; the paper's own PostgreSQL FPR results show the benign-coverage assumption fails for unseen workloads.
  • domain assumption The benign workload suite (Govdocs conversions, compression, sysbench OLTP) spans realistic benign IO
    Section 2.6: the suite is finite and the paper itself shows it fails for PostgreSQL traces (FPR up to 55.21% on XFS, Section 3.3), so the generalizability conclusions are conditional on workload coverage.
  • ad hoc to paper The copy/delete aging simulation captures long-term volume-state effects
    Section 2.5 acknowledges the simple approach is less sophisticated than Impressions or Geriatrix; partial validation with Geriatrix (Section 3.1) supports but does not fully replace the assumption that copy/delete-induced fragmentation matches real aging.
  • standard math k-fold cross-validation with concurrency-based splits keeps training and test distributions exchangeable
    Sections 2.4-2.5: k=5 folds with splits by concurrency or trace sections. Adjacent time windows from the same trace are likely correlated, which can inflate fold performance and underestimate FPR on truly unseen IO streams.

how reviews work

0 comments
Cite this review

Pith. "Pith review of On the Generalizability of Machine Learning-based Ransomware Detection in Block Storage." pith.science (2026). https://pith.science/paper/R6TUXCFZ

@misc{pith2026241221084,
  author       = {Pith},
  title        = {Pith review of: On the Generalizability of Machine Learning-based Ransomware Detection in Block Storage},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/R6TUXCFZ}},
  note         = {Machine review of arXiv:2412.21084}
}
read the original abstract

Ransomware represents a pervasive threat, traditionally countered at the operating system, file-system, or network levels. However, these approaches often introduce significant overhead and remain susceptible to circumvention by attackers. Recent research activity started looking into the detection of ransomware by observing block IO operations. However, this approach exhibits significant detection challenges. Recognizing these limitations, our research pivots towards enabling robust ransomware detection in storage systems keeping in mind their limited computational resources available. To perform our studies, we propose a kernel-based framework capable of efficiently extracting and analyzing IO operations to identify ransomware activity. The framework can be adopted to storage systems using computational storage devices to improve security and fully hide detection overheads. Our method employs a refined set of computationally light features optimized for ML models to accurately discern malicious from benign activities. Using this lightweight approach, we study a wide range of generalizability aspects and analyze the performance of these models across a large space of setups and configurations covering a wide range of realistic real-world scenarios. We reveal various trade-offs and provide strong arguments for the generalizability of storage-based detection of ransomware and show that our approach outperforms currently available ML-based ransomware detection in storage. Empirical validation reveals that our decision tree-based models achieve remarkable effectiveness, evidenced by higher median F1 scores of up to 12.8%, lower false negative rates of up to 10.9% and particularly decreased false positive rates of up to 17.1% compared to existing storage-based detection approaches.

Figures

Figures reproduced from arXiv: 2412.21084 by the authors.

Figure 1
Figure 1. (a) Linux-based ransomware detection in user space. [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Results for different volume states (high and [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Generalizability across file system types. F1 scores [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (6 more)
Figure 5
Figure 5. Figure 5: FPR of benign workloads trained with XFS on [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: Greedy feature removal of XGBoost model trained [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]
Figure 7
Figure 7. Figure 7: F1 scores of XGBoost models trained and evaluated [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]
Figure 9
Figure 9. Figure 9: F1 score of XGBoost models trained and evaluated [PITH_FULL_IMAGE:figures/full_fig_p009_9.png]
Figure 10
Figure 10. Figure 10: F1 score of XGBoost models trained and evaluated [PITH_FULL_IMAGE:figures/full_fig_p010_10.png]
Figure 12
Figure 12. Figure 12: Real-time ransomware detection using our pipeline. [PITH_FULL_IMAGE:figures/full_fig_p011_12.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Learning the Language of NVMe Streams for Ransomware Detection

    cs.LG 2025-02 conditional novelty 6.0 of 10

    Transformer models that tokenize NVMe command streams detect ransomware commands and estimate ransomware IO volume better than tabular baselines in the authors' evaluation.

