{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,23]],"date-time":"2026-10-23T08:29:50Z","timestamp":1792744190032,"version":"4.5.0"},"publisher-location":"Cham","reference-count":22,"publisher":"Springer International Publishing","isbn-type":[{"value":"9783030675493","type":"print"},{"value":"9783030675509","type":"electronic"}],"license":[{"start":{"date-parts":[[2021,1,1]],"date-time":"2021-01-01T00:00:00Z","timestamp":1609459200000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"},{"start":{"date-parts":[[2021,1,1]],"date-time":"2021-01-01T00:00:00Z","timestamp":1609459200000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2021]]},"DOI":"10.1007\/978-3-030-67550-9_5","type":"book-chapter","created":{"date-parts":[[2021,1,19]],"date-time":"2021-01-19T12:02:51Z","timestamp":1611057771000},"page":"57-71","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":5,"title":["Using Process Mining to Identify File System Metrics Impacted by Ransomware Execution"],"prefix":"10.1007","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-0487-0615","authenticated-orcid":false,"given":"Arash","family":"Mahboubi","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9969-7682","authenticated-orcid":false,"given":"Keyvan","family":"Ansari","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6353-8359","authenticated-orcid":false,"given":"Seyit","family":"Camtepe","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2021,1,20]]},"reference":[{"issue":"4","key":"5_CR1","doi-asserted-by":"publisher","first-page":"525","DOI":"10.1109\/TSC.2012.25","volume":"6","author":"W Van Der Aalst","year":"2013","unstructured":"Van Der Aalst, W.: Service mining: using process mining to discover, check, and improve service behavior. IEEE Trans. Serv. Comput. 6(4), 525\u2013535 (2013). https:\/\/doi.org\/10.1109\/TSC.2012.25","journal-title":"IEEE Trans. Serv. Comput."},{"key":"5_CR2","doi-asserted-by":"crossref","unstructured":"Van der Aalst, W.: Data Science in Action, pp. 3\u201323. Springer, Heidelberg (2016). https:\/\/doi.org\/10.1007\/978-3-662-49851-4","DOI":"10.1007\/978-3-662-49851-4"},{"key":"5_CR3","doi-asserted-by":"publisher","unstructured":"Accorsi, R., Stocker, T., M\u00fcller, G.: On the exploitation of process mining for security audits: The process discovery case. In: Proceedings of the 28th Annual ACM Symposium on Applied Computing, pp. 1462\u20131468. SAC 2013. Association for Computing Machinery, New York, NY, USA (2013). https:\/\/doi.org\/10.1145\/2480362.2480634, https:\/\/doi.org\/10.1145\/2480362.2480634","DOI":"10.1145\/2480362.2480634"},{"key":"5_CR4","unstructured":"de Alvarenga, S.C., Zarpel, B., Miani, R.: Discovering attack strategies using process mining. In: Proceedings of the 11th Advanced International Conference on Telecommunications, pp. 119\u2013125 (2015)"},{"issue":"4","key":"5_CR5","doi-asserted-by":"publisher","first-page":"686","DOI":"10.1109\/TKDE.2018.2841877","volume":"31","author":"A Augusto","year":"2019","unstructured":"Augusto, A., et al.: Automated discovery of process models from event logs: review and benchmark. IEEE Trans. Knowl. Data Eng. 31(4), 686\u2013705 (2019). https:\/\/doi.org\/10.1109\/TKDE.2018.2841877","journal-title":"IEEE Trans. Knowl. Data Eng."},{"issue":"3","key":"5_CR6","doi-asserted-by":"publisher","first-page":"257","DOI":"10.1007\/s10207-018-0415-3","volume":"18","author":"ML Bernardi","year":"2018","unstructured":"Bernardi, M.L., Cimitile, M., Distante, D., Martinelli, F., Mercaldo, F.: Dynamic malware detection and phylogeny analysis using process mining. Int. J. Inf. Secur. 18(3), 257\u2013284 (2018). https:\/\/doi.org\/10.1007\/s10207-018-0415-3","journal-title":"Int. J. Inf. Secur."