{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,24]],"date-time":"2026-08-24T00:21:01Z","timestamp":1787530861393,"version":"build-2736575974"},"publisher-location":"New York, NY, USA","reference-count":62,"publisher":"ACM","license":[{"start":{"date-parts":[[2023,11,15]],"date-time":"2023-11-15T00:00:00Z","timestamp":1700006400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"Key R&D Program of Shaanxi Province of China","award":["2019ZDLGY12-06"],"award-info":[{"award-number":["2019ZDLGY12-06"]}]},{"name":"Shenzhen Science and Technology Program","award":["SGDX20201103095408029"],"award-info":[{"award-number":["SGDX20201103095408029"]}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62232013,62002151,U21A20464,62372218"],"award-info":[{"award-number":["62232013,62002151,U21A20464,62372218"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Foundation for Innovative Research Groups of the National Natural Science Foundation of China","award":["62121001"],"award-info":[{"award-number":["62121001"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2023,11,15]]},"DOI":"10.1145\/3576915.3616665","type":"proceedings-article","created":{"date-parts":[[2023,11,21]],"date-time":"2023-11-21T12:35:13Z","timestamp":1700570113000},"page":"341-355","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":12,"title":["Travelling the Hypervisor and SSD: A Tag-Based Approach Against Crypto Ransomware with Fine-Grained Data Recovery"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-9849-4576","authenticated-orcid":false,"given":"Boyang","family":"Ma","sequence":"first","affiliation":[{"name":"Xidian University, Xi'an, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-1829-6021","authenticated-orcid":false,"given":"Yilin","family":"Yang","sequence":"additional","affiliation":[{"name":"Xidian University, Xi'an, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0709-7434","authenticated-orcid":false,"given":"Jinku","family":"Li","sequence":"additional","affiliation":[{"name":"Xidian University, Xi'an, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3365-2526","authenticated-orcid":false,"given":"Fengwei","family":"Zhang","sequence":"additional","affiliation":[{"name":"Southern University of Science and Technology, Shenzhen, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2899-6121","authenticated-orcid":false,"given":"Wenbo","family":"Shen","sequence":"additional","affiliation":[{"name":"Zhejiang University, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7610-4736","authenticated-orcid":false,"given":"Yajin","family":"Zhou","sequence":"additional","affiliation":[{"name":"Zhejiang University, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4251-1143","authenticated-orcid":false,"given":"Jianfeng","family":"Ma","sequence":"additional","affiliation":[{"name":"Xidian University, Xi'an, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2023,11,21]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.3390\/s22051837"},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1145\/1134760.1134765"},{"key":"e_1_3_2_1_3_1","unstructured":"Jens Axboe. 2023. FIO. https:\/\/github.com\/axboe\/fio."},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICDCS.2018.00089"},{"key":"e_1_3_2_1_5_1","first-page":"1762","article-title":"SSD-Assisted Ransomware Detection and Data Recovery Techniques","volume":"70","author":"Baek SungHa","year":"2021","unstructured":"SungHa Baek, Youngdon Jung, David Mohaisen, Sungjin Lee, and DaeHun Nyang. 2021. SSD-Assisted Ransomware Detection and Data Recovery Techniques. IEEE Trans. Computers, Vol. 70, 10 (2021), 1762--1776.","journal-title":"IEEE Trans. Computers"},{"key":"e_1_3_2_1_6_1","volume-title":"Understanding the Linux Kernel: from I\/O ports to process management. \"O'Reilly Media","author":"Bovet Daniel P","unstructured":"Daniel P Bovet and Marco Cesati. 2005. Understanding the Linux Kernel: from I\/O ports to process management. \"O'Reilly Media, Inc.\"."},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1145\/2991079.2991101"},{"key":"e_1_3_2_1_8_1","first-page":"1239","article-title":"Analysis of Encryption Key Generation in Modern Crypto Ransomware","volume":"19","author":"Cicala Fabrizio","year":"2022","unstructured":"Fabrizio Cicala and Elisa Bertino. 2022. Analysis of Encryption Key Generation in Modern Crypto Ransomware. IEEE Trans. Dependable Secur. Comput., Vol. 19, 2 (2022), 1239--1253.","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"e_1_3_2_1_9_1","unstructured":"CNN. 2021. Ransomware is a national security risk. https:\/\/tinyurl.com\/4he7utk9."},{"key":"e_1_3_2_1_10_1","volume-title":"Ransomware-Aware Filesystem. In Proceedings of the 32nd Annual Conference on Computer Security Applications. 