Reference graph

Works this paper leans on

60 extracted references · 59 canonical work pages · cited by 1 Pith paper

  1. [1]

    Malware dynamic analysis evasion techniques: A survey

    Amir Afianian, Salman Niksefat, Babak Sadeghiyan, and David Baptiste. Malware dynamic analysis evasion techniques: A survey. ACM Comput. Surv., 52(6), nov 2019

    work page 2019

  2. [2]

    Arpaci-Dusseau, and Remzi H

    Nitin Agrawal, Andrea C. Arpaci-Dusseau, and Remzi H. Arpaci-Dusseau. Generating realistic im- pressions for file-system benchmarking. ACM Trans. Storage, 5(4), December 2009

    work page 2009

  3. [3]

    Ajay Kumara and C.D

    M.A. Ajay Kumara and C.D. Jaidhar. Leveraging vir- tual machine introspection with memory forensics to de- tect and characterize unknown malware using machine learning techniques at hypervisor. Digital Investigation, 23:99–123, Dec 2017

    work page 2017

  4. [4]

    Akopytov/sysbench: Scriptable database and system performance benchmark, 2020

    Alexey Akopytov. Akopytov/sysbench: Scriptable database and system performance benchmark, 2020

    work page 2020

  5. [5]

    Targeted ransomware: A new cyber threat to edge system of brownfield industrial internet of things

    Muna Al-Hawawreh, Frank den Hartog, and Elena Sit- nikova. Targeted ransomware: A new cyber threat to edge system of brownfield industrial internet of things. IEEE Internet of Things Journal, 6(4):7137–7151, 2019

    work page 2019

  6. [6]

    Alhawi, James Baldwin, and Ali Dehghan- tanha

    Omar M. Alhawi, James Baldwin, and Ali Dehghan- tanha. Leveraging machine learning techniques for win- dows ransomware network traffic detection. Advances in Information Security, page 93–106, 2018

    work page 2018

  7. [7]

    An intelligent behavior-based ran- somware detection system for android platform

    Abdulrahman Alzahrani, Hani Alshahrani, Ali Alshehri, and Huirong Fu. An intelligent behavior-based ran- somware detection system for android platform. 2019 First IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA), Dec 2019

    work page 2019

  8. [8]

    Detecting malware domains at the upper DNS hierarchy

    Manos Antonakakis, Roberto Perdisci, Wenke Lee, Nikolaos Vasiloglou II, and David Dagon. Detecting malware domains at the upper DNS hierarchy. In 20th USENIX Security Symposium (USENIX Security 11) , San Francisco, CA, August 2011. USENIX Association

    work page 2011

Show all 60 references
  1. [9]

    Ssd-insider: Internal defense of solid-state drive against ransomware with perfect data recovery

    SungHa Baek, Youngdon Jung, Aziz Mohaisen, Sungjin Lee, and DaeHun Nyang. Ssd-insider: Internal defense of solid-state drive against ransomware with perfect data recovery. In IEEE 38th International Conference on Distributed Computing Systems (ICDCS), pages 875– 884, 2018

    2018

  2. [10]

    Know thy ran- somware response: A detailed framework for devis- ing effective ransomware response strategies

    Pranshu Bajpai and Richard Enbody. Know thy ran- somware response: A detailed framework for devis- ing effective ransomware response strategies. Digital Threats: Research and Practice, 4(4):1–19, Oct 2023

    2023

  3. [11]

    A framework for empirical evaluation of malware detection resilience against behavior obfusca- tion

    Sebastian Banescu, Tobias Wuchner, Aleieldin Salem, Marius Guggenmos, Martın Ochoa, and Alexander Pretschner. A framework for empirical evaluation of malware detection resilience against behavior obfusca- tion. In 2015 10th International Conference on Mali- cious and Unwanted ...

