{"id":"https://openalex.org/W3208935820","doi":"https://doi.org/10.1016/j.cose.2021.102512","title":"Rcryptect: Real-time detection of cryptographic function in the user-space filesystem","display_name":"Rcryptect: Real-time detection of cryptographic function in the user-space filesystem","publication_year":2021,"publication_date":"2021-10-22","ids":{"openalex":"https://openalex.org/W3208935820","doi":"https://doi.org/10.1016/j.cose.2021.102512","mag":"3208935820"},"language":"en","primary_location":{"id":"doi:10.1016/j.cose.2021.102512","doi":"https://doi.org/10.1016/j.cose.2021.102512","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.cose.2021.102512","pdf_url":"https://www.sciencedirect.com/science/article/pii/S0167404821003369/pdf","source":{"id":"https://openalex.org/S12529635","display_name":"Computers & Security","issn_l":"0167-4048","issn":["0167-4048","1872-6208"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["anvur-scientific","ccf-b","cwts-core","dongbi-b","jufo-2","ki-jl-1","norway-1","poland-140","russia-white-list-1","vabb-shw"],"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computers & Security","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://www.sciencedirect.com/science/article/pii/S0167404821003369/pdf","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5083938393","display_name":"Seungkwang Lee","orcid":"https://orcid.org/0000-0001-9534-9624","observed_orcids":["https://orcid.org/0000-0001-9534-9624"]},"institutions":[{"id":"https://openalex.org/I142401562","display_name":"Electronics and Telecommunications Research Institute","ror":"https://ror.org/03ysstz10","country_code":"KR","type":"facility","lineage":["https://openalex.org/I142401562","https://openalex.org/I2801339556","https://openalex.org/I4210144908","https://openalex.org/I4387152098"]},{"id":"https://openalex.org/I157485424","display_name":"Korea Advanced Institute of Science and Technology","ror":"https://ror.org/05apxxy63","country_code":"KR","type":"education","lineage":["https://openalex.org/I157485424"]}],"countries":["KR"],"is_corresponding":true,"raw_author_name":"Seungkwang Lee","raw_affiliation_strings":["Cryptography Research Team, ETRI, Daejeon, 34129, South Korea","Department of School of Computing, KAIST, Daejeon, 34141, South Korea"],"raw_orcid":"https://orcid.org/0000-0001-9534-9624","affiliations":[{"raw_affiliation_string":"Cryptography Research Team, ETRI, Daejeon, 34129, South Korea","institution_ids":["https://openalex.org/I142401562"]},{"raw_affiliation_string":"Department of School of Computing, KAIST, Daejeon, 34141, South Korea","institution_ids":["https://openalex.org/I157485424"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5073972669","display_name":"Nam-Su Jho","orcid":"https://orcid.org/0000-0003-1721-5350","observed_orcids":["https://orcid.org/0000-0003-1721-5350"]},"institutions":[{"id":"https://openalex.org/I142401562","display_name":"Electronics and Telecommunications Research Institute","ror":"https://ror.org/03ysstz10","country_code":"KR","type":"facility","lineage":["https://openalex.org/I142401562","https://openalex.org/I2801339556","https://openalex.org/I4210144908","https://openalex.org/I4387152098"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Nam-su Jho","raw_affiliation_strings":["Cryptography Research Team, ETRI, Daejeon, 34129, South Korea"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Cryptography Research Team, ETRI, Daejeon, 34129, South Korea","institution_ids":["https://openalex.org/I142401562"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5082978040","display_name":"Doyoung Chung","orcid":"https://orcid.org/0000-0001-6005-1238","observed_orcids":["https://orcid.org/0000-0001-6005-1238"]},"institutions":[{"id":"https://openalex.org/I142401562","display_name":"Electronics and Telecommunications Research Institute","ror":"https://ror.org/03ysstz10","country_code":"KR","type":"facility","lineage":["https://openalex.org/I142401562","https://openalex.org/I2801339556","https://openalex.org/I4210144908","https://openalex.org/I4387152098"]},{"id":"https://openalex.org/I157485424","display_name":"Korea