{"id":"https://openalex.org/W4386266016","doi":"https://doi.org/10.1109/access.2023.3309879","title":"Hiding in the Crowd: Ransomware Protection by Adopting Camouflage and Hiding Strategy With the Link File","display_name":"Hiding in the Crowd: Ransomware Protection by Adopting Camouflage and Hiding Strategy With the Link File","publication_year":2023,"publication_date":"2023-01-01","ids":{"openalex":"https://openalex.org/W4386266016","doi":"https://doi.org/10.1109/access.2023.3309879"},"language":"en","primary_location":{"id":"doi:10.1109/access.2023.3309879","doi":"https://doi.org/10.1109/access.2023.3309879","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2023.3309879","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/6514899/10233856.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["anvur-scientific","cwts-core","doaj","jufo-1","ki-jl-1","norway-1","oarl","poland-100","russia-white-list-1","vabb-shw"],"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://ieeexplore.ieee.org/ielx7/6287639/6514899/10233856.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5081300006","display_name":"Soohan Lee","orcid":"https://orcid.org/0009-0007-4956-7234","observed_orcids":["https://orcid.org/0009-0007-4956-7234"]},"institutions":[{"id":"https://openalex.org/I1344042128","display_name":"Ministry of National Defense","ror":"https://ror.org/05hfet039","country_code":"KR","type":"government","lineage":["https://openalex.org/I1344042128","https://openalex.org/I2801339556"]},{"id":"https://openalex.org/I197347611","display_name":"Korea University","ror":"https://ror.org/047dqcg40","country_code":"KR","type":"education","lineage":["https://openalex.org/I197347611"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Soohan Lee","raw_affiliation_strings":["Department of Cyber Security, Korea University, Seoul, Republic of Korea","Ministry of Defense, Seoul, Republic of Korea"],"raw_orcid":"https://orcid.org/0009-0007-4956-7234","affiliations":[{"raw_affiliation_string":"Department of Cyber Security, Korea University, Seoul, Republic of Korea","institution_ids":["https://openalex.org/I197347611"]},{"raw_affiliation_string":"Ministry of Defense, Seoul, Republic of Korea","institution_ids":["https://openalex.org/I1344042128"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5045815542","display_name":"Suhyeon Lee","orcid":"https://orcid.org/0000-0002-1318-6612","observed_orcids":["https://orcid.org/0000-0002-1318-6612"]},"institutions":[{"id":"https://openalex.org/I1344042128","display_name":"Ministry of National Defense","ror":"https://ror.org/05hfet039","country_code":"KR","type":"government","lineage":["https://openalex.org/I1344042128","https://openalex.org/I2801339556"]},{"id":"https://openalex.org/I197347611","display_name":"Korea University","ror":"https://ror.org/047dqcg40","country_code":"KR","type":"education","lineage":["https://openalex.org/I197347611"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Suhyeon Lee","raw_affiliation_strings":["Department of Cyber Security, Korea University, Seoul, Republic of Korea","Ministry of Defense, Seoul, Republic of Korea"],"raw_orcid":"https://orcid.org/0000-0002-1318-6612","affiliations":[{"raw_affiliation_string":"Department of Cyber Security, Korea University, Seoul, Republic of Korea","institution_ids":["https://openalex.org/I197347611"]},{"raw_affiliation_string":"Ministry of Defense, Seoul, Republic of Korea","institution_ids":["https://openalex.org/I1344042128"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5105783034","display_name":"Jiwon Park","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I197347611","display_name":"Korea University","ror":"https://ror.org/047dqcg40","country_code":"KR","type":"education","lineage":["https://openalex.org/I197347611"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Jiwon Park","raw_affiliation_strings":["Department of Cyber Security, Korea University, Seoul, Republic of Korea"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Cyber Security, Korea University, Seoul, Republic of Korea","institution_ids":["https://openalex.org/I197347611"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5056537657","display_name":"Kyoungmin Kim","orcid":"https://orcid.org/0000-0001-9146-5441","observed_orcids":["https://orcid.org/0000-0001-9146-5441"]},"institutions":[{"id":"https://openalex.org/I197347611","display_name":"Korea University","ror":"https://ror.org/047dqcg40","country_code":"KR","type":"education","lineage":["https://openalex.org/I197347611"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Kyoungmin Kim","raw_affiliation_strings":["Department of Cyber Security, Korea University, Seoul, Republic of Korea"],"raw_orcid":"https://orcid.org/0000-0001-9146-5441","affiliations":[{"raw_affiliation_string":"Department of Cyber Security, Korea University, Seoul, Republic of Korea","institution_ids":["https://openalex.org/I197347611"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100767530","display_name":"Kyungho