    2015

  4. [12]

    Ransomware: Recent advances, analysis, challenges and future research directions

    Craig Beaman, Ashley Barkworth, Toluwalope David Akande, Saqib Hakak, and Muhammad Khurram Khan. Ransomware: Recent advances, analysis, challenges and future research directions. Computers & Security, 111:102490, Dec 2021

    2021

  5. [13]

    A survey on detection techniques for crypto- graphic ransomware

    Eduardo Berrueta, Daniel Morato, Eduardo Magaña, and Mikel Izal. A survey on detection techniques for crypto- graphic ransomware. IEEE Access, 7:144925–144944, 2019

    2019

  6. [14]

    Intelligent and behavioral-based detection of malware in IoT spectrum sensors

    Alberto Huertas Celdrán, Pedro Miguel Sánchez, Miguel Azorín Castillo, Gérôme Bovet, Grego- rio Martínez Pérez, and Burkhard Stiller. Intelligent and behavioral-based detection of malware in IoT spectrum sensors. International Journal of Information Security, 23:541–561, 2023. 13

    2023

  7. [15]

    Anomaly detection: A survey

    Varun Chandola, Arindam Banerjee, and Vipin Kumar. Anomaly detection: A survey. ACM Comput. Surv. , 41(3), jul 2009

    2009

  8. [16]

    Ex- plainable ransomware detection with deep learning tech- niques

    Giovanni Ciaramella, Giacomo Iadarola, Fabio Mar- tinelli, Francesco Mercaldo, and Antonella Santone. Ex- plainable ransomware detection with deep learning tech- niques. Journal of Computer Virology and Hacking Techniques, Sep 2023

    2023

  9. [17]

    Trusted detection of ransomware in a private cloud using machine learning methods leveraging meta-features from volatile mem- ory

    Aviad Cohen and Nir Nissim. Trusted detection of ransomware in a private cloud using machine learning methods leveraging meta-features from volatile mem- ory. Expert Systems with Applications , 102:158–178, Jul 2018

    2018

  10. [18]

    Shieldfs: a self-healing, ransomware-aware filesystem

    Andrea Continella, Alessandro Guagnelli, Giovanni Zin- garo, Giulio De Pasquale, Alessandro Barenghi, Stefano Zanero, and Federico Maggi. Shieldfs: a self-healing, ransomware-aware filesystem. In Proceedings of the 32nd Annual Conference on Computer Security Applica- tions, AC...

  11. [19]

    Dionysios Diamantopoulos, Roman Pletka, Slavisa Sarafijanovic, A. L. Narasimha Reddy, and Haris Pozidis. Wannalaugh: A configurable ransomware emulator – learning to mimic malicious storage traces, 2024

    2024

  12. [20]

    Ransomware detection with machine learning in storage systems

    Dario Gagulic, Lynn Zumtaugwald, and Siddhant Sahu. Ransomware detection with machine learning in storage systems. Master’s thesis, 2023

    2023

  13. [21]

    Bringing science to digital forensics with standardized forensic corpora

    Simson Garfinkel, Paul Farrell, Vassil Roussev, and George Dinolt. Bringing science to digital forensics with standardized forensic corpora. Digit. Investig., 6:S2—-S11, sep 2009

    2009

  14. [22]

    Iot-keeper: Detecting malicious iot net- work activity using online traffic analysis at the edge

    Ibbad Hafeez, Markku Antikainen, Aaron Yi Ding, and Sasu Tarkoma. Iot-keeper: Detecting malicious iot net- work activity using online traffic analysis at the edge. IEEE Transactions on Network and Service Manage- ment, 17(1):45–59, 2020

    2020

  15. [23]

    Ransap: An open dataset of ransomware storage access patterns for training machine learning models

    Manabu Hirano, Ryo Hodota, and Ryotaro Kobayashi. Ransap: An open dataset of ransomware storage access patterns for training machine learning models. Forensic Science International: Digital Investigation, 40:301314, 2022

    2022

  16. [24]

    Machine learn- ing based ransomware detection using storage access patterns obtained from live-forensic hypervisor

    Manabu Hirano and Ryotaro Kobayashi. Machine learn- ing based ransomware detection using storage access patterns obtained from live-forensic hypervisor. In 2019 sixth international conference on internet of things: Sys- tems, Management and security (IOTSMS), pages 1–6. IEEE, 2019

    2019

  17. [25]

    Way- backVisor: Hypervisor-based scalable live forensic ar- chitecture for timeline analysis

    Manabu Hirano, Takuma Tsuzuki, Seishiro Ikeda, Naoga Taka, Kenji Fujiwara, and Ryotaro Kobayashi. Way- backVisor: Hypervisor-based scalable live forensic ar- chitecture for timeline analysis. Security, Privacy, and Anonymity in Computation, Communication, and Stor- age, pages ...

