{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,2]],"date-time":"2026-09-02T15:03:29Z","timestamp":1788361409244,"version":"build-2803163510"},"publisher-location":"Cham","reference-count":19,"publisher":"Springer International Publishing","isbn-type":[{"value":"9783030368012","type":"print"},{"value":"9783030368029","type":"electronic"}],"license":[{"start":{"date-parts":[[2019,1,1]],"date-time":"2019-01-01T00:00:00Z","timestamp":1546300800000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2019]]},"DOI":"10.1007\/978-3-030-36802-9_20","type":"book-chapter","created":{"date-parts":[[2019,12,5]],"date-time":"2019-12-05T18:03:03Z","timestamp":1575568983000},"page":"181-189","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":54,"title":["The Inadequacy of Entropy-Based Ransomware Detection"],"prefix":"10.1007","author":[{"given":"Timothy","family":"McIntosh","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Julian","family":"Jang-Jaccard","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Paul","family":"Watters","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Teo","family":"Susnjak","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2019,12,5]]},"reference":[{"key":"20_CR1","doi-asserted-by":"crossref","unstructured":"Ahmadian, M.M., Shahriari, H.R., Ghaffarian, S.M.: Connection-monitor & connection-breaker: a novel approach for prevention and detection of high survivable ransomwares. In: 2015 12th International Iranian Society of Cryptology Conference on Information Security and Cryptology (ISCISC), pp. 79\u201384. IEEE (2015)","DOI":"10.1109\/ISCISC.2015.7387902"},{"key":"20_CR2","doi-asserted-by":"crossref","unstructured":"Continella, A., et al.: Shieldfs: a self-healing, ransomware-aware file system. In: Proceedings of the 32nd Annual Conference on Computer Security Applications, pp. 336\u2013347. ACM (2016)","DOI":"10.1145\/2991079.2991110"},{"key":"20_CR3","doi-asserted-by":"publisher","first-page":"S2","DOI":"10.1016\/j.diin.2009.06.016","volume":"6","author":"Simson Garfinkel","year":"2009","unstructured":"Garfinkel, S., Farrell, P., Roussev, V., Dinolt, G.: Bringing science to digital forensics with standardized forensic corpora. Digit. Invest. 6, S2\u2013S11 (2009)","journal-title":"Digital Investigation"},{"key":"20_CR4","doi-asserted-by":"crossref","unstructured":"Gen\u00e7, Z.A., Lenzini, G., Ryan, P.Y.: Security analysis of key acquiring strategies used by cryptographic ransomware. In: Proceedings of the Central European Cybersecurity Conference 2018, p. 7. ACM (2018)","DOI":"10.1145\/3277570.3277577"},{"key":"20_CR5","doi-asserted-by":"publisher","first-page":"389","DOI":"10.1016\/j.cose.2017.11.019","volume":"73","author":"J G\u00f3mez-Hern\u00e1ndez","year":"2018","unstructured":"G\u00f3mez-Hern\u00e1ndez, J., \u00c1lvarez-Gonz\u00e1lez, L., Garc\u00eda-Teodoro, P.: R-locker: Thwarting ransomware action through a honeyfile-based approach. Comput. Secur. 73, 389\u2013398 (2018)","journal-title":"Comput. Secur."},{"key":"20_CR6","unstructured":"Held, M., Waldvogel, M.: Fighting ransomware with guided undo. In: Proceedings of the 11th Norwegian Information Security Conference (2018)"},{"key":"20_CR7","first-page":"1","volume":"PP","author":"S Homayoun","year":"2017","unstructured":"Homayoun, S., Dehghantanha, A., Ahmadzadeh, M., Hashemi, S., Khayami, R.: Know abnormal, find evil: Frequent pattern mining for ransomware threat hunting and intelligence. IEEE Trans. Emerg. Top. Comput. PP, 1 (2017)","journal-title":"IEEE Trans. Emerg. Top. Comput."},{"key":"20_CR8","doi-asserted-by":"crossref","unstructured":"Josefsson, S.: The base16, base32, and base64 data encodings (2006)","DOI":"10.17487\/rfc4648"},{"key":"20_CR9","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"98","DOI":"10.1007\/978-3-319-66332-6_5","volume-title":"Research in Attacks, Intrusions, and Defenses","author":"A Kharraz","year":"2017","unstructured":"Kharraz, A., Kirda, E.: Redemption: real-time protection against ransomware at end-hosts. In: Dacier, M., Bailey, M., Polychronakis, M., Antonakakis, M. (eds.) RAID 2017. LNCS, vol. 10453, pp. 98\u2013119. Springer, Cham (2017). https:\/\/doi.org\/10.1007\/978-3-319-66332-6_5"},{"key":"20_CR10","doi-asserted-by":"crossref","unstructured":"Kirda, E.: Unveil: a large-scale, automated approach to detecting ransomware (keynote). In: 2017 IEEE 24th International Conference on Software Analysis, Evolution and Reengineering (SANER), p. 1. IEEE (2017)","DOI":"10.1109\/SANER.2017.7884603"},{"key":"20_CR11","doi-asserted-by":"crossref","unstructured":"Kolodenker, E., Koch, W., Stringhini, G., Egele, M.: Paybreak: defense against cryptographic ransomware. In: Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security, pp. 599\u2013611. ACM (2017)","DOI":"10.1145\/3052973.3053035"},{"key":"20_CR12","unstructured":"Li, W.J., Wang, K., Stolfo, S.J., Herzog, B.: Fileprints: identifying file types by n-gram analysis. In: Proceedings from the Sixth Annual IEEE SMC Information Assurance Workshop, IAW 2005, pp. 64\u201371. IEEE (2005)"},{"key":"20_CR13","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"532","DOI":"10.1007\/978-3-319-48965-0_32","volume-title":"Cryptology and Network Security","author":"F Mbol","year":"2016","unstructured":"Mbol, F., Robert, J.