Advanced Institute of Science and Technology","ror":"https://ror.org/05apxxy63","country_code":"KR","type":"education","lineage":["https://openalex.org/I157485424"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Doyoung Chung","raw_affiliation_strings":["Cryptography Research Team, ETRI, Daejeon, 34129, South Korea","Department of School of Computing, KAIST, Daejeon, 34141, South Korea"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Cryptography Research Team, ETRI, Daejeon, 34129, South Korea","institution_ids":["https://openalex.org/I142401562"]},{"raw_affiliation_string":"Department of School of Computing, KAIST, Daejeon, 34141, South Korea","institution_ids":["https://openalex.org/I157485424"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5022997358","display_name":"Yousung Kang","orcid":"https://orcid.org/0000-0002-1967-8941","observed_orcids":["https://orcid.org/0000-0002-1967-8941"]},"institutions":[{"id":"https://openalex.org/I142401562","display_name":"Electronics and Telecommunications Research Institute","ror":"https://ror.org/03ysstz10","country_code":"KR","type":"facility","lineage":["https://openalex.org/I142401562","https://openalex.org/I2801339556","https://openalex.org/I4210144908","https://openalex.org/I4387152098"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Yousung Kang","raw_affiliation_strings":["Cryptography Research Team, ETRI, Daejeon, 34129, South Korea"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Cryptography Research Team, ETRI, Daejeon, 34129, South Korea","institution_ids":["https://openalex.org/I142401562"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5101610666","display_name":"Myungchul Kim","orcid":"https://orcid.org/0000-0001-8077-0053","observed_orcids":["https://orcid.org/0000-0001-8077-0053"]},"institutions":[{"id":"https://openalex.org/I157485424","display_name":"Korea Advanced Institute of Science and Technology","ror":"https://ror.org/05apxxy63","country_code":"KR","type":"education","lineage":["https://openalex.org/I157485424"]}],"countries":["KR"],"is_corresponding":true,"raw_author_name":"Myungchul Kim","raw_affiliation_strings":["Department of School of Computing, KAIST, Daejeon, 34141, South Korea"],"raw_orcid":"https://orcid.org/0000-0001-8077-0053","affiliations":[{"raw_affiliation_string":"Department of School of Computing, KAIST, Daejeon, 34141, South Korea","institution_ids":["https://openalex.org/I157485424"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":["https://openalex.org/A5083938393","https://openalex.org/A5101610666"],"corresponding_institution_ids":["https://openalex.org/I142401562","https://openalex.org/I157485424"],"apc_list":{"value":2920,"currency":"USD","value_usd":2920},"apc_paid":{"value":2920,"currency":"USD","value_usd":2920},"fwci":3.075,"has_fulltext":true,"cited_by_count":28,"citation_normalized_percentile":{"value":0.92455203,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":95,"max":99},"biblio":{"volume":"112","issue":null,"first_page":"102512","last_page":"102512"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9883000254631042,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9883000254631042,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.009499999694526196,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.0012000000569969416,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/ransomware-detection","display_name":"ransomware detection","score":0.9990000128746033},{"id":"https://openalex.org/keywords/fuses","display_name":"fuses","score":0.5289999842643738},{"id":"https://openalex.org/keywords/real-time-monitoring","display_name":"real-time monitoring","score":0.7950000166893005},{"id":"https://openalex.org/keywords/heuristic-rules","display_name":"heuristic rules","score":0.7080000042915344},{"id":"https://openalex.org/keywords/binary-obfuscation","display_name":"binary