{"id":"https://openalex.org/W3201224956","doi":"https://doi.org/10.1109/tnsm.2021.3112056","title":"On Ransomware Family Attribution Using Pre-Attack Paranoia Activities","display_name":"On Ransomware Family Attribution Using Pre-Attack Paranoia Activities","publication_year":2021,"publication_date":"2021-09-13","ids":{"openalex":"https://openalex.org/W3201224956","doi":"https://doi.org/10.1109/tnsm.2021.3112056","mag":"3201224956"},"language":"en","primary_location":{"is_oa":false,"landing_page_url":"https://doi.org/10.1109/tnsm.2021.3112056","pdf_url":null,"source":{"id":"https://openalex.org/S173527311","display_name":"IEEE Transactions on Network and Service Management","issn_l":"1932-4537","issn":["1932-4537","2373-7379"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false},"type":"article","type_crossref":"journal-article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"bronze","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5063743251","display_name":"Ricardo Misael Ayala Molina","orcid":"https://orcid.org/0000-0002-3843-8708"},"institutions":[{"id":"https://openalex.org/I60158472","display_name":"Concordia University","ror":"https://ror.org/0420zvk78","country_code":"CA","type":"education","lineage":["https://openalex.org/I60158472"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Ricardo Misael Ayala Molina","raw_affiliation_strings":["Security Research Centre, Concordia Institute for Information Systems Engineering, Concordia University, Montreal, QC, Canada"],"affiliations":[{"raw_affiliation_string":"Security Research Centre, Concordia Institute for Information Systems Engineering, Concordia University, Montreal, QC, Canada","institution_ids":["https://openalex.org/I60158472"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5048698954","display_name":"Sadegh Torabi","orcid":"https://orcid.org/0000-0003-2811-3536"},"institutions":[{"id":"https://openalex.org/I162714631","display_name":"George Mason University","ror":"https://ror.org/02jqj7156","country_code":"US","type":"education","lineage":["https://openalex.org/I162714631"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Sadegh Torabi","raw_affiliation_strings":["Center for Secure Information Systems, George Mason University, Fairfax, VA, USA"],"affiliations":[{"raw_affiliation_string":"Center for Secure Information Systems, George Mason University, Fairfax, VA, USA","institution_ids":["https://openalex.org/I162714631"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5063271538","display_name":"Khaled Sarieddine","orcid":"https://orcid.org/0000-0002-6099-2502"},"institutions":[{"id":"https://openalex.org/I60158472","display_name":"Concordia University","ror":"https://ror.org/0420zvk78","country_code":"CA","type":"education","lineage":["https://openalex.org/I60158472"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Khaled Sarieddine","raw_affiliation_strings":["Security Research Centre, Concordia Institute for Information Systems Engineering, Concordia University, Montreal, QC, Canada"],"affiliations":[{"raw_affiliation_string":"Security Research Centre, Concordia Institute for Information Systems Engineering, Concordia University, Montreal, QC, Canada","institution_ids":["https://openalex.org/I60158472"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5039079298","display_name":"Elias Bou\u2010Harb","orcid":"https://orcid.org/0000-0001-8040-4635"},"institutions":[{"id":"https://openalex.org/I45438204","display_name":"The University of Texas at San Antonio","ror":"https://ror.org/01kd65564","country_code":"US","type":"education","lineage":["https://openalex.org/I45438204"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Elias Bou-Harb","raw_affiliation_strings":["Cyber Center For Security and Analytics, University of Texas at San Antonio, San Antonio, TX, USA"],"affiliations":[{"raw_affiliation_string":"Cyber Center For Security and Analytics, University of Texas at San Antonio, San Antonio, TX, USA","institution_ids":["https://openalex.org/I45438204"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5090600716","display_name":"Nizar Bouguila","orcid":"https://orcid.org/0000-0001-7224-7940"},"institutions":[{"id":"https://openalex.org/I60158472","display_name":"Concordia University","ror":"https://ror.org/0420zvk78","country_code":"CA","type":"education","lineage":["https://openalex.org/I60158472"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Nizar Bouguila","raw_affiliation_strings":["Security