{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,28]],"date-time":"2026-08-28T17:27:13Z","timestamp":1787938033460,"version":"build-2784847793"},"publisher-location":"New York, NY, USA","reference-count":56,"publisher":"ACM","license":[{"start":{"date-parts":[[2024,4,12]],"date-time":"2024-04-12T00:00:00Z","timestamp":1712880000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"National Key Research and Development Project","award":["022YFB3104000"],"award-info":[{"award-number":["022YFB3104000"]}]},{"name":"NSFC Program","award":["62022046"],"award-info":[{"award-number":["62022046"]}]},{"name":"NSFC Program","award":["92167101"],"award-info":[{"award-number":["92167101"]}]},{"name":"NSFC Program","award":["62021002"],"award-info":[{"award-number":["62021002"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2024,4,12]]},"DOI":"10.1145\/3597503.3639090","type":"proceedings-article","created":{"date-parts":[[2024,4,12]],"date-time":"2024-04-12T12:43:26Z","timestamp":1712925806000},"page":"1-12","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":13,"title":["An Empirical Study of Data Disruption by Ransomware Attacks"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0007-5808-9553","authenticated-orcid":false,"given":"Yiwei","family":"Hou","sequence":"first","affiliation":[{"name":"Tsinghua University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4336-7190","authenticated-orcid":false,"given":"Lihua","family":"Guo","sequence":"additional","affiliation":[{"name":"Tsinghua University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6446-247X","authenticated-orcid":false,"given":"Chijin","family":"Zhou","sequence":"additional","affiliation":[{"name":"Tsinghua University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8767-6454","authenticated-orcid":false,"given":"Yiwen","family":"Xu","sequence":"additional","affiliation":[{"name":"Tsinghua University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4914-836X","authenticated-orcid":false,"given":"Zijing","family":"Yin","sequence":"additional","affiliation":[{"name":"Tsinghua University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0798-974X","authenticated-orcid":false,"given":"Shanshan","family":"Li","sequence":"additional","affiliation":[{"name":"National University of Defense Technology, Changsha, Hunan, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0862-2491","authenticated-orcid":false,"given":"Chengnian","family":"Sun","sequence":"additional","affiliation":[{"name":"Waterloo University, Waterloo, Ontario, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0955-503X","authenticated-orcid":false,"given":"Yu","family":"Jiang","sequence":"additional","affiliation":[{"name":"Tsinghua University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2024,4,12]]},"reference":[{"key":"e_1_3_2_1_1_1","volume-title":"The state of ransomware","year":"2023","unstructured":"BlackFog. The state of ransomware in 2023. https:\/\/www.blackfog.com\/the-state-of-ransomware-in-2023\/, 2023. (Online; accessed on Nov 26, 2023)."},{"key":"e_1_3_2_1_2_1","volume-title":"Cyber attack suspected in german woman's death. https:\/\/www.nytimes.com\/2020\/09\/18\/world\/europe\/cyber-attack-germany-ransomeware-death.html","author":"York Times The New","year":"2020","unstructured":"The New York Times. Cyber attack suspected in german woman's death. https:\/\/www.nytimes.com\/2020\/09\/18\/world\/europe\/cyber-attack-germany-ransomeware-death.html, 2020. (Online; accessed on Nov 26, 2023)."},{"key":"e_1_3_2_1_3_1","volume-title":"Baby died because of ransomware attack on hospital, suit says. https:\/\/www.nbcnews.com\/news\/baby-died-due-ransomware-attack-hospital-suit-claims-rcna2465","author":"News NBC","year":"2021","unstructured":"NBC News. Baby died because of ransomware attack on hospital, suit says. https:\/\/www.nbcnews.com\/news\/baby-died-due-ransomware-attack-hospital-suit-claims-rcna2465, 2021. (Online; accessed on Nov 26, 2023)."