{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,29]],"date-time":"2026-05-29T22:04:02Z","timestamp":1780092242713,"version":"3.54.0"},"reference-count":53,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"2","license":[{"start":{"date-parts":[[2020,4,1]],"date-time":"2020-04-01T00:00:00Z","timestamp":1585699200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"}],"funder":[{"name":"European Council 268 International Incoming Fellowship","award":["FP7-PEOPLE-2013-IIF"],"award-info":[{"award-number":["FP7-PEOPLE-2013-IIF"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Emerg. Topics Comput."],"published-print":{"date-parts":[[2020,4,1]]},"DOI":"10.1109\/tetc.2017.2756908","type":"journal-article","created":{"date-parts":[[2017,9,26]],"date-time":"2017-09-26T18:20:15Z","timestamp":1506450015000},"page":"341-351","source":"Crossref","is-referenced-by-count":129,"title":["Know Abnormal, Find Evil: Frequent Pattern Mining for Ransomware Threat Hunting and Intelligence"],"prefix":"10.1109","volume":"8","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-9371-9759","authenticated-orcid":false,"given":"Sajad","family":"Homayoun","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9294-7554","authenticated-orcid":false,"given":"Ali","family":"Dehghantanha","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Marzieh","family":"Ahmadzadeh","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Sattar","family":"Hashemi","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Raouf","family":"Khayami","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref39","article-title":"CloudRPS: A cloud analysis based enhanced ransomware prevention system","author":"lee","year":"2016","journal-title":"J Supercomputing"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/ISCISC.2016.7736455"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/NTMS.2016.7792489"},{"key":"ref32","first-page":"10","article-title":"A survey on malware propagation, analysis, and detection","volume":"2","author":"damshenas","year":"2013","journal-title":"International Journal of Cyber-Security and Digital Forensics (UCSDF"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1016\/S1353-4858(16)30086-1"},{"key":"ref30","doi-asserted-by":"crossref","first-page":"77","DOI":"10.1007\/s11416-008-0092-2","article-title":"Comparative analysis of various ransomware virii","volume":"6","author":"gazet","year":"2008","journal-title":"J Comput Virology"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/CCC.2016.14"},{"key":"ref36","first-page":"757","article-title":"Unveil: A large-scale, automated approach to detecting ransomware","author":"kharaz","year":"2016","journal-title":"Proc 25th Usenix Security Symp"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-20550-2_1"},{"key":"ref34","doi-asserted-by":"crossref","first-page":"67","DOI":"10.1007\/s10207-006-0082-7","article-title":"Cryptoviral extortion using microsoft crypto API","volume":"5","author":"young","year":"2006","journal-title":"Int J Inf Security"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/MIC.2016.90"},{"key":"ref27","volume":"2016","year":"2016","journal-title":"Comput Fraud Security"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1016\/S1361-3723(16)30036-7"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2011.08.004"},{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/InfoSec.2015.7435501"},{"key":"ref20","article-title":"Automated dynamic analysis of ransomware: Benefits, limitations and use for detection","author":"sgandurra","year":"2016"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2016.2646641"},{"key":"ref21","doi-asserted-by":"crossref","first-page":"619","DOI":"10.1007\/s10844-013-0286-z","article-title":"Detecting intrusion transactions in database systems: A novel approach","volume":"42","author":"sohrabi","year":"2013","journal-title":"J Intell Inf Syst"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1016\/0005-2795(75)90109-9"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2015.2457918"},{"key":"ref26","first-page":"1","article-title":"Ransomware becomes most popular form of attack as payouts approach $1bn a year","volume":"2017","year":"2017","journal-title":"Netw Secur"},{"key":"ref25","first-page":"37","article-title":"Evaluation: From precision, recall and f-measure to ROC, informedness, markedness and correlation","volume":"2","author":"powers","year":"2011","journal-title":"J Mach Learn Technol"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1016\/j.ipm.2009.03.002"},{"key":"ref51","article-title":"Cloud incident handling and forensic-by-design: Cloud storage as a case study","volume":"29","author":"rahman","year":"2016","journal-title":"Concurrency Comput Practice Experience"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/CHASE.2017.68"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/MCC.2016.5"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/MNET.2016.1600110NM"},{"key":"ref11","first-page":"1","article-title":"Detecting crypto-ransomware in IoT networks based on energy consumption footprint","author":"azmoodeh","year":"2017","journal-title":"J Ambient Intell Humanized Comput"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1080\/15536548.2015.1073510"},{"key":"ref12","author":"savage","year":"2015","journal-title":"The Evolution of Ransomware"},{"key":"ref13","article-title":"Internet security threat report","year":"2016"},{"key":"ref14","first-page":"1","article-title":"Framing dependencies introduced by underground commoditization","author":"huang","year":"2015","journal-title":"Proc 4th Workshop Econ Inf Security"},{"key":"ref15","article-title":"Symantec backup survey","year":"2009"},{"key":"ref16","doi-asserted-by":"crossref","first-page":"465","DOI":"10.1016\/j.procs.2016.08.072","article-title":"Experimental analysis of ransomware on windows and android platforms: Evolution and characterization","volume":"94","author":"zavarsky","year":"2016","journal-title":"Procedia Comput Sci"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1080\/10658980701576412"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1016\/S1361-3723(17)30023-4"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/MCE.2014.2340211"},{"key":"ref4","article-title":"The internet organised crime threat assessment (iOCTA) 2016","year":"2016"},{"key":"ref3","doi-asserted-by":"crossref","DOI":"10.52922\/ti275639","article-title":"Cyber threat landscape faced by financial and insurance industry","author":"choo","year":"2011"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1016\/B978-0-12-804629-6.00008-0"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/Trustcom.2015.482"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2013.01.009"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1016\/j.compeleceng.2017.02.013"},{"key":"ref49","article-title":"Correlation-based feature selection for machine learning","author":"hall","year":"1999"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1016\/B978-0-12-802117-0.00015-1"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2016.2592905"},{"key":"ref45","first-page":"3389","article-title":"SPMF: A java open-source pattern mining library","volume":"15","author":"fournier-viger","year":"2014","journal-title":"J Mach Learn Res"},{"key":"ref48","year":"2017"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1145\/2463676.2465285"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/ICDE.1995.380415"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.2298\/CSIS0501103H"},{"key":"ref44","author":"tan","year":"2005","journal-title":"Introduction to Data Mining"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-07821-2_11"}],"container-title":["IEEE Transactions on Emerging Topics in Computing"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/6245516\/9109372\/08051108.pdf?arnumber=8051108","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,6,27]],"date-time":"2024-06-27T08:07:50Z","timestamp":1719475670000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/8051108\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,4,1]]},"references-count":53,"journal-issue":{"issue":"2"},"URL":"https:\/\/doi.org\/10.1109\/tetc.2017.2756908","relation":{},"ISSN":["2168-6750","2376-4562"],"issn-type":[{"value":"2168-6750","type":"electronic"},{"value":"2376-4562","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020,4,1]]}}}