    2017

  18. [26]

    Jian Huang, Jun Xu, Xinyu Xing, Peng Liu, and Moinud- din K. Qureshi. Flashguard: Leveraging intrinsic flash properties to defend against encryption ransomware. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, CCS ’17, page 2231–2244, N...

    2017

  19. [27]

    Saurabh Kadekodi, Vaishnavh Nagarajan, and Gre- gory R. Ganger. Geriatrix: Aging what you see and what you don’t see. a file system aging approach for modern storage systems. In 2018 USENIX Annual Tech- nical Conference (USENIX ATC 18) , pages 691–704, Boston, MA, July 2018. U...

    2018

  20. [28]

    UNVEIL: A Large-Scale, automated approach to detecting ransomware

    Amin Kharaz, Sajjad Arshad, Collin Mulliner, William Robertson, and Engin Kirda. UNVEIL: A Large-Scale, automated approach to detecting ransomware. In 25th USENIX Security Symposium (USENIX Security 16) , pages 757–772, Austin, TX, August 2016

    2016

  21. [29]

    Automated identification of cryptographic primitives in binary code with data flow graph isomor- phism

    Pierre Lestringant, Frédéric Guihéry, and Pierre-Alain Fouque. Automated identification of cryptographic primitives in binary code with data flow graph isomor- phism. In Proceedings of the 10th ACM Symposium on Information, Computer and Communications Security, ASIA CCS ’15, p...

  22. [30]

    Huaicheng Li, Mingzhe Hao, Michael Hao Tong, Swami- nathan Sundararaman, Matias Bjørling, and Haryadi S. Gunawi. The case of FEMU: Cheap, accurate, scalable and extensible flash emulator. In Proceedings of 16th USENIX Conference on File and Storage Technologies (FAST), Oakland...

    2018

  23. [31]

    Detecting environment-sensitive mal- ware

    Martina Lindorfer, Clemens Kolbitsch, and Paolo Mi- lani Comparetti. Detecting environment-sensitive mal- ware. In Recent Advances in Intrusion Detection, pages 338–357, 2011

    2011

  24. [32]

    R- packdroid

    Davide Maiorca, Francesco Mercaldo, Giorgio Giac- into, Corrado Aaron Visaggio, and Fabio Martinelli. R- packdroid. Proceedings of the Symposium on Applied Computing, Apr 2017

    2017

  25. [33]

    Malware sample exchange, 2024

    MalwareBazaar. Malware sample exchange, 2024. 14

    2024

  26. [34]

    Sujadevi, Prem Sankar A.U., and Sri- nath Jan

    Sumith Maniath, Aravind Ashok, Prabaharan Poor- nachandran, V .G. Sujadevi, Prem Sankar A.U., and Sri- nath Jan. Deep learning lstm based ransomware detec- tion. 2017 Recent Developments in Control, Automation & Power Engineering (RDCAPE), Oct 2017

    2017

  27. [35]

    Ransomware mitigation in the modern era: A comprehensive review, research chal- lenges, and future directions

    Timothy McIntosh, ASM Kayes, Yi-Ping Phoebe Chen, Alex Ng, and Paul Watters. Ransomware mitigation in the modern era: A comprehensive review, research chal- lenges, and future directions. ACM Computing Surveys (CSUR), 54(9):1–36, 2021

    2021

  28. [36]

    A content-based ransomware detection and backup solid-state drive for ransomware defense