},{"key":"e_1_3_2_1_4_1","volume-title":"Hospitals say cyberattacks increase death rates and delay patient care. https:\/\/www.theverge.com\/2021\/9\/27\/22696097\/hospital-ransomware-cyberattack-death-rates-patients","author":"Verge The","year":"2021","unstructured":"The Verge. Hospitals say cyberattacks increase death rates and delay patient care. https:\/\/www.theverge.com\/2021\/9\/27\/22696097\/hospital-ransomware-cyberattack-death-rates-patients, 2021. (Online; accessed on Nov 26, 2023)."},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.23919\/ICACT.2018.8323680"},{"key":"e_1_3_2_1_6_1","volume-title":"International Journal of Computer Science Issues (IJCSI), 16(3):10--17","author":"Vidyarthi Deepti","year":"2019","unstructured":"Deepti Vidyarthi, CRS Kumar, Subrata Rakshit, and Shailesh Chansarkar. Static malware analysis to identify ransomware properties. International Journal of Computer Science Issues (IJCSI), 16(3):10--17, 2019."},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1109\/CSICC52343.2021.9420580"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2907485"},{"key":"e_1_3_2_1_9_1","volume-title":"Analysis of conti ransomware attack on computer network with live forensic method. IJID (International Journal on Informatics for Development), 10(1):53--61","author":"Umar Rusydi","year":"2021","unstructured":"Rusydi Umar, Imam Riadi, and Ridho Surya Kusuma. Analysis of conti ransomware attack on computer network with live forensic method. IJID (International Journal on Informatics for Development), 10(1):53--61, 2021."},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1109\/SysCon53536.2022.9773935"},{"key":"e_1_3_2_1_11_1","first-page":"234","volume-title":"DIMVA 2018, Saclay, France, June 28--29, 2018, Proceedings 15","author":"Gen\u00e7 Ziya Alper","year":"2018","unstructured":"Ziya Alper Gen\u00e7, Gabriele Lenzini, and Peter YA Ryan. No random, no ransom: a key to stop cryptographic ransomware. In Detection of Intrusions and Malware, and Vulnerability Assessment: 15th International Conference, DIMVA 2018, Saclay, France, June 28--29, 2018, Proceedings 15, pages 234--255. Springer, 2018."},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2020.101997"},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3240025"},{"key":"e_1_3_2_1_14_1","volume-title":"Automated dynamic analysis of ransomware: Benefits, limitations and use for detection. arXiv preprint arXiv:1609.03020","author":"Sgandurra Daniele","year":"2016","unstructured":"Daniele Sgandurra, Luis Mu\u00f1oz-Gonz\u00e1lez, Rabih Mohsen, and Emil C Lupu. Automated dynamic analysis of ransomware: Benefits, limitations and use for detection. arXiv preprint arXiv:1609.03020, 2016."},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1145\/2991079.2991110"},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.3003785"},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.fsidi.2021.301314"},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cosrev.2020.100233"},{"key":"e_1_3_2_1_19_1","volume-title":"Nodoze: Combatting threat alert fatigue with automated provenance triage. In network and distributed systems security symposium","author":"Hassan Wajih Ul","year":"2019","unstructured":"Wajih Ul Hassan, Shengjian Guo, Ding Li, Zhengzhang Chen, Kangkook Jee, Zhichun Li, and Adam Bates. Nodoze: Combatting threat alert fatigue with automated provenance triage. In network and distributed systems security symposium, 2019."},{"key":"e_1_3_2_1_20_1","volume-title":"A survey on ransomware: Evolution, taxonomy, and defense solutions. ACM Computing Surveys (CSUR), 54(11s):1--37","author":"Oz Harun","year":"2022","unstructured":"Harun Oz, Ahmet Aris, Albert Levi, and A Selcuk Uluagac. A survey on ransomware: Evolution, taxonomy, and defense solutions. ACM Computing Surveys (CSUR), 54(11s):1--37, 2022."