{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,19]],"date-time":"2026-05-19T02:07:12Z","timestamp":1779156432364,"version":"3.51.4"},"publisher-location":"Cham","reference-count":29,"publisher":"Springer Nature Switzerland","isbn-type":[{"value":"9783032234490","type":"print"},{"value":"9783032234506","type":"electronic"}],"license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026]]},"DOI":"10.1007\/978-3-032-23450-6_23","type":"book-chapter","created":{"date-parts":[[2026,5,19]],"date-time":"2026-05-19T01:31:06Z","timestamp":1779154266000},"page":"452-469","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Insights into Ransomware Detection based on\u00a0Semantic Understanding"],"prefix":"10.1007","author":[{"given":"Lingbo","family":"Zhao","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Shuquan","family":"Wang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Zhilu","family":"Wang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yuhui","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Rui","family":"Hou","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2026,5,19]]},"reference":[{"key":"23_CR1","unstructured":"Team, T.I.: Global ransomware attacks at an all-time high, shows latest 2023 state of ransomware report (2023). https:\/\/www.threatdown.com\/blog\/global-ransomware-attacks-at-an-all-time-high-shows-latest-2023-state-of-ransomware-report\/. Accessed 20 Mar 2025"},{"key":"23_CR2","unstructured":"Veeam: 2024 ransomware trends report. https:\/\/go.veeam.com\/ransomware-trends-executive-summary-2024-us\/. Accessed 20 Mar 2025"},{"key":"23_CR3","doi-asserted-by":"publisher","unstructured":"Continella, A., et al.: ShieldFS: a self-healing, ransomware-aware filesystem. In: ACSAC, pp. 336\u2013347. ACM SIGCOMM (2016). https:\/\/doi.org\/10.1145\/2991079.2991110","DOI":"10.1145\/2991079.2991110"},{"key":"23_CR4","doi-asserted-by":"publisher","first-page":"114","DOI":"10.1007\/978-3-030-00470-5_6","volume-title":"Research in Attacks, Intrusions, and Defenses","author":"S Mehnaz","year":"2018","unstructured":"Mehnaz, S., Mudgerikar, A., Bertino, E.: RWGuard: a real-time detection system against cryptographic ransomware. In: Bailey, M., Holz, T., Stamatogiannakis, M., Ioannidis, S. (eds.) Research in Attacks, Intrusions, and Defenses, pp. 114\u2013136. Springer International Publishing, Cham (2018)"},{"key":"23_CR5","doi-asserted-by":"publisher","first-page":"98","DOI":"10.1007\/978-3-319-66332-6_5","volume-title":"Research in Attacks, Intrusions, and Defenses","author":"A Kharraz","year":"2017","unstructured":"Kharraz, A., Kirda, E.: Redemption: real-time protection against ransomware at end-hosts. In: Dacier, M., Bailey, M., Polychronakis, M., Antonakakis, M. (eds.) Research in Attacks, Intrusions, and Defenses, pp. 98\u2013119. Springer International Publishing, Cham (2017)"},{"key":"23_CR6","doi-asserted-by":"crossref","unstructured":"Kirda, E.: UNVEIL: a large-scale, automated approach to detecting ransomware (keynote). In: IEEE International Conference on Software Analysis, Evolution, and Reengineering (2016). https:\/\/api.semanticscholar.org\/CorpusID:14678747","DOI":"10.1109\/SANER.2017.7884603"},{"key":"23_CR7","doi-asserted-by":"publisher","unstructured":"Wang, S., Dong, F., Yang, H., Xu, J., Wang, H.: CanCal: towards real-time and lightweight ransomware detection and response in industrial environments. In: Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, CCS \u201924, pp. 2326\u20132340. Association for Computing Machinery, New York (2024). https:\/\/doi.org\/10.1145\/3658644.3690269","DOI":"10.1145\/3658644.3690269"},{"key":"23_CR8","unstructured":"Wang, Z., et al.: Ransom access memories: achieving practical ransomware protection in cloud with DeftPunk. In: 18th USENIX Symposium on Operating Systems Design and Implementation (OSDI 24), pp. 687\u2013702. USENIX Association, Santa Clara (2024). https:\/\/www.usenix.org\/conference\/osdi24\/presentation\/wang-zhongyu"},{"key":"23_CR9","doi-asserted-by":"publisher","first-page":"51395","DOI":"10.1109\/ACCESS.2023.3279819","volume":"11","author":"K Thummapudi","year":"2023","unstructured":"Thummapudi, K., Lama, P., Boppana, R.V.: Detection of ransomware attacks using processor and disk usage data. IEEE Access 11, 51395\u201351407 (2023). https:\/\/doi.org\/10.1109\/ACCESS.2023.3279819","journal-title":"IEEE Access"},{"key":"23_CR10","doi-asserted-by":"publisher","unstructured":"Zhou, C., et al.: Limits of I\/O based ransomware detection: an imitation based attack. In: 2023 IEEE Symposium on Security and Privacy (SP), pp. 2584\u20132601 (2023). https:\/\/doi.org\/10.1109\/SP46215.2023.10179372","DOI":"10.1109\/SP46215.2023.10179372"},{"key":"23_CR11","doi-asserted-by":"publisher","unstructured":"Athiwaratkun, B., Stokes, J.W.: Malware classification with LSTM and GRU language models and a character-level CNN. In: 2017 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 2482\u20132486 (2017). https:\/\/doi.org\/10.1109\/ICASSP.2017.7952603","DOI":"10.1109\/ICASSP.2017.7952603"},{"key":"23_CR12","doi-asserted-by":"crossref","unstructured":"Moussaileb, R., Cuppens-Boulahia, N., Lanet, J.L., Bouder, H.L.: A survey on windows-based ransomware taxonomy and detection mechanisms. ACM Comput. Surv. (CSUR) 54, 1\u201336 (2021). https:\/\/api.semanticscholar.org\/CorpusID:236898599","DOI":"10.1145\/3453153"},{"key":"23_CR13","doi-asserted-by":"crossref","unstructured":"Al-rimy, B.A.S., Maarof, M.A., Shaid, S.Z.M.: Ransomware threat success factors, taxonomy, and countermeasures: a survey and research directions. Comput. Secur. 74, 144\u2013166 (2018). https:\/\/api.semanticscholar.org\/CorpusID:44344755","DOI":"10.1016\/j.cose.2018.01.001"},{"key":"23_CR14","doi-asserted-by":"publisher","unstructured":"Agrawal, R., Stokes, J.W., Selvaraj, K., Marinescu, M.: Attention in recurrent neural networks for ransomware detection. In: ICASSP 2019 - 2019 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 3222\u20133226 (2019). https:\/\/doi.org\/10.1109\/ICASSP.2019.8682899","DOI":"10.1109\/ICASSP.2019.8682899"},{"key":"23_CR15","unstructured":"Aleksandar\u00a0Milenkoski, J.W.: crimeware-trends-ransomware-developers-turn-to-intermittent-encryption-to-evade-detection. https:\/\/www.sentinelone.com\/labs\/crimeware-trends-ransomware-developers- turn-to-intermittent-encryption-to- evade-detection\/. Accessed 20 Mar 2025"},{"key":"23_CR16","unstructured":"Pernet, C.: Ransomware-makes-use-of-intermittent-encryption-to-bypass-detection-algorithms. https:\/\/www.techrepublic.com\/article\/ransomware-makes-use-of-intermittent- encryption-to-bypass-detection-algorithms\/. Accessed 20 Mar 2025"},{"key":"23_CR17","unstructured":"Vaswani, A., et al.: Attention is all you need. In: Proceedings of the 31st International Conference on Neural Information Processing Systems, NIPS\u201917, pp. 6000\u20136010. Curran Associates Inc., Red Hook (2017)"},{"key":"23_CR18","unstructured":"MalwareBazaar: Malwarebazaar (2023). https:\/\/bazaar.abuse.ch\/. Accessed 20 Mar 2025"},{"key":"23_CR19","unstructured":"VirusShare: Virusshare.com - because sharing is caring (2023). https:\/\/virusshare.com\/. Accessed 20 Mar 2025"},{"key":"23_CR20","unstructured":"Microsoft: managing-contexts-in-a-minifilter-driver (2024). https:\/\/learn.microsoft.com\/zh-cn\/windows-hardware\/drivers\/ifs\/managing-contexts-in-a-minifilter-driver"},{"key":"23_CR21","unstructured":"trendmicro: play (2023). https:\/\/www.trendmicro.com\/vinfo\/us\/security\/news\/ransomware-spotlight\/ransomware-spotlight-play. Accessed 20 Mar 2025"},{"key":"23_CR22","unstructured":"Figueroa, M.: An inside look at how Ryuk evolved its encryption and evasion techniques. https:\/\/www.sentinelone.com\/labs\/an-inside-look-at-how-ryuk-evolved-its-encryption-and-evasion-techniques\/. Accessed 20 Mar 2025"},{"key":"23_CR23","unstructured":"Loman, M.: LockFile ransomware\u2019s box of tricks: intermittent encryption and evasion. https:\/\/news.sophos.com\/en-us\/2021\/08\/27\/ lockfile-ransomwares-box-of-tricks- intermittent-encryption-and-evasion\/. Accessed 20 Mar 2025"},{"key":"23_CR24","doi-asserted-by":"publisher","first-page":"1433","DOI":"10.1109\/TIFS.2023.3240025","volume":"18","author":"GO Ganfure","year":"2023","unstructured":"Ganfure, G.O., Wu, C.F., Chang, Y.H., Shih, W.K.: RTrap: trapping and containing ransomware with machine learning. IEEE Trans. Inf. Forensics Secur. 