},{"key":"5_CR7","doi-asserted-by":"crossref","unstructured":"Coltellese, S., Maggi, F.M., Marrella, A., Massarelli, L., Querzoni, L.: Triage of iot attacks through process mining. In: OTM Confederated International Conferences\u201d On the Move to Meaningful Internet Systems\u201d. pp. 326\u2013344. Springer (2019)","DOI":"10.1007\/978-3-030-33246-4_22"},{"key":"5_CR8","doi-asserted-by":"publisher","unstructured":"Continella, A., et al.: Shieldfs: a self-healing, ransomware-aware filesystem. In: Proceedings of the 32nd Annual Conference on Computer Security Applications, pp. 336\u2013347. ACSAC 2016, Association for Computing Machinery, New York, NY, USA (2016). https:\/\/doi.org\/10.1145\/2991079.2991110","DOI":"10.1145\/2991079.2991110"},{"key":"5_CR9","doi-asserted-by":"publisher","first-page":"444","DOI":"10.1007\/11494744_25","volume-title":"Applications and Theory of Petri Nets 2005","author":"BF van Dongen","year":"2005","unstructured":"van Dongen, B.F., de Medeiros, A.K.A., Verbeek, H.M.W., Weijters, A.J.M.M., van der Aalst, W.M.P.: The prom framework: A new era in process mining tool support. In: Ciardo, G., Darondeau, P. (eds.) Applications and Theory of Petri Nets 2005, pp. 444\u2013454. Springer, Berlin Heidelberg, Berlin, Heidelberg (2005)"},{"key":"5_CR10","doi-asserted-by":"crossref","unstructured":"Hassan, N.A.: Ransomware Families, pp. 47\u201368. Apress, Berkeley (2019)","DOI":"10.1007\/978-1-4842-4255-1_3"},{"key":"5_CR11","doi-asserted-by":"publisher","unstructured":"Honda, T., Mukaiyama, K., Shirai, T., Ohki, T., Nishigaki, M.: Ransomware detection considering user\u2019s document editing. In: 2018 IEEE 32nd International Conference on Advanced Information Networking and Applications (AINA), pp. 907\u2013914 (2018). https:\/\/doi.org\/10.1109\/AINA.2018.00133","DOI":"10.1109\/AINA.2018.00133"},{"key":"5_CR12","doi-asserted-by":"publisher","unstructured":"Jans, M., Alles, M., Vasarhelyi, M.: The case for process mining in auditing: sources of value added and areas of application. Int. J. Account. Inf. Syst. 14(1), 1\u201320 (2013). https:\/\/doi.org\/10.1016\/j.accinf.2012.06.015, http:\/\/www.sciencedirect.com\/science\/article\/pii\/S1467089512000462","DOI":"10.1016\/j.accinf.2012.06.015"},{"key":"5_CR13","doi-asserted-by":"publisher","unstructured":"Kim, D., Lee, J.: Blacklist vs. whitelist-based ransomware solutions. IEEE Consumer Electr. Mag. 9(3), 22\u201328 (2020). https:\/\/doi.org\/10.1109\/MCE.2019.2956192","DOI":"10.1109\/MCE.2019.2956192"},{"key":"5_CR14","unstructured":"Leemans, M.: Statechart prom plugin : statechart workbench (2017)"},{"key":"5_CR15","unstructured":"Loman, M.: How ransomware attacks. Sophos (2019), https:\/\/www.sophos.com\/en-us\/medialibrary\/PDFs\/technical-papers\/sophoslabs-ransomware-behavior-report.pdf"},{"key":"5_CR16","doi-asserted-by":"publisher","first-page":"27740","DOI":"10.1109\/ACCESS.2017.2772787","volume":"5","author":"A Mahboubi","year":"2017","unstructured":"Mahboubi, A., Camtepe, S., Morarji, H.: A study on formal methods to generalize heterogeneous mobile malware propagation and their impacts. IEEE Access 5, 27740\u201327756 (2017). https:\/\/doi.org\/10.1109\/ACCESS.2017.2772787","journal-title":"IEEE Access"},{"key":"5_CR17","unstructured":"Sgandurra, D., Mu\u00f1oz-Gonz\u00e1lez, L., Mohsen, R., Lupu, E.C.: Automated dynamic analysis of ransomware: Benefits, limitations and use for detection. arXiv preprint arXiv:1609.03020 (2016)"},{"key":"5_CR18","doi-asserted-by":"publisher","unstructured":"Van Der Aalst, W.M.P., Van Hee, K.M., Van der Werf, J.M., Verdonk, M.: Auditing 2.0: using process mining to support tomorrow\u2019s auditor. Computer 43(3), 90\u201393 (2010). https:\/\/doi.org\/10.1109\/MC.2010.61","DOI":"10.1109\/MC.2010.61"},{"key":"5_CR19","doi-asserted-by":"publisher","unstructured":"Van Der Aalst, W., de Medeiros, A.: Process mining and security: Detecting anomalous process executions and checking process conformance. Electr. Notes Theoret. Comput. Sci. 121, 3\u201321 (2005). https:\/\/doi.org\/10.1016\/j.entcs.2004.10.013, http:\/\/www.sciencedirect.com\/science\/article\/pii\/S1571066105000228. Proceedings of the 2nd International Workshop on Security Issues with Petri Nets and other Computational Models (WISP 2004)","DOI":"10.1016\/j.entcs.2004.10.013"},{"key":"5_CR20","series-title":"Lecture Notes in Business Information Processing","doi-asserted-by":"publisher","first-page":"353","DOI":"10.1007\/978-3-319-15895-2_30","volume-title":"Business