},{"issue":"2","key":"e_1_3_2_1_21_1","first-page":"1239","article-title":"Analysis of encryption key generation in modern crypto ransomware","volume":"19","author":"Cicala Fabrizio","year":"2020","unstructured":"Fabrizio Cicala and Elisa Bertino. Analysis of encryption key generation in modern crypto ransomware. IEEE Transactions on Dependable and Secure Computing, 19(2):1239--1253, 2020.","journal-title":"IEEE Transactions on Dependable and Secure Computing"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179372"},{"key":"e_1_3_2_1_23_1","first-page":"757","volume-title":"UNVEIL: A large-scale, automated approach to detecting ransomware","author":"Kharraz Amin","year":"2016","unstructured":"Amin Kharraz, Sajjad Arshad, Collin Mulliner, William K. Robertson, and Engin Kirda. UNVEIL: A large-scale, automated approach to detecting ransomware. In Thorsten Holz and Stefan Savage, editors, 25th USENIX Security Symposium, USENIX Security 16, Austin, TX, USA, August 10--12, 2016, pages 757--772. USENIX Association, 2016."},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2022.102644"},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1109\/TCAD.2022.3200908"},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2018.00033"},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISCC.2018.8538354"},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102490"},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2018.09.013"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.3390\/computers8040079"},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1002\/cpe.5422"},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134035"},{"issue":"10","key":"e_1_3_2_1_33_1","first-page":"1762","article-title":"Ssd-assisted ransomware detection and data recovery techniques","volume":"70","author":"Baek Sungha","year":"2020","unstructured":"Sungha Baek, Youngdon Jung, David Mohaisen, Sungjin Lee, and Daehun Nyang. Ssd-assisted ransomware detection and data recovery techniques. IEEE Transactions on Computers, 70(10):1762--1776, 2020.","journal-title":"IEEE Transactions on Computers"},{"key":"e_1_3_2_1_34_1","first-page":"1","volume-title":"Proceedings of the 56th Annual Design Automation Conference 2019","author":"Park Jisung","year":"2019","unstructured":"Jisung Park, Youngdon Jung, Jonghoon Won, Minji Kang, Sungjin Lee, and Jihong Kim. Ransomblocker: A low-overhead ransomware-proof ssd. In Proceedings of the 56th Annual Design Automation Conference 2019, pages 1--6, 2019."},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/3503222.3507773"},{"issue":"3","key":"e_1_3_2_1_36_1","first-page":"600","article-title":"Imaging performance counters with deep learning to detect ransomware","volume":"72","author":"Ganfure Gaddisa Olani","year":"2022","unstructured":"Gaddisa Olani Ganfure, Chun-Feng Wu, Yuan-Hao Chang, and Wei-Kuan Shih. Deepware: Imaging performance counters with deep learning to detect ransomware. IEEE Transactions on Computers, 72(3):600--613, 2022.","journal-title":"IEEE Transactions on Computers"},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3616665"},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00047"},{"key":"e_1_3_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2022.102760"},{"key":"e_1_3_2_1_40_1","volume-title":"A survey on windows-based ransomware taxonomy and detection mechanisms. ACM Computing Surveys (CSUR), 54(6):1--36","author":"Moussaileb Routa","year":"2021","unstructured":"Routa Moussaileb, Nora Cuppens, Jean-Louis Lanet, and H\u00e9l\u00e8ne Le Bouder. A survey on windows-based ransomware taxonomy and detection mechanisms. ACM Computing Surveys (CSUR), 54(6):1--36, 2021."},{"key":"e_1_3_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2018.01.001"},{"key":"e_1_3_2_1_42_1","volume-title":"https:\/\/www.virustotal.com\/gui\/contact-us\/premium-services","year":"2023","unstructured":"Virustotal. https:\/\/www.virustotal.com\/gui\/contact-us\/premium-services, 2023. (Online; accessed on Nov 26, 2023)."},{"key":"e_1_3_2_1_43_1","volume-title":"http:\/\/vxvault.net\/ViriList.php","author":"Vx","year":"2023","unstructured":"Vx vault. http:\/\/vxvault.net\/ViriList.php, 2023. (Online; accessed on Nov 26, 2023)."},{"key":"e_1_3_2_1_44_1","volume-title":"https:\/\/www.tutorialjinni.com\/download-free-malware-samples.htm","year":"2023","unstructured":"tutorialjinni. https:\/\/www.tutorialjinni.com\/download-free-malware-samples.htm, 2023. (Online; accessed on Nov 26, 2023)."