-M., Sadighian, A.: An efficient approach to detect torrentlocker ransomware in computer systems. In: Foresti, S., Persiano, G. (eds.) CANS 2016. LNCS, vol. 10052, pp. 532\u2013541. Springer, Cham (2016). https:\/\/doi.org\/10.1007\/978-3-319-48965-0_32"},{"key":"20_CR14","doi-asserted-by":"crossref","unstructured":"McDaniel, M., Heydari, M.H.: Content based file type detection algorithms. In: Proceedings of the 36th Annual Hawaii International Conference on System Sciences, p. 10. IEEE (2003)","DOI":"10.1109\/HICSS.2003.1174905"},{"key":"20_CR15","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"217","DOI":"10.1007\/978-3-030-04224-0_19","volume-title":"Neural Information Processing","author":"TR McIntosh","year":"2018","unstructured":"McIntosh, T.R., Jang-Jaccard, J., Watters, P.A.: Large scale behavioral analysis of ransomware attacks. In: Cheng, L., Leung, A.C.S., Ozawa, S. (eds.) ICONIP 2018. LNCS, vol. 11306, pp. 217\u2013229. Springer, Cham (2018). https:\/\/doi.org\/10.1007\/978-3-030-04224-0_19"},{"key":"20_CR16","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"114","DOI":"10.1007\/978-3-030-00470-5_6","volume-title":"Research in Attacks, Intrusions, and Defenses","author":"S Mehnaz","year":"2018","unstructured":"Mehnaz, S., Mudgerikar, A., Bertino, E.: RWGuard: a real-time detection system against cryptographic ransomware. In: Bailey, M., Holz, T., Stamatogiannakis, M., Ioannidis, S. (eds.) RAID 2018. LNCS, vol. 11050, pp. 114\u2013136. Springer, Cham (2018). https:\/\/doi.org\/10.1007\/978-3-030-00470-5_6"},{"key":"20_CR17","doi-asserted-by":"crossref","unstructured":"Scaife, N., Carter, H., Traynor, P., Butler, K.R.: Cryptolock (and drop it): stopping ransomware attacks on user data. In: 2016 IEEE 36th International Conference on Distributed Computing Systems (ICDCS), pp. 303\u2013312. IEEE (2016)","DOI":"10.1109\/ICDCS.2016.46"},{"key":"20_CR18","doi-asserted-by":"crossref","unstructured":"Verma, M., Kumarguru, P., Deb, S.B., Gupta, A.: Analysing indicator of compromises for ransomware: Leveraging IOCs with machine learning techniques. In: 2018 IEEE International Conference on Intelligence and Security Informatics (ISI), pp. 154\u2013159. IEEE (2018)","DOI":"10.1109\/ISI.2018.8587409"},{"issue":"2","key":"20_CR19","doi-asserted-by":"publisher","first-page":"63","DOI":"10.23919\/SAIEE.2014.8531919","volume":"105","author":"P Weston","year":"2014","unstructured":"Weston, P., Wolthusen, S.D.: Forensic entropy analysis of microsoft windows storage volumes. SAIEE Afr. Res. J. 105(2), 63\u201370 (2014)","journal-title":"SAIEE Afr. Res. J."}],"container-title":["Communications in Computer and Information Science","Neural Information Processing"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-030-36802-9_20","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,3,12]],"date-time":"2024-03-12T16:50:35Z","timestamp":1710262235000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-030-36802-9_20"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019]]},"ISBN":["9783030368012","9783030368029"],"references-count":19,"URL":"https:\/\/doi.org\/10.1007\/978-3-030-36802-9_20","relation":{},"ISSN":["1865-0929","1865-0937"],"issn-type":[{"value":"1865-0929","type":"print"},{"value":"1865-0937","type":"electronic"}],"subject":[],"published":{"date-parts":[[2019]]},"assertion":[{"value":"5 December 2019","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"ICONIP","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Neural Information Processing","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Sydney, NSW","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Australia","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2019","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"12 December 2019","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"15 December 2019","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"26","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"iconip2019","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"http:\/\/ajiips.com.au\/iconip2019\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}