18, 1433\u20131448 (2023)","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"23_CR25","doi-asserted-by":"crossref","unstructured":"Reidys, B., Liu, P., Huang, J.: RSSD: defend against ransomware with hardware-isolated network-storage codesign and post-attack analysis. In: Proceedings of the 27th ACM International Conference on Architectural Support for Programming Languages and Operating Systems (2022). https:\/\/api.semanticscholar.org\/CorpusID:247026945","DOI":"10.1145\/3503222.3507773"},{"key":"23_CR26","doi-asserted-by":"crossref","unstructured":"Ma, B., et al.: Travelling the hypervisor and SSD: a tag-based approach against crypto ransomware with fine-grained data recovery. In: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, pp. 341\u2013355 (2023)","DOI":"10.1145\/3576915.3616665"},{"key":"23_CR27","doi-asserted-by":"crossref","unstructured":"Baek, S., Jung, Y., Mohaisen, A., Lee, S., Nyang, D.: SSD-insider: internal defense of solid-state drive against ransomware with perfect data recovery. In: 2018 IEEE 38th International Conference on Distributed Computing Systems (ICDCS), pp. 875\u2013884 (2018). https:\/\/api.semanticscholar.org\/CorpusID:50775506","DOI":"10.1109\/ICDCS.2018.00089"},{"issue":"10","key":"23_CR28","doi-asserted-by":"publisher","first-page":"1762","DOI":"10.1109\/TC.2020.3011214","volume":"70","author":"S Baek","year":"2021","unstructured":"Baek, S., Jung, Y., Mohaisen, D., Lee, S., Nyang, D.: SSD-assisted ransomware detection and data recovery techniques. IEEE Trans. Comput. 70(10), 1762\u20131776 (2021). https:\/\/doi.org\/10.1109\/TC.2020.3011214","journal-title":"IEEE Trans. Comput."},{"key":"23_CR29","unstructured":"Ahn, J., et al.: KEY-SSD: access-control drive to protect files from ransomware attacks (2019). CoRR abs\/1904.05012. http:\/\/arxiv.org\/abs\/1904.05012"}],"container-title":["Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering","Security and Privacy in Communication Networks"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-032-23450-6_23","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,5,19]],"date-time":"2026-05-19T01:31:11Z","timestamp":1779154271000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-032-23450-6_23"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"ISBN":["9783032234490","9783032234506"],"references-count":29,"URL":"https:\/\/doi.org\/10.1007\/978-3-032-23450-6_23","relation":{},"ISSN":["1867-8211","1867-822X"],"issn-type":[{"value":"1867-8211","type":"print"},{"value":"1867-822X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]},"assertion":[{"value":"19 May 2026","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"SecureComm","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Security and Privacy in Communication Systems","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Xiangtan","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"China","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2025","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"4 July 2025","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"6 July 2025","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"21","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"securecomm2025","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/securecomm.eai-conferences.org\/2025\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}