},{"key":"e_1_3_2_1_45_1","volume-title":"https:\/\/samples.vx-underground.org\/samples\/Blocks\/InTheWild%20Collection\/","year":"2023","unstructured":"Inthewild. https:\/\/samples.vx-underground.org\/samples\/Blocks\/InTheWild%20Collection\/, 2023. (Online; accessed on Nov 26, 2023)."},{"key":"e_1_3_2_1_46_1","volume-title":"https:\/\/bazaar.abuse.ch\/browse\/","year":"2023","unstructured":"Bazaar. https:\/\/bazaar.abuse.ch\/browse\/, 2023. (Online; accessed on Nov 26, 2023)."},{"key":"e_1_3_2_1_47_1","volume-title":"https:\/\/thezoo.morirt.com\/","year":"2023","unstructured":"thezoo. https:\/\/thezoo.morirt.com\/, 2023. (Online; accessed on Nov 26, 2023)."},{"key":"e_1_3_2_1_48_1","volume-title":"https:\/\/www.vx-underground.org\/malware.html","year":"2023","unstructured":"vx-underground. https:\/\/www.vx-underground.org\/malware.html, 2023. (Online; accessed on Nov 26, 2023)."},{"key":"e_1_3_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.1145\/3427228.3427261"},{"key":"e_1_3_2_1_50_1","volume-title":"Malware configuration and payload extraction. https:\/\/github.com\/kevoreilly\/CAPEv2","author":"O'Reilly Kevin","year":"2023","unstructured":"Kevin O'Reilly. Malware configuration and payload extraction. https:\/\/github.com\/kevoreilly\/CAPEv2, 2023. (Online; accessed on Nov 26, 2023)."},{"key":"e_1_3_2_1_51_1","volume-title":"https:\/\/filezilla-project.org\/","year":"2023","unstructured":"Filezilla. https:\/\/filezilla-project.org\/, 2023. (Online; accessed on Nov 26, 2023)."},{"key":"e_1_3_2_1_52_1","volume-title":"https:\/\/winscp.net\/eng\/download.php","author":"Winscp","year":"2023","unstructured":"WinSCP.net. Winscp 6.1 download. https:\/\/winscp.net\/eng\/download.php, 2023. (Online; accessed on Nov 26, 2023)."},{"key":"e_1_3_2_1_53_1","volume-title":"https:\/\/www.torproject.org\/","author":"Tor","year":"2023","unstructured":"Tor project. https:\/\/www.torproject.org\/, 2023. (Online; accessed on Nov 26, 2023)."},{"key":"e_1_3_2_1_54_1","volume-title":"https:\/\/github.com\/microsoft\/Detours","year":"2023","unstructured":"Microsoft. https:\/\/github.com\/microsoft\/Detours, 2023. (Online; accessed on Nov 26, 2023)."},{"key":"e_1_3_2_1_55_1","first-page":"98","volume-title":"RAID 2017, Atlanta, GA, USA, September 18--20, 2017, Proceedings","author":"Kharraz Amin","year":"2017","unstructured":"Amin Kharraz and Engin Kirda. Redemption: Real-time protection against ransomware at end-hosts. In Research in Attacks, Intrusions, and Defenses: 20th International Symposium, RAID 2017, Atlanta, GA, USA, September 18--20, 2017, Proceedings, pages 98--119. Springer, 2017."},{"key":"e_1_3_2_1_56_1","volume-title":"Crime time | rethinking ransomware and how to disrupt it. https:\/\/www.youtube.com\/watch?v=gPJqtK-qP2E&list=PLtgaAEEmVe6AGQj2LhA4UnN0XolmeYw9_&index=3","author":"Selck-Paulsson Diana","year":"2022","unstructured":"Diana Selck-Paulsson and Charl van der Walt. Crime time | rethinking ransomware and how to disrupt it. https:\/\/www.youtube.com\/watch?v=gPJqtK-qP2E&list=PLtgaAEEmVe6AGQj2LhA4UnN0XolmeYw9_&index=3, 2022. (Online; accessed on Nov 26, 2023)."}],"event":{"name":"ICSE '24: IEEE\/ACM 46th International Conference on Software Engineering","location":"Lisbon Portugal","acronym":"ICSE '24","sponsor":["SIGSOFT ACM Special Interest Group on Software Engineering","IEEE CS","Faculty of Engineering of University of Porto"]},"container-title":["Proceedings of the IEEE\/ACM 46th International Conference on Software Engineering"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3597503.3639090","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3597503.3639090","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T18:49:11Z","timestamp":1750272551000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3597503.3639090"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,4,12]]},"references-count":56,"alternative-id":["10.1145\/3597503.3639090","10.1145\/3597503"],"URL":"https:\/\/doi.org\/10.1145\/3597503.3639090","relation":{},"subject":[],"published":{"date-parts":[[2024,4,12]]},"assertion":[{"value":"2024-04-12","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}