obfuscation","score":0.6809999942779541}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8628922700881958},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.6383166909217834},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.6369509696960449},{"id":"https://openalex.org/C15927051","wikidata":"https://www.wikidata.org/wiki/Q246593","display_name":"Cryptographic primitive","level":4,"score":0.5776144862174988},{"id":"https://openalex.org/C173801870","wikidata":"https://www.wikidata.org/wiki/Q201413","display_name":"Heuristic","level":2,"score":0.5550259351730347},{"id":"https://openalex.org/C2777667771","wikidata":"https://www.wikidata.org/wiki/Q926331","display_name":"Ransomware","level":3,"score":0.5228174924850464},{"id":"https://openalex.org/C2777210771","wikidata":"https://www.wikidata.org/wiki/Q4927124","display_name":"Block (permutation group theory)","level":2,"score":0.4125729203224182},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.37347227334976196},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.30474740266799927},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.24811285734176636},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.18631747364997864},{"id":"https://openalex.org/C33884865","wikidata":"https://www.wikidata.org/wiki/Q1254335","display_name":"Cryptographic protocol","level":3,"score":0.17433089017868042},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.10258442163467407},{"id":"https://openalex.org/C2524010","wikidata":"https://www.wikidata.org/wiki/Q8087","display_name":"Geometry","level":1,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1016/j.cose.2021.102512","doi":"https://doi.org/10.1016/j.cose.2021.102512","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.cose.2021.102512","pdf_url":"https://www.sciencedirect.com/science/article/pii/S0167404821003369/pdf","source":{"id":"https://openalex.org/S12529635","display_name":"Computers & Security","issn_l":"0167-4048","issn":["0167-4048","1872-6208"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["anvur-scientific","ccf-b","cwts-core","dongbi-b","jufo-2","ki-jl-1","norway-1","poland-140","russia-white-list-1","vabb-shw"],"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computers & Security","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1016/j.cose.2021.102512","doi":"https://doi.org/10.1016/j.cose.2021.102512","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.cose.2021.102512","pdf_url":"https://www.sciencedirect.com/science/article/pii/S0167404821003369/pdf","source":{"id":"https://openalex.org/S12529635","display_name":"Computers & Security","issn_l":"0167-4048","issn":["0167-4048","1872-6208"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["anvur-scientific","ccf-b","cwts-core","dongbi-b","jufo-2","ki-jl-1","norway-1","poland-140","russia-white-list-1","vabb-shw"],"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computers & Security","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[{"id":"https://openalex.org/G2896300088","display_name":null,"funder_award_id":"20ZR1300","funder_id":"https://openalex.org/F4320322093","funder_display_name":"Electronics and Telecommunications Research Institute"},{"id":"https://openalex.org/G772044346","display_name":null,"funder_award_id":"2021R1A2C1004993","funder_id":"https://openalex.org/F4320322030","funder_display_name":"Ministry of Science, ICT and Future Planning"}],"funders":[{"id":"https://openalex.org/F4320322030","display_name":"Ministry of Science, ICT and Future Planning","ror":"https://ror.org/032e49973"},{"id":"https://openalex.org/F4320322093","display_name":"Electronics and Telecommunications Research Institute","ror":"https://ror.org/03ysstz10"},{"id":"https://openalex.org/F4320322120","display_name":"National Research Foundation of