    Donghyun Min, Yungwoo Ko, Ryan Walker, Junghee Lee, and Youngjae Kim. A content-based ransomware detection and backup solid-state drive for ransomware defense. IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, 41(7):2038–2051, 2022

    2022

  29. [37]

    Celest: Federated learning for globally coordinated threat detec- tion, 2023

    Talha Ongun, Simona Boboila, Alina Oprea, Tina Eliassi-Rad, Jason Hiser, and Jack Davidson. Celest: Federated learning for globally coordinated threat detec- tion, 2023

    2023

  30. [38]

    Made: Security analytics for enterprise threat detection

    Alina Oprea, Zhou Li, Robin Norris, and Kevin Bowers. Made: Security analytics for enterprise threat detection. In Proceedings of the 34th Annual Computer Security Applications Conference, ACSAC ’18, page 124–136, New York, NY , USA, 2018. Association for Computing Machinery

    2018

  31. [39]

    Selcuk Ulu- agac

    Harun Oz, Ahmet Aris, Albert Levi, and A. Selcuk Ulu- agac. A survey on ransomware: Evolution, taxonomy, and defense solutions. ACM Comput. Surv., 54(11s), sep 2022

    2022

  32. [40]

    Snap- Boost: A heterogenous boosting machine

    Thomas Parnell, Andreea Anghel, Malgorzata Lazuka, Nikolas Ioannou, Sebastian Kurella, Peshal Agarwal, Nikolaos Papandreou, and Haralampos Pozidis. Snap- Boost: A heterogenous boosting machine. In 34th Conference on Neural Information Processing Systems (NeurIPS 2020), 2020

    2020

  33. [41]

    A categorical treatment of malicious behavioral obfuscation

    Romain Péchoux and Thanh Dinh Ta. A categorical treatment of malicious behavioral obfuscation. In T. V . Gopal, Manindra Agrawal, Angsheng Li, and S. Barry Cooper, editors, Theory and Applications of Models of Computation, pages 280–299, Cham, 2014. Springer International Publishing

    2014

  34. [42]

    Behavioural analysis of recent ransomwares and prediction of future attacks by polymorphic and metamorphic ransomware

    Navneet Kaur Popli and Anup Girdhar. Behavioural analysis of recent ransomwares and prediction of future attacks by polymorphic and metamorphic ransomware. In Computational Intelligence: Theories, Applications and Future Directions - Volume II, pages 65–80, Septem- ber 2019

    2019

  35. [43]

    Locating system prob- lems using dynamic instrumentation

    Vara Prasad and William Cohen. Locating system prob- lems using dynamic instrumentation. In Proceedings of the Linux Symposium, pages 49–64, July 2005

    2005

  36. [44]

    Segugio: Efficient behavior-based tracking of malware-control domains in large isp networks

    Babak Rahbarinia, Roberto Perdisci, and Manos An- tonakakis. Segugio: Efficient behavior-based tracking of malware-control domains in large isp networks. In 2015 45th Annual IEEE/IFIP International Conference on Dependable Systems and Networks, pages 403–414, 2015

    2015

  37. [45]

    Security assurance against cyber- crime ransomware

    Habib ur Rehman, Eiad Yafi, Mohammed Nazir, and Khurram Mustafa. Security assurance against cyber- crime ransomware. In Pandian Vasant, Ivan Zelinka, and Gerhard-Wilhelm Weber, editors,Intelligent Computing & Optimization, pages 21–34, Cham, 2019. Springer International Publishing

    2019

  38. [46]

    Nolen Scaife, Henry Carter, Patrick Traynor, and Kevin R. B. Butler. Cryptolock (and drop it): Stopping ran- somware attacks on user data. In 2016 IEEE 36th Inter- national Conference on Distributed Computing Systems (ICDCS), pages 303–312, 2016

    2016

  39. [47]

    X-force threat intelligence index 2022, 2022

    IBM Security. X-force threat intelligence index 2022, 2022

    2022

  40. [48]