336--347","author":"Continella Andrea","year":"2016","unstructured":"Andrea Continella, Alessandro Guagnelli, Giovanni Zingaro, Giulio De Pasquale, Alessandro Barenghi, Stefano Zanero, and Federico Maggi. 2016. ShieldFS: A Self-Healing, Ransomware-Aware Filesystem. In Proceedings of the 32nd Annual Conference on Computer Security Applications. 336--347."},{"key":"e_1_3_2_1_11_1","volume-title":"Intel\u00ae 64 and IA-32 Architectures Software Developer's Manual","author":"Intel Corporation","year":"2022","unstructured":"Intel Corporation. 2022a. Intel\u00ae 64 and IA-32 Architectures Software Developer's Manual (2022). https:\/\/tinyurl.com\/mt58w3a9."},{"key":"e_1_3_2_1_12_1","unstructured":"The MITRE Corporation. 2022b. Access Token Manipulation. https:\/\/attack.mitre.org\/techniques\/T1134\/."},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-65745-1_3"},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2011.11"},{"key":"e_1_3_2_1_15_1","unstructured":"FBI. 2022. Ransomware. https:\/\/tinyurl.com\/2rnmxrzn."},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1145\/2505124"},{"key":"e_1_3_2_1_17_1","first-page":"191","article-title":"A virtual machine introspection based architecture for intrusion detection","volume":"3","author":"Garfinkel Tal","year":"2003","unstructured":"Tal Garfinkel, Mendel Rosenblum, et al. 2003. A virtual machine introspection based architecture for intrusion detection. In NDSS, Vol. 3. 191--206.","journal-title":"NDSS"},{"key":"e_1_3_2_1_18_1","volume-title":"Desktop Windows Version Market Share Worldwide -","year":"2021","unstructured":"GlobalStats. 2021. Desktop Windows Version Market Share Worldwide - June 2021. https:\/\/tinyurl.com\/4zrfxp9j."},{"key":"e_1_3_2_1_19_1","unstructured":"GoogleCode. 2011. OpenNFM. https:\/\/code.google.com\/p\/opennfm\/."},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00047"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134035"},{"key":"e_1_3_2_1_22_1","unstructured":"IBM. 2022. IBM Spectrum Scale with TRIM-supporting NVMe SSDs. https:\/\/shorturl.at\/hzCHS."},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2014.45"},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134011"},{"key":"e_1_3_2_1_25_1","unstructured":"The kernel development community. 2021. Processes and threads. https:\/\/linux-kernel-labs.github.io\/refs\/heads\/master\/lectures\/processes.html."},{"key":"e_1_3_2_1_26_1","unstructured":"kernel.org. 2022. Inline Data. https:\/\/tinyurl.com\/ynrd68ju."},{"key":"e_1_3_2_1_27_1","volume-title":"25th USENIX Security Symposium (USENIX Security 16)","author":"Kharaz Amin","year":"2016","unstructured":"Amin Kharaz, Sajjad Arshad, Collin Mulliner, William Robertson, and Engin Kirda. 2016. UNVEIL: A Large-Scale, Automated Approach to Detecting Ransomware. In 25th USENIX Security Symposium (USENIX Security 16). 757--772."},{"key":"e_1_3_2_1_28_1","first-page":"98","article-title":"Redemption: Real-time protection against ransomware at end-hosts. In Research in Attacks, Intrusions, and Defenses: 20th International Symposium","volume":"2017","author":"Kharraz Amin","year":"2017","unstructured":"Amin Kharraz and Engin Kirda. 2017. Redemption: Real-time protection against ransomware at end-hosts. In Research in Attacks, Intrusions, and Defenses: 20th International Symposium, RAID 2017. 98--119.","journal-title":"RAID"},{"key":"e_1_3_2_1_29_1","volume-title":"DIMVA","author":"Kharraz Amin","year":"2015","unstructured":"Amin Kharraz, William Robertson, Davide Balzarotti, Leyla Bilge, and Engin Kirda. 2015. Cutting the gordian knot: A look under the hood of ransomware attacks. In Detection of Intrusions and Malware, and Vulnerability Assessment: 12th International Conference, DIMVA 2015. 3--24."},{"key":"e_1_3_2_1_30_1","unstructured":"Kingston. 2021. What is SSD encryption and how does it work? https:\/\/www.kingston.com\/en\/blog\/data-security\/how-ssd-encryption-works."},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053035"},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1145\/1064979.1065006"},{"key":"e_1_3_2_1_33_1","volume-title":"Linux system programming: talking directly to the kernel and C library. \"O'Reilly Media","author":"Love Robert","unstructured":"Robert Love. 2013. Linux system programming: talking directly to the kernel and C library. \"O'Reilly Media, Inc.\"."},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/3479393"},{"key":"e_1_3_2_1_35_1","first-page":"114","article-title":"Rwguard: A real-time detection system against cryptographic ransomware. In Research in Attacks, Intrusions, and Defenses: 21st International Symposium","volume":"2018","author":"Mehnaz Shagufta","year":"2018","unstructured":"Shagufta Mehnaz, Anand Mudgerikar, and Elisa Bertino. 2018. Rwguard: A real-time detection system against cryptographic ransomware. In Research in Attacks, Intrusions, and Defenses: 21st International Symposium, RAID 2018. 