{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,1]],"date-time":"2026-02-01T04:11:11Z","timestamp":1769919071012,"version":"3.49.0"},"publisher-location":"Cham","reference-count":29,"publisher":"Springer Nature Switzerland","isbn-type":[{"value":"9783031928819","type":"print"},{"value":"9783031928826","type":"electronic"}],"license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025]]},"DOI":"10.1007\/978-3-031-92882-6_15","type":"book-chapter","created":{"date-parts":[[2025,5,15]],"date-time":"2025-05-15T14:33:37Z","timestamp":1747319617000},"page":"210-223","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":3,"title":["SAFARI: A\u00a0Scalable Air-Gapped Framework for\u00a0Automated Ransomware Investigation"],"prefix":"10.1007","author":[{"given":"Tommaso","family":"Compagnucci","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Franco","family":"Callegati","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Saverio","family":"Giallorenzo","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Andrea","family":"Melis","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Simone","family":"Melloni","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Alessandro","family":"Vannini","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2025,5,16]]},"reference":[{"key":"15_CR1","doi-asserted-by":"publisher","first-page":"144","DOI":"10.1016\/j.cose.2018.01.001","volume":"74","author":"B Al-rimy","year":"2018","unstructured":"Al-rimy, B., Maarof, M.A., Shaid, S.: Ransomware threat success factors, taxonomy, and countermeasures: a survey and research directions. Comput. Secur. 74, 144\u2013166 (2018). https:\/\/doi.org\/10.1016\/j.cose.2018.01.001","journal-title":"Comput. Secur."},{"key":"15_CR2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102490","volume":"111","author":"C Beaman","year":"2021","unstructured":"Beaman, C., Barkworth, A., Akande, T.D., Hakak, S., Khan, M.K.: Ransomware: recent advances, analysis, challenges and future research directions. Comput. Secur. 111, 102490 (2021). https:\/\/doi.org\/10.1016\/j.cose.2021.102490","journal-title":"Comput. Secur."},{"key":"15_CR3","doi-asserted-by":"publisher","unstructured":"Berardi, D., Giallorenzo, S., Melis, A., Melloni, S., Onori, L., Prandini, M.: Data flooding against ransomware: concepts and implementations. Comput. Secur., 103295 (2023). https:\/\/doi.org\/10.1016\/j.cose.2023.103295","DOI":"10.1016\/j.cose.2023.103295"},{"key":"15_CR4","doi-asserted-by":"publisher","DOI":"10.1016\/j.softx.2023.101605","volume":"25","author":"D Berardi","year":"2024","unstructured":"Berardi, D., Giallorenzo, S., Melis, A., Melloni, S., Prandini, M.: Ranflood: a mitigation tool based on the principles of data flooding against ransomware. SoftwareX 25, 101605 (2024). https:\/\/doi.org\/10.1016\/j.softx.2023.101605","journal-title":"SoftwareX"},{"key":"15_CR5","doi-asserted-by":"publisher","DOI":"10.1016\/J.COSE.2022.102760","volume":"119","author":"AY Connolly","year":"2022","unstructured":"Connolly, A.Y., Borrion, H.: Reducing ransomware crime: analysis of victims\u2019 payment decisions. Comput. Secur. 119, 102760 (2022). https:\/\/doi.org\/10.1016\/J.COSE.2022.102760","journal-title":"Comput. Secur."},{"key":"15_CR6","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2025.104315","volume":"151","author":"N d\u2019Ambrosio","year":"2025","unstructured":"d\u2019Ambrosio, N., Capodagli, G., Perrone, G., Romano, S.P.: Scass: breaking into scada systems security. Comput. Secur. 151, 104315 (2025). https:\/\/doi.org\/10.1016\/j.cose.2025.104315","journal-title":"Comput. Secur."