    Poi- soning network flow classifiers

    Giorgio Severi, Simona Boboila, Alina Oprea, John Holodnak, Kendra Kratkiewicz, and Jason Matterer. Poi- soning network flow classifiers. In Proceedings of the 39th Annual Computer Security Applications Confer- ence, ACSAC ’23, page 337–351, 2023

    2023

  41. [49]

    Bitvisor

    Takahiro Shinagawa, Hideki Eiraku, Kouichi Tanimoto, Kazumasa Omote, Shoichi Hasegawa, Takashi Horie, Manabu Hirano, Kenichi Kourai, Yoshihiro Oyama, Eiji Kawai, and et al. Bitvisor. Proceedings of the 2009 ACM SIGPLAN/SIGOPS international conference on Virtual execution envir...

    2009

  42. [50]

    A siem and multiple analysis software integrated malware detec- tion approach

    Daiyu Sim, Huaqun Guo, and Luying Zhou. A siem and multiple analysis software integrated malware detec- tion approach. In 2023 IEEE International Conference on Service Operations and Logistics, and Informatics (SOLI), pages 1–7, 2023

    2023

  43. [51]

    An emerging threat fileless malware: a survey and research challenges

    Sudhakar and Sashil Kumar. An emerging threat fileless malware: a survey and research challenges. Cybersecu- rity, 3(1), 2020

    2020

  44. [52]

    Ransomware: Growing number of attackers using virtual machines, 2021

    Threat Hunter Team Symantec. Ransomware: Growing number of attackers using virtual machines, 2021

    2021

  45. [53]

    A survey on device behavior fingerprinting: Data sources, techniques, application scenarios, and datasets

    Pedro Miguel Sánchez Sánchez, Jose Maria Jor- quera Valero, Alberto Huertas Celdrán, Gérôme Bovet, Manuel Gil Pérez, and Gregorio Martínez Pérez. A survey on device behavior fingerprinting: Data sources, techniques, application scenarios, and datasets. IEEE 15 Communications S...

    2021

  46. [54]

    Adrian Tang, Simha Sethumadhavan, and Salvatore J. Stolfo. Unsupervised anomaly-based malware detec- tion using hardware features. In Research in Attacks, Intrusions and Defenses, pages 109–129, 2014

    2014

  47. [55]

    Efficient signature based malware detection on mobile devices

    Deepak Venugopal and Guoning Hu. Efficient signature based malware detection on mobile devices. Mobile Information Systems, 4(1):33–49, 2008

    2008

  48. [56]

    Ran- som access memories: Achieving practical ransomware protection in cloud with DeftPunk

    Zhongyu Wang, Yaheng Song, Erci Xu, Haonan Wu, Guangxun Tong, Shizhuo Sun, Haoran Li, Jincheng Liu, Lijun Ding, Rong Liu, Jiaji Zhu, and Jiesheng Wu. Ran- som access memories: Achieving practical ransomware protection in cloud with DeftPunk. In 18th USENIX Symposium on Operati...

    2024

  49. [57]

    Ransomware detection using deep learn- ing based unsupervised feature extraction and a cost sensitive pareto ensemble classifier

    Umme Zahoora, Asifullah Khan, Muttukrishnan Ra- jarajan, Saddam Hussain Khan, Muhammad Asam, and Tauseef Jamal. Ransomware detection using deep learn- ing based unsupervised feature extraction and a cost sensitive pareto ensemble classifier. Scientific Reports, 12(1), Sep 2022

    2022

  50. [58]

    Min Zheng, Mingshen Sun, and John C.S. Lui. Droid analytics: A signature based analytic system to collect, extract, analyze and associate android malware. 2013 12th IEEE International Conference on Trust, Security and Privacy in Computing and Communications , Jul 2013

    2013

  51. [59]

    Minding the semantic gap for effective storage-based ransomware defense

    Weidong Zhu, Grant Hernandez, Washington Garcia, Dave (Jing) Tian, Sara Rampazzi, and Kevin Butler. Minding the semantic gap for effective storage-based ransomware defense. In Proceedings of the 38th Inter- national Conference on Massive Storage Systems and Technology (MSST), ...

    2024

  52. [2015]

    Association for Computing Machinery

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.