Research Centre, Concordia Institute for Information Systems Engineering, Concordia University, Montreal, QC, Canada"],"affiliations":[{"raw_affiliation_string":"Security Research Centre, Concordia Institute for Information Systems Engineering, Concordia University, Montreal, QC, Canada","institution_ids":["https://openalex.org/I60158472"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5072393948","display_name":"Chadi Assi","orcid":"https://orcid.org/0000-0002-3161-1846"},"institutions":[{"id":"https://openalex.org/I60158472","display_name":"Concordia University","ror":"https://ror.org/0420zvk78","country_code":"CA","type":"education","lineage":["https://openalex.org/I60158472"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Chadi Assi","raw_affiliation_strings":["Security Research Centre, Concordia Institute for Information Systems Engineering, Concordia University, Montreal, QC, Canada"],"affiliations":[{"raw_affiliation_string":"Security Research Centre, Concordia Institute for Information Systems Engineering, Concordia University, Montreal, QC, Canada","institution_ids":["https://openalex.org/I60158472"]}]}],"institution_assertions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":6.555,"has_fulltext":false,"cited_by_count":28,"citation_normalized_percentile":{"value":0.999749,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":96,"max":97},"biblio":{"volume":"19","issue":"1","first_page":"19","last_page":"36"},"is_retracted":false,"is_paratext":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Characterization and Detection of Android Malware","score":0.9999,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Characterization and Detection of Android Malware","score":0.9999,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Intrusion Detection and Defense Mechanisms","score":0.9914,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Detection and Prevention of Phishing Attacks","score":0.9907,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/ransomware","display_name":"Ransomware","score":0.590996},{"id":"https://openalex.org/keywords/behavioral-analysis","display_name":"Behavioral Analysis","score":0.538693},{"id":"https://openalex.org/keywords/security-analysis","display_name":"Security Analysis","score":0.52989},{"id":"https://openalex.org/keywords/ddos-attacks","display_name":"DDoS Attacks","score":0.511433},{"id":"https://openalex.org/keywords/android-malware","display_name":"Android Malware","score":0.503174},{"id":"https://openalex.org/keywords/evasion","display_name":"Evasion (ethics)","score":0.45333937}],"concepts":[{"id":"https://openalex.org/C2777667771","wikidata":"https://www.wikidata.org/wiki/Q926331","display_name":"Ransomware","level":3,"score":0.96469676},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7719327},{"id":"https://openalex.org/C2781105514","wikidata":"https://www.wikidata.org/wiki/Q1229994","display_name":"Paranoia","level":2,"score":0.73181313},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.70996165},{"id":"https://openalex.org/C148730421","wikidata":"https://www.wikidata.org/wiki/Q141090","display_name":"Encryption","level":2,"score":0.49304673},{"id":"https://openalex.org/C2781251061","wikidata":"https://www.wikidata.org/wiki/Q5416089","display_name":"Evasion (ethics)","level":3,"score":0.45333937},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.41533184},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.3273522},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.0},{"id":"https://openalex.org/C8891405","wikidata":"https://www.wikidata.org/wiki/Q1059","display_name":"Immune system","level":2,"score":0.0},{"id":"https://openalex.org/C203014093","wikidata":"https://www.wikidata.org/wiki/Q101929","display_name":"Immunology","level":1,"score":0.0},{"id":"https://openalex.org/C542102704","wikidata":"https://www.wikidata.org/wiki/Q183257","display_name":"Psychotherapist","level":1,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"is_oa":false,"landing_page_url":"https://doi.org/10.1109/tnsm.2021.3112056","pdf_url":null,"source":{"id":"https://openalex.org/S173527311","display_name":"IEEE Transactions on Network and Service Management","issn_l":"1932-4537","issn":["1932-4537","2373-7379"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.45,"display_name":"Decent work and economic