},{"issue":"12","key":"15_CR7","doi-asserted-by":"publisher","first-page":"11553","DOI":"10.1109\/TII.2023.3246983","volume":"19","author":"A De Benedictis","year":"2023","unstructured":"De Benedictis, A., Flammini, F., Mazzocca, N., Somma, A., Vitale, F.: Digital twins for anomaly detection in the industrial internet of things: conceptual architecture and proof-of-concept. IEEE TII 19(12), 11553\u201311563 (2023). https:\/\/doi.org\/10.1109\/TII.2023.3246983","journal-title":"IEEE TII"},{"key":"15_CR8","doi-asserted-by":"publisher","unstructured":"Dey, A., Totel, E., Cost\u00e9, B.: Daemon: dynamic auto-encoders for contextualised anomaly detection applied to security monitoring. In: IFIP SEC, pp. 53\u201369. Springer, Heidelberg (2022). https:\/\/doi.org\/10.1007\/978-3-031-06975-8_4","DOI":"10.1007\/978-3-031-06975-8_4"},{"key":"15_CR9","doi-asserted-by":"publisher","unstructured":"Halsey, M.: Windows 10 file structure in depth. In: Windows 10 Troubleshooting, pp. 449\u2013457. Apress, Berkeley (2016). https:\/\/doi.org\/10.1007\/978-1-4842-0925-7_27","DOI":"10.1007\/978-1-4842-0925-7_27"},{"issue":"3","key":"15_CR10","doi-asserted-by":"publisher","DOI":"10.1098\/rsos.190023","volume":"7","author":"J Hernandez-Castro","year":"2020","unstructured":"Hernandez-Castro, J., Cartwright, A., Cartwright, E.: An economic analysis of ransomware and its welfare consequences. RSOS 7(3), 190023 (2020). https:\/\/doi.org\/10.1098\/rsos.190023","journal-title":"RSOS"},{"key":"15_CR11","series-title":"Communications in Computer and Information Science","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1007\/978-981-16-0422-5_1","volume-title":"Security in Computing and Communications","author":"H Jiang","year":"2021","unstructured":"Jiang, H., Choi, T., Ko, R.: Pandora: a cyber range environment for the safe testing and deployment of autonomous cyber attack tools. In: Thampi, S.M., Wang, G., Rawat, D.B., Ko, R., Fan, C.-I. (eds.) SSCC 2020. CCIS, vol. 1364, pp. 1\u201320. Springer, Singapore (2021). https:\/\/doi.org\/10.1007\/978-981-16-0422-5_1"},{"key":"15_CR12","doi-asserted-by":"publisher","DOI":"10.1016\/j.compeleceng.2022.108061","volume":"101","author":"NK Kandasamy","year":"2022","unstructured":"Kandasamy, N.K., Venugopalan, S., Wong, T.K., Leu, N.J.: An electric power digital twin for cyber security testing, research and education. Comput. Electr. Eng. 101, 108061 (2022). https:\/\/doi.org\/10.1016\/j.compeleceng.2022.108061","journal-title":"Comput. Electr. Eng."},{"key":"15_CR13","unstructured":"Kaspersky: Ransomware attacks and types (2021)"},{"key":"15_CR14","unstructured":"Kharraz, A., Arshad, S., Mulliner, C., Robertson, W.K., Kirda, E.: UNVEIL: a large-scale, automated approach to detecting ransomware. In: Holz, T., Savage, S. (eds.) USENIX Security Symposium, pp. 757\u2013772. USENIX Association (2016)"},{"key":"15_CR15","unstructured":"Kroll: Data exfiltration ransomware attacks (2021)"},{"key":"15_CR16","unstructured":"Liska, A., Gallo, T.: Ransomware: Defending Against Digital Extortion, 1st edn. O\u2019Reilly Media, Inc., Newton (2016)"},{"issue":"6","key":"15_CR17","doi-asserted-by":"publisher","first-page":"31","DOI":"10.1109\/MIM.2022.9847127","volume":"25","author":"RV Mahmoud","year":"2022","unstructured":"Mahmoud, R.V., Anagnostopoulos, M., Pedersen, J.M.: Detecting cyber attacks through measurements: learnings from a cyber range. IEEE IMM 25(6), 31\u201336 (2022). https:\/\/doi.org\/10.1109\/MIM.2022.9847127","journal-title":"IEEE IMM"},{"key":"15_CR18","doi-asserted-by":"publisher","unstructured":"Maigida, A.M., Abdulhamid, S.M., Olalere, M., Alhassan, J.K., Chiroma, H., Dada, E.G.: Systematic literature review and metadata analysis of ransomware attacks and detection mechanisms. J. Reliable Intell. Environ., 1\u201323 (2019). https:\/\/doi.org\/10.1007\/s40860-019-00080-3","DOI":"10.1007\/s40860-019-00080-3"},{"issue":"2","key":"15_CR19","doi-asserted-by":"publisher","first-page":"689","DOI":"10.1007\/s10270-022-01075-0","volume":"22","author":"M Masi","year":"2023","unstructured":"Masi, M., Sellitto, G.P., Aranha, H., Pavleska, T.: Securing critical infrastructures with a cybersecurity digital twin. Softw. Syst. Model. 22(2), 689\u2013707 (2023)","journal-title":"Softw. Syst. Model."},{"key":"15_CR20","doi-asserted-by":"publisher","DOI":"10.1145\/3691340","author":"T McIntosh","year":"2024","unstructured":"McIntosh, T., et al.: Ransomware reloaded: re-examining its trend, research and mitigation in the era of data exfiltration. ACM Comput. Surv. (2024). https:\/\/doi.org\/10.1145\/3691340","journal-title":"ACM Comput. Surv."