{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,7,27]],"date-time":"2025-07-27T07:27:52Z","timestamp":1753601272217,"version":"3.37.3"},"publisher-location":"Cham","reference-count":30,"publisher":"Springer International Publishing","isbn-type":[{"type":"print","value":"9783030036379"},{"type":"electronic","value":"9783030036386"}],"license":[{"start":{"date-parts":[[2018,1,1]],"date-time":"2018-01-01T00:00:00Z","timestamp":1514764800000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2018]]},"DOI":"10.1007\/978-3-030-03638-6_24","type":"book-chapter","created":{"date-parts":[[2018,11,1]],"date-time":"2018-11-01T03:12:53Z","timestamp":1541041973000},"page":"385-401","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":12,"title":["Next Generation Cryptographic Ransomware"],"prefix":"10.1007","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-7198-7437","authenticated-orcid":false,"given":"Ziya Alper","family":"Gen\u00e7","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8229-3270","authenticated-orcid":false,"given":"Gabriele","family":"Lenzini","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Peter Y. A.","family":"Ryan","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2018,11,2]]},"reference":[{"key":"24_CR1","unstructured":"Barkly: 2017 Ransomware Report. Technical report. Barkly (2017)"},{"key":"24_CR2","doi-asserted-by":"crossref","unstructured":"Continella, A., et al.: ShieldFS: a self-healing, ransomware-aware filesystem. In: Proceedings of the 32nd Annual Conference on Computer Security Applications, pp. 336\u2013347. ACM, New York (2016)","DOI":"10.1145\/2991079.2991110"},{"key":"24_CR3","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-662-04722-4","volume-title":"The Design of Rijndael","author":"J Daemen","year":"2002","unstructured":"Daemen, J., Rijmen, V.: The Design of Rijndael. Springer, Heidelberg (2002). https:\/\/doi.org\/10.1007\/978-3-662-04722-4"},{"key":"24_CR4","unstructured":"Darwin, I.: Fine Free File Command (2010). http:\/\/www.darwinsys.com\/file\/"},{"issue":"5","key":"24_CR5","doi-asserted-by":"publisher","first-page":"531","DOI":"10.1111\/j.1541-1338.2011.00521.x","volume":"28","author":"R Deibert","year":"2011","unstructured":"Deibert, R., Crete-Nishihata, M.: Blurred boundaries: probing the ethics of cyberspace research. Rev. Policy Res. 28(5), 531\u2013537 (2011)","journal-title":"Rev. Policy Res."},{"key":"24_CR6","unstructured":"Directorate-General for Research and Innovation: Ethics for Researchers Facilitating Research Excellence in FP7. Technical report. European Commission, July 2013"},{"key":"24_CR7","doi-asserted-by":"crossref","unstructured":"Douceur, J.R., Adya, A., Bolosky, W.J., Simon, D., Theimer, M.: Reclaiming space from duplicate files in a serverless distributed file system. In: Proceedings of the 22nd International Conference on Distributed Computing Systems, pp. 617\u2013624. IEEE, Washington, DC (2002)","DOI":"10.1109\/ICDCS.2002.1022312"},{"key":"24_CR8","doi-asserted-by":"crossref","unstructured":"Eastlake 3rd, D.: Publicly Verifiable Nominations Committee (NomCom) Random Selection. RFC 3797, June 2004. https:\/\/tools.ietf.org\/pdf\/rfc3797.pdf","DOI":"10.17487\/rfc3797"},{"key":"24_CR9","volume-title":"Statistical Tables for Biological, Agricultural and Medical Research","author":"RA Fisher","year":"1938","unstructured":"Fisher, R.A., Yates, F.: Statistical Tables for Biological, Agricultural and Medical Research. Oliver and Boyd, Oxford (1938)"},{"key":"24_CR10","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"234","DOI":"10.1007\/978-3-319-93411-2_11","volume-title":"Detection of Intrusions and Malware, and Vulnerability Assessment","author":"ZA Gen\u00e7","year":"2018","unstructured":"Gen\u00e7, Z.A., Lenzini, G., Ryan, P.Y.A.: No random, no ransom: a key to stop cryptographic ransomware. In: Giuffrida, C., Bardin, S., Blanc, G. (eds.) DIMVA 2018. LNCS, vol. 10885, pp. 234\u2013255. Springer, Cham (2018). https:\/\/doi.org\/10.1007\/978-3-319-93411-2_11"},{"key":"24_CR11","doi-asserted-by":"publisher","first-page":"265","DOI":"10.1007\/978-3-642-13547-7_16","volume-title":"Cybercrimes: A Multidisciplinary Analysis","author":"JR Herrera-Flanigan","year":"2011","unstructured":"Herrera-Flanigan, J.R., Ghosh, S.: Criminal regulations. In: Ghosh, S., Turrini, E. (eds.) Cybercrimes: A Multidisciplinary Analysis, pp. 265\u2013308. Springer, Heidelberg (2011). https:\/\/doi.org\/10.1007\/978-3-642-13547-7_16"},{"key":"24_CR12","unstructured":"Hirschberg, B., Kravchik, M., Haenel, A., Solow, H.: Ransomware Key Extractor and Recovery System, April 2016. https:\/\/patentscope.wipo.int\/search\/en\/detail.jsf?docId=US215058675"},{"key":"24_CR13","unstructured":"Kaspersky: KSN Report - Ransomware in 2014\u20132016. Technical report. Kaspersky (2016)"},{"key":"24_CR14","unstructured":"Kharraz, A., Arshad, S., Mulliner, C., Robertson, W., Kirda, E.: UNVEIL: a large-scale, automated approach to detecting ransomware. In: 25th USENIX Security Symposium, pp. 757\u2013772. USENIX Association, Austin (2016)"},{"key":"24_CR15","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"98","DOI":"10.1007\/978-3-319-66332-6_5","volume-title":"Research in Attacks, Intrusions, and Defenses","author":"A Kharraz","year":"2017","unstructured":"Kharraz, A., Kirda, E.: Redemption real-time protection against ransomware at end-hosts. In: Dacier, M., Bailey, M., Polychronakis, M., Antonakakis, M. (eds.) RAID 2017. LNCS, vol. 10453, pp. 98\u2013119. Springer, Cham (2017). https:\/\/doi.org\/10.1007\/978-3-319-66332-6_5"},{"key":"24_CR16","doi-asserted-by":"crossref","unstructured":"Kim, H., Yoo, D., Kang, J.S., Yeom, Y.: Dynamic ransomware protection using deterministic random bit generator. In: 2017 IEEE Conference on Application, Information and Network Security (AINS), pp. 64\u201368, November 2017","DOI":"10.1109\/AINS.2017.8270426"},{"key":"24_CR17","doi-asserted-by":"crossref","unstructured":"Kolodenker, E., Koch, W., Stringhini, G., Egele, M.: PayBreak: defense against cryptographic ransomware. In: Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security, pp. 599\u2013611. ACM, New York (2017)","DOI":"10.1145\/3052973.3053035"},{"key":"24_CR18","series-title":"Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering","doi-asserted-by":"publisher","first-page":"105","DOI":"10.1007\/978-3-319-58967-1_12","volume-title":"Big Data Technologies and Applications","author":"K Lee","year":"2017","unstructured":"Lee, K., Oh, I., Yim, K.: Ransomware-prevention technique using key backup. In: Jung, J.J., Kim, P. (eds.) BDTA 2016. LNICST, vol. 194, pp. 105\u2013114. Springer, Cham (2017). https:\/\/doi.org\/10.1007\/978-3-319-58967-1_12"},{"key":"24_CR19","doi-asserted-by":"publisher","DOI":"10.1201\/9781439821916","volume-title":"Handbook of Applied Cryptography","author":"AJ Menezes","year":"1996","unstructured":"Menezes, A.J., Vanstone, S.A., Oorschot, P.C.V.: Handbook of Applied Cryptography, 1st edn. CRC Press Inc., Boca Raton (1996)","edition":"1"},{"key":"24_CR20","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"192","DOI":"10.1007\/978-3-319-70290-2_12","volume-title":"Secure IT Systems","author":"A Palisse","year":"2017","unstructured":"Palisse, A., Durand, A., Le Bouder, H., Le\u00a0Guernic, C., Lanet, J.-L.: Data aware defense (DaD): towards a generic and practical ransomware countermeasure. In: Lipmaa, H., Mitrokotsa, A., Matulevi\u010dius, R. (eds.) NordSec 2017. LNCS, vol. 10674, pp. 192\u2013208. Springer, Cham (2017). https:\/\/doi.org\/10.1007\/978-3-319-70290-2_12"},{"key":"24_CR21","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"11","DOI":"10.1007\/978-3-319-54876-0_2","volume-title":"Risks and Security of Internet and Systems","author":"A Palisse","year":"2017","unstructured":"Palisse, A., Le Bouder, H., Lanet, J.-L., Le Guernic, C., Legay, A.: Ransomware and the legacy crypto API. In: Cuppens, F., Cuppens, N., Lanet, J.-L., Legay, A. (eds.) CRiSIS 2016. LNCS, vol. 10158, pp. 11\u201328. Springer, Cham (2017). https:\/\/doi.org\/10.1007\/978-3-319-54876-0_2"},{"key":"24_CR22","unstructured":"Rogaway, P.: The Moral Character of Cryptographic Work. Cryptology ePrint Archive, Report 2015\/1162 (2015). https:\/\/eprint.iacr.org\/2015\/1162"},{"key":"24_CR23","series-title":"IFIP Advances in Information and Communication Technology","doi-asserted-by":"publisher","first-page":"207","DOI":"10.1007\/978-3-642-15506-2_15","volume-title":"Advances in Digital Forensics VI","author":"V Roussev","year":"2010","unstructured":"Roussev, V.: Data fingerprinting with similarity digests. In: Chow, K.