Process Management Workshops","author":"C Wakup","year":"2015","unstructured":"Wakup, C., Desel, J.: Analyzing a TCP\/IP-protocol with process mining techniques. In: Fournier, F., Mendling, J. (eds.) BPM 2014. LNBIP, vol. 202, pp. 353\u2013364. Springer, Cham (2015). https:\/\/doi.org\/10.1007\/978-3-319-15895-2_30"},{"key":"5_CR21","doi-asserted-by":"publisher","unstructured":"Yaqoob, I., et al.: The rise of ransomware and emerging security challenges in the internet of things. Comput. Networks 129, 444\u2013458 (2017). https:\/\/doi.org\/10.1016\/j.comnet.2017.09.003, http:\/\/www.sciencedirect.com\/science\/article\/pii\/S1389128617303468. Special Issue on 5G Wireless Networks for IoT and Body Sensors","DOI":"10.1016\/j.comnet.2017.09.003"},{"key":"5_CR22","doi-asserted-by":"publisher","unstructured":"Young, A., Yung, M.: Cryptovirology: extortion-based security threats and countermeasures. In: Proceedings 1996 IEEE Symposium on Security and Privacy, pp. 129\u2013140 (1996). https:\/\/doi.org\/10.1109\/SECPRI.1996.502676","DOI":"10.1109\/SECPRI.1996.502676"}],"container-title":["Lecture Notes in Computer Science","Mobile, Secure, and Programmable Networking"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-030-67550-9_5","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,1,19]],"date-time":"2021-01-19T12:06:23Z","timestamp":1611057983000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-030-67550-9_5"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021]]},"ISBN":["9783030675493","9783030675509"],"references-count":22,"URL":"https:\/\/doi.org\/10.1007\/978-3-030-67550-9_5","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021]]},"assertion":[{"value":"20 January 2021","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"MSPN","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Mobile, Secure, and Programmable Networking","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Paris","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"France","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2020","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"28 October 2020","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"29 October 2020","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"6","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"mspn2020","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/mspn2020.roc.cnam.fr\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Double-blind","order":1,"name":"type","label":"Type","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"EasyChair","order":2,"name":"conference_management_system","label":"Conference Management System","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"31","order":3,"name":"number_of_submissions_sent_for_review","label":"Number of Submissions Sent for Review","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"16","order":4,"name":"number_of_full_papers_accepted","label":"Number of Full Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"0","order":5,"name":"number_of_short_papers_accepted","label":"Number of Short Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"52% - The value is computed by the equation \"Number of Full Papers Accepted \/ Number of Submissions Sent for Review * 100\" and then rounded to a whole number.","order":6,"name":"acceptance_rate_of_full_papers","label":"Acceptance Rate of Full Papers","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"3","order":7,"name":"average_number_of_reviews_per_paper","label":"Average Number of Reviews per Paper","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"2","order":8,"name":"average_number_of_papers_per_reviewer","label":"Average Number of Papers per Reviewer","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"No","order":9,"name":"external_reviewers_involved","label":"External Reviewers Involved","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"The conference was held virtually.","order":10,"name":"additional_info_on_review_process","label":"Additional Info on Review Process","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}}]}}