},{"key":"15_CR21","doi-asserted-by":"publisher","unstructured":"McIntosh, T., et\u00a0al.: Ransomware mitigation in the modern era: a comprehensive review, research challenges, and future directions. ACM Comput. Surv. 54(9) (2021). https:\/\/doi.org\/10.1145\/3479393","DOI":"10.1145\/3479393"},{"key":"15_CR22","doi-asserted-by":"publisher","DOI":"10.1016\/J.COSE.2020.101762","volume":"92","author":"PH Meland","year":"2020","unstructured":"Meland, P.H., Bayoumy, Y., Sindre, G.: The ransomware-as-a-service economy within the darknet. Comput. Secur. 92, 101762 (2020). https:\/\/doi.org\/10.1016\/J.COSE.2020.101762","journal-title":"Comput. Secur."},{"key":"15_CR23","doi-asserted-by":"publisher","unstructured":"Meurs, T., Junger, M., Tews, E., Abhishta, A.: Ransomware: how attacker\u2019s effort, victim characteristics and context influence ransom requested, payment and financial loss. In: APWG eCrime, pp. 1\u201313. IEEE (2022). https:\/\/doi.org\/10.1109\/ECRIME57793.2022.10142138","DOI":"10.1109\/ECRIME57793.2022.10142138"},{"key":"15_CR24","unstructured":"OpenWrt Team: Openwrt. https:\/\/openwrt.org\/. Accessed Sept 2024"},{"key":"15_CR25","doi-asserted-by":"publisher","unstructured":"Oz, H., Aris, A., Levi, A., Uluagac, A.S.: A survey on ransomware: evolution, taxonomy, and defense solutions. ACM Comput. Surv. 54(11s) (2022). https:\/\/doi.org\/10.1145\/3514229","DOI":"10.1145\/3514229"},{"key":"15_CR26","doi-asserted-by":"publisher","unstructured":"Pokhrel, A., Katta, V., Colomo-Palacios, R.: Digital twin for cybersecurity incident prediction: a multivocal literature review. In: ICSEW\u201920, pp. 671\u2013678. ACM, New York (2020). https:\/\/doi.org\/10.1145\/3387940.3392199","DOI":"10.1145\/3387940.3392199"},{"key":"15_CR27","unstructured":"Richardson, R., North, M.: Ransomware: evolution, mitigation and prevention. Int. Manag. Rev. 13(1), 10\u201321,101 (2017). https:\/\/www.proquest.com\/scholarly-journals\/ransomware-evolution-mitigation-prevention\/docview\/1881414570\/se-2"},{"key":"15_CR28","doi-asserted-by":"crossref","unstructured":"Rossow, C., et al.: Prudent practices for designing malware experiments: status quo and outlook. In: IEEE S &P, pp. 65\u201379. IEEE (2012)","DOI":"10.1109\/SP.2012.14"},{"key":"15_CR29","doi-asserted-by":"publisher","unstructured":"Scaife, N., Carter, H., Traynor, P., Butler, K.R.B.: Cryptolock (and drop it): stopping ransomware attacks on user data. In: IEEE ICDCS, pp. 303\u2013312 (2016). https:\/\/doi.org\/10.1109\/ICDCS.2016.46","DOI":"10.1109\/ICDCS.2016.46"}],"container-title":["IFIP Advances in Information and Communication Technology","ICT Systems Security and Privacy Protection"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-031-92882-6_15","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,5,15]],"date-time":"2025-05-15T14:33:42Z","timestamp":1747319622000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-031-92882-6_15"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"ISBN":["9783031928819","9783031928826"],"references-count":29,"URL":"https:\/\/doi.org\/10.1007\/978-3-031-92882-6_15","relation":{},"ISSN":["1868-4238","1868-422X"],"issn-type":[{"value":"1868-4238","type":"print"},{"value":"1868-422X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025]]},"assertion":[{"value":"16 May 2025","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"SEC","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"IFIP International Conference on ICT Systems Security and Privacy Protection","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Maribor","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Slovenia","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2025","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"21 May 2025","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"23 May 2025","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"40","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"sec2025","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/sec2025.um.si\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}