Korea","ror":"https://ror.org/013aysd81"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W3208935820.pdf","grobid_xml":"https://content.openalex.org/works/W3208935820.grobid-xml"},"referenced_works_count":57,"referenced_works":["https://openalex.org/W89505464","https://openalex.org/W115326044","https://openalex.org/W126407768","https://openalex.org/W1505973206","https://openalex.org/W1539179632","https://openalex.org/W1551162551","https://openalex.org/W1551572898","https://openalex.org/W1553308705","https://openalex.org/W1596832152","https://openalex.org/W1965817476","https://openalex.org/W2003279466","https://openalex.org/W2039433315","https://openalex.org/W2049208027","https://openalex.org/W2057330156","https://openalex.org/W2065995359","https://openalex.org/W2119359024","https://openalex.org/W2132874238","https://openalex.org/W2166462894","https://openalex.org/W2223594212","https://openalex.org/W2315793729","https://openalex.org/W2350778671","https://openalex.org/W2461373307","https://openalex.org/W2511701350","https://openalex.org/W2513529237","https://openalex.org/W2558619741","https://openalex.org/W2559964890","https://openalex.org/W2604964870","https://openalex.org/W2670925489","https://openalex.org/W2761029450","https://openalex.org/W2764249719","https://openalex.org/W2766465617","https://openalex.org/W2766516664","https://openalex.org/W2768096314","https://openalex.org/W2785572316","https://openalex.org/W2789940211","https://openalex.org/W2794851814","https://openalex.org/W2804066576","https://openalex.org/W2901458495","https://openalex.org/W2912967214","https://openalex.org/W2928980918","https://openalex.org/W2944412604","https://openalex.org/W2964936987","https://openalex.org/W2971937769","https://openalex.org/W3017140503","https://openalex.org/W3032258369","https://openalex.org/W3033579761","https://openalex.org/W3039822732","https://openalex.org/W3047892252","https://openalex.org/W3140731556","https://openalex.org/W4210799323","https://openalex.org/W4230954682","https://openalex.org/W4232418947","https://openalex.org/W4246774680","https://openalex.org/W4297974898","https://openalex.org/W4301329292","https://openalex.org/W4315746341","https://openalex.org/W6750057548"],"related_works":["https://openalex.org/W2890196927","https://openalex.org/W3047892252","https://openalex.org/W2794482868","https://openalex.org/W3123696521","https://openalex.org/W6931348348","https://openalex.org/W3036401269","https://openalex.org/W4405401741","https://openalex.org/W2970607737","https://openalex.org/W4293335073","https://openalex.org/W7167034428"],"abstract_inverted_index":{"The":[0],"existing":[1],"methods":[2],"of":[3,33,93,100],"ransomware":[4,102],"detection":[5,92],"have":[6],"limitations.":[7],"To":[8],"be":[9,110],"specific,":[10],"static":[11],"analysis":[12,21,54],"is":[13,22],"not":[14],"effective":[15],"to":[16,25,44,55,59,68,73],"obfuscated":[17],"binaries,":[18],"while":[19],"dynamic":[20],"usually":[23],"restricted":[24],"a":[26,40],"certain":[27],"platform":[28],"and":[29,63,85,103],"often":[30],"takes":[31],"tens":[32],"minutes.":[34],"In":[35,66],"this":[36],"paper,":[37],"we":[38,79],"propose":[39],"block-level":[41],"monitoring":[42],"system":[43],"detect":[45],"potentially":[46],"malicious":[47],"cryptographic":[48,94,107],"operations.":[49],"We":[50,96],"carry":[51],"out":[52],"statistical":[53],"find":[56],"heuristic":[57,71],"rules":[58],"distinguish":[60],"between":[61],"normal":[62],"encrypted":[64],"blocks.":[65],"order":[67],"apply":[69],"the":[70,74,98],"rule":[72],"filesystem":[75,88],"without":[76],"kernel":[77],"modification,":[78],"adopt":[80],"Filesystem":[81],"in":[82],"Userspace":[83],"(FUSE)":[84],"define":[86],"our":[87],"Rcryptect":[89],"for":[90],"real-time":[91],"function.":[95],"demonstrate":[97],"protection":[99],"well-known":[101],"show":[104],"that":[105],"various":[106],"functions":[108],"can":[109],"detected":[111],"with":[112],"about":[113],"13%":[114],"overhead.":[115]},"counts_by_year":[{"year":2026,"cited_by_count":4},{"year":2025,"cited_by_count":10},{"year":2024,"cited_by_count":3},{"year":2023,"cited_by_count":6},{"year":2022,"cited_by_count":5}],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2021-11-08T00:00:00"}