growth","id":"https://metadata.un.org/sdg/8"}],"grants":[],"datasets":[],"versions":[],"referenced_works_count":34,"referenced_works":["https://openalex.org/W1629102637","https://openalex.org/W1977177161","https://openalex.org/W2007627477","https://openalex.org/W2120109599","https://openalex.org/W2122997647","https://openalex.org/W2135813353","https://openalex.org/W2141577524","https://openalex.org/W2181925019","https://openalex.org/W2183762295","https://openalex.org/W2284289336","https://openalex.org/W2487124337","https://openalex.org/W2603160474","https://openalex.org/W2753594008","https://openalex.org/W2773511604","https://openalex.org/W2784113120","https://openalex.org/W2800912855","https://openalex.org/W2885747980","https://openalex.org/W2887670066","https://openalex.org/W2889559485","https://openalex.org/W2900275727","https://openalex.org/W2914076857","https://openalex.org/W2922394742","https://openalex.org/W2953506610","https://openalex.org/W2962911061","https://openalex.org/W2963204406","https://openalex.org/W2969244304","https://openalex.org/W2969904462","https://openalex.org/W2974072230","https://openalex.org/W2980075242","https://openalex.org/W3016369654","https://openalex.org/W3028860567","https://openalex.org/W3046012722","https://openalex.org/W3097730806","https://openalex.org/W4302027802"],"related_works":["https://openalex.org/W4387298227","https://openalex.org/W4387065217","https://openalex.org/W4368275542","https://openalex.org/W4285357721","https://openalex.org/W3214090987","https://openalex.org/W3201228709","https://openalex.org/W3152957156","https://openalex.org/W2526398307","https://openalex.org/W2470502009","https://openalex.org/W2470029541"],"abstract_inverted_index":{"Ransomware":[0],"attacks":[1],"are":[2,25],"among":[3],"the":[4,125,128,132,179],"most":[5],"disruptive":[6],"cyber":[7],"threats,":[8],"causing":[9],"significant":[10],"financial":[11],"losses":[12],"while":[13,108,176],"impacting":[14],"productivity,":[15],"accessibility,":[16],"and":[17,112,136,184],"reputation.":[18],"Despite":[19],"their":[20,81],"end":[21],"goals":[22],"(encryption/locking),":[23],"ransomware":[24,63,77,118,173,189],"often":[26],"designed":[27],"to":[28,56,79,116],"evade":[29],"detection":[30],"by":[31,87,192],"executing":[32],"a":[33,44,53],"series":[34],"of":[35,99,127],"pre-attack":[36],"API":[37,106],"calls,":[38],"namely":[39],"\u201cparanoia\u201d":[40],"activities,":[41],"for":[42,61,172,181,187],"determining":[43],"suitable":[45],"execution":[46],"environment.":[47],"In":[48],"this":[49,67,148],"work,":[50],"we":[51,69,102],"present":[52],"first-of-a-kind":[54],"effort":[55],"utilize":[57],"such":[58,96,164],"paranoia":[59,84,196],"activities":[60],"characterizing":[62],"distinguishable":[64],"behaviors.":[65],"To":[66],"end,":[68],"draw-upon":[70],"more":[71],"than":[72],"3K":[73],"samples":[74],"from":[75,147],"recent/prominent":[76],"families":[78],"fingerprint":[80],"uniquely":[82],"leveraged":[83],"activities.":[85,197],"Specifically,":[86],"leveraging":[88],"techniques":[89,138],"rooted":[90],"in":[91],"Natural":[92],"Language":[93],"Processing":[94],"(NLP)":[95],"as":[97,170],"Occurrence":[98],"Words":[100],"(OoW),":[101],"model":[103],"ransomware-generated":[104,195],"evasion":[105,157],"calls":[107],"tailoring":[109],"various":[110],"machine":[111],"deep":[113],"learning":[114],"algorithms":[115],"perform":[117],"classification.":[119],"The":[120,145],"thoroughly":[121],"conducted":[122],"evaluations":[123],"demonstrate":[124],"effectiveness":[126],"implemented":[129],"approach,":[130],"with":[131],"Random":[133],"Forest":[134],"(RF)":[135],"OoW":[137],"producing":[139],"an":[140],"optimal":[141],"classification":[142],"accuracy":[143],"(94.92%).":[144],"insights/findings":[146],"work":[149],"not":[150],"only":[151],"shed":[152],"light":[153],"on":[154],"contemporary":[155],"ransomware-specific":[156],"methods,":[158],"but":[159],"also":[160],"(i)":[161],"indicates":[162],"that":[163],"tactics":[165],"could":[166],"be":[167],"employed":[168],"effectively":[169],"features":[171],"family":[174],"attribution":[175],"(ii)":[177],"laying":[178],"foundation":[180],"implementing":[182],"proactive":[183],"portable":[185],"countermeasures":[186],"further":[188],"attack":[190],"detection/mitigation":[191],"solely":[193],"utilizing":[194]},"cited_by_api_url":"https://api.openalex.org/works?filter=cites:W3201224956","counts_by_year":[{"year":2024,"cited_by_count":11},{"year":2023,"cited_by_count":15},{"year":2022,"cited_by_count":2}],"updated_date":"2024-10-08T07:58:25.167460","created_date":"2021-09-27"}