-P., Shenoi, S. (eds.) DigitalForensics 2010. IAICT, vol. 337, pp. 207\u2013226. Springer, Heidelberg (2010). https:\/\/doi.org\/10.1007\/978-3-642-15506-2_15"},{"key":"24_CR24","unstructured":"Roussev, V., Quates, C.: The sdhash tutorial (2013). http:\/\/roussev.net\/sdhash\/tutorial\/03-quick.html"},{"key":"24_CR25","doi-asserted-by":"crossref","unstructured":"Scaife, N., Carter, H., Traynor, P., Butler, K.R.B.: CryptoLock (and drop it): stopping ransomware attacks on user data. In: 2016 IEEE 36th International Conference on Distributed Computing Systems (ICDCS), pp. 303\u2013312, June 2016","DOI":"10.1109\/ICDCS.2016.46"},{"key":"24_CR26","unstructured":"Stark, P.B.: Pseudo-Random Number Generator using SHA-256. https:\/\/www.stat.berkeley.edu\/~stark\/Java\/Html\/sha256Rand.htm"},{"key":"24_CR27","unstructured":"Morgan, S.: 2017 Cybercrimes Report. Technical report. Cybersecurity Ventures (2017)"},{"key":"24_CR28","doi-asserted-by":"crossref","unstructured":"Sullins, J.P.: A case study in malware research ethics education: when teaching bad is good. In: Proceedings of IEEE Security & Privacy, San Jose, CA, USA, 17\u201318 May 2014. IEEE computer society (2014)","DOI":"10.1109\/SPW.2014.46"},{"key":"24_CR29","unstructured":"Symantec Corporation: Internet Security Threat Report. Technical report, April 2018"},{"issue":"1","key":"24_CR30","doi-asserted-by":"publisher","first-page":"11","DOI":"10.1016\/S1353-4858(16)30008-3","volume":"2016","author":"F Touchette","year":"2016","unstructured":"Touchette, F.: The evolution of malware. Netw. Secur. 2016(1), 11\u201314 (2016)","journal-title":"Netw. Secur."}],"container-title":["Lecture Notes in Computer Science","Secure IT Systems"],"original-title":[],"link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-030-03638-6_24","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2019,10,30]],"date-time":"2019-10-30T06:17:58Z","timestamp":1572416278000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-030-03638-6_24"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2018]]},"ISBN":["9783030036379","9783030036386"],"references-count":30,"URL":"https:\/\/doi.org\/10.1007\/978-3-030-03638-6_24","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"type":"print","value":"0302-9743"},{"type":"electronic","value":"1611-3349"}],"subject":[],"published":{"date-parts":[[2018]]},"assertion":[{"value":"NordSec","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Nordic Conference on Secure IT Systems","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Oslo","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Norway","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2018","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"28 November 2018","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"30 November 2018","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"23","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"nordsec2018","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"http:\/\/securitylab.no\/nordsec18\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Double-blind","order":1,"name":"type","label":"Type","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information"}},{"value":"EasyChair","order":2,"name":"conference_management_system","label":"Conference Management System","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information"}},{"value":"81","order":3,"name":"number_of_submissions_sent_for_review","label":"Number of Submissions Sent for Review","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information"}},{"value":"29","order":4,"name":"number_of_full_papers_accepted","label":"Number of Full Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information"}},{"value":"0","order":5,"name":"number_of_short_papers_accepted","label":"Number of Short Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information"}},{"value":"36% - The value is computed by the equation \"Number of Full Papers Accepted \/ Number of Submissions Sent for Review * 100\" and then rounded to a whole number.","order":6,"name":"acceptance_rate_of_full_papers","label":"Acceptance Rate of Full Papers","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information"}},{"value":"3","order":7,"name":"average_number_of_reviews_per_paper","label":"Average Number of Reviews per Paper","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information"}},{"value":"4","order":8,"name":"average_number_of_papers_per_reviewer","label":"Average Number of Papers per Reviewer","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information"}},{"value":"Yes","order":9,"name":"external_reviewers_involved","label":"External Reviewers Involved","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information"}}]}}