114--136.","journal-title":"RAID"},{"key":"e_1_3_2_1_36_1","unstructured":"Trend Micro. 2017. Erebus Linux Ransomware: Impact to Servers and Countermeasures. https:\/\/tinyurl.com\/3tjtcjw6."},{"key":"e_1_3_2_1_37_1","unstructured":"Microsoft. 2021a. Access Tokens. https:\/\/tinyurl.com\/5vnyhhh7."},{"key":"e_1_3_2_1_38_1","unstructured":"Microsoft. 2021b. DISKSPD. https:\/\/github.com\/microsoft\/diskspd."},{"key":"e_1_3_2_1_39_1","unstructured":"Microsoft. 2021c. Processes and Threads. https:\/\/tinyurl.com\/3sa395yy."},{"key":"e_1_3_2_1_40_1","unstructured":"Microsoft. 2022a. Enable virtualization-based protection of code integrity. https:\/\/tinyurl.com\/3dx9u2r4."},{"key":"e_1_3_2_1_41_1","unstructured":"Microsoft. 2022b. FILE_OBJECT structure. https:\/\/tinyurl.com\/5356jbuy."},{"key":"e_1_3_2_1_42_1","unstructured":"Microsoft. 2022c. Virtualization-based Security. https:\/\/tinyurl.com\/4eeh6fhd."},{"key":"e_1_3_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1109\/TCAD.2021.3099084"},{"key":"e_1_3_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1145\/3453153"},{"key":"e_1_3_2_1_45_1","unstructured":"NBC News. 2022. Costa Rica 'under assault' is a troubling test case on ransomware attacks. https:\/\/tinyurl.com\/5n9338ye."},{"key":"e_1_3_2_1_46_1","unstructured":"Olimex. 2019. LPC-H3131. https:\/\/tinyurl.com\/38fwkekd."},{"key":"e_1_3_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1145\/3316781.3317889"},{"key":"e_1_3_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-25141-2_7"},{"key":"e_1_3_2_1_49_1","volume-title":"USENIX Security Symposium. 333--348","author":"Reardon Joel","year":"2012","unstructured":"Joel Reardon, Srdjan Capkun, and David A Basin. 2012. Data node encrypted file system: Efficient secure deletion for flash memory. In USENIX Security Symposium. 333--348."},{"key":"e_1_3_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1145\/3503222.3507773"},{"key":"e_1_3_2_1_51_1","unstructured":"SAMSUNG. 2019. K9K8G08U1M datasheet. https:\/\/tinyurl.com\/jcm3uswa."},{"key":"e_1_3_2_1_52_1","volume-title":"2016 IEEE 36th International Conference on Distributed Computing Systems (ICDCS). 303--312","author":"Scaife Nolen","unstructured":"Nolen Scaife, Henry Carter, Patrick Traynor, and Kevin R. B. Butler. 2016. CryptoLock (and Drop It): Stopping Ransomware Attacks on User Data. In 2016 IEEE 36th International Conference on Distributed Computing Systems (ICDCS). 303--312."},{"key":"e_1_3_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.1145\/1508293.1508311"},{"key":"e_1_3_2_1_54_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2020.101997"},{"key":"e_1_3_2_1_55_1","volume-title":"AutoIt v3 is a freeware BASIC-like scripting language designed for automating the Windows GUI and general scripting","author":"Team AutoIt","year":"2018","unstructured":"AutoIt Team. 2018. AutoIt v3 is a freeware BASIC-like scripting language designed for automating the Windows GUI and general scripting (2018). https:\/\/www.autoitscript.com\/site\/autoit\/."},{"key":"e_1_3_2_1_56_1","unstructured":"TheWashingtonPost. 2021. Ransomware is a national security threat and a big business - and it's wreaking havoc. https:\/\/tinyurl.com\/357vxevm."},{"key":"e_1_3_2_1_57_1","unstructured":"Linus Torvalds. 2022. syscall_wrapper.h. https:\/\/github.com\/torvalds\/linux\/blob\/master\/arch\/x86\/include\/asm\/syscall_wrapper.h."},{"key":"e_1_3_2_1_58_1","unstructured":"VirusShare. 2021. VirusShare.com - Because Sharing is Caring. https:\/\/virusshare.com\/."},{"key":"e_1_3_2_1_59_1","unstructured":"VirusTotal. 2021. Analyze suspicious files and URLs to detect types of malware. https:\/\/www.virustotal.com."},{"key":"e_1_3_2_1_60_1","doi-asserted-by":"publisher","DOI":"10.1145\/3292006.3300041"},{"key":"e_1_3_2_1_61_1","unstructured":"P. Yosifovich D.A. Solomon and A. Ionescu. 2017. Windows Internals Part 1."},{"key":"e_1_3_2_1_62_1","unstructured":"zaqoQLF. 2022. ransomware-python. https:\/\/github.com\/zaqoQLF\/ransomware-python."}],"event":{"name":"CCS '23: ACM SIGSAC Conference on Computer and Communications Security","location":"Copenhagen Denmark","acronym":"CCS '23","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3576915.3616665","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3576915.3616665","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,21]],"date-time":"2025-08-21T01:45:13Z","timestamp":1755740713000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3576915.3616665"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,11,15]]},"references-count":62,"alternative-id":["10.1145\/3576915.3616665","10.1145\/3576915"],"URL":"https:\/\/doi.org\/10.1145\/3576915.3616665","relation":{},"subject":[],"published":{"date-parts":[[2023,11,15]]},"assertion":[{"value":"2023-11-21","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}