Lee","orcid":"https://orcid.org/0000-0002-5183-5927","observed_orcids":["https://orcid.org/0000-0002-5183-5927"]},"institutions":[{"id":"https://openalex.org/I197347611","display_name":"Korea University","ror":"https://ror.org/047dqcg40","country_code":"KR","type":"education","lineage":["https://openalex.org/I197347611"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Kyungho Lee","raw_affiliation_strings":["Institute of Cyber Security and Privacy, Korea University, Seoul, Republic of Korea"],"raw_orcid":"https://orcid.org/0000-0002-5183-5927","affiliations":[{"raw_affiliation_string":"Institute of Cyber Security and Privacy, Korea University, Seoul, Republic of Korea","institution_ids":["https://openalex.org/I197347611"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":1950,"currency":"USD","value_usd":1950},"apc_paid":{"value":1950,"currency":"USD","value_usd":1950},"fwci":4.597,"has_fulltext":true,"cited_by_count":18,"citation_normalized_percentile":{"value":0.94764675,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":91,"max":99},"biblio":{"volume":"11","issue":null,"first_page":"92693","last_page":"92704"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9922000169754028,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9922000169754028,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.004000000189989805,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.0006000000284984708,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/ransomware-as-a-service","display_name":"ransomware-as-a-service","score":0.9129999876022339},{"id":"https://openalex.org/keywords/lockbit","display_name":"LockBit","score":0.847000002861023},{"id":"https://openalex.org/keywords/file-hiding","display_name":"file hiding","score":0.753000020980835},{"id":"https://openalex.org/keywords/attacker-perspective","display_name":"attacker perspective","score":0.3970000147819519},{"id":"https://openalex.org/keywords/encrypted-databases","display_name":"encrypted databases","score":0.8040000200271606},{"id":"https://openalex.org/keywords/linkers","display_name":"linkers","score":0.6549999713897705},{"id":"https://openalex.org/keywords/usability","display_name":"usability","score":0.4169999957084656}],"concepts":[{"id":"https://openalex.org/C2777667771","wikidata":"https://www.wikidata.org/wiki/Q926331","display_name":"Ransomware","level":3,"score":0.9873916506767273},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7695517539978027},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6466761827468872},{"id":"https://openalex.org/C2776576444","wikidata":"https://www.wikidata.org/wiki/Q303569","display_name":"Attack surface","level":2,"score":0.4406298100948334},{"id":"https://openalex.org/C148730421","wikidata":"https://www.wikidata.org/wiki/Q141090","display_name":"Encryption","level":2,"score":0.4124402403831482},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.3558621406555176}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/access.2023.3309879","doi":"https://doi.org/10.1109/access.2023.3309879","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2023.3309879","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/6514899/10233856.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["anvur-scientific","cwts-core","doaj","jufo-1","ki-jl-1","norway-1","oarl","poland-100","russia-white-list-1","vabb-shw"],"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:32b111340ea84c1ebfb096450edf31a3","doi":null,"is_oa":true,"landing_page_url":"https://doaj.org/article/32b111340ea84c1ebfb096450edf31a3","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Access, Vol 11, Pp 92693-92704 (2023)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1109/access.2023.3309879","doi":"https://doi.org/10.1109/access.2023.3309879","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2023.3309879","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/6514899/10233856.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["anvur-scientific","cwts-core","doaj","jufo-1","ki-jl-1","norway-1","oarl","poland-100","russia-white-list-1","vabb-shw"],"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320321373","display_name":"Korea University","ror":"https://ror.org/047dqcg40"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4386266016.pdf","grobid_xml":"https://content.openalex.org/works/W4386266016.grobid-xml"},"referenced_works_count":34,"referenced_works":["https://openalex.org/W604108088","https://openalex.org/W2109394932","https://openalex.org/W2132874238","https://openalex.org/W2461373307","https://openalex.org/W2559964890","https://openalex.org/W2601591992","https://openalex.org/W2752497163","https://openalex.org/W2775582065","https://openalex.org/W2886257824","https://openalex.org/W2911311548","https://openalex.org/W2911731407","https://openalex.org/W2963563709","https://openalex.org/W2963604227","https://openalex.org/W2964829536","https://openalex.org/W2998074434","https://openalex.org/W3009492331","https://openalex.org/W3016101473","https://openalex.org/W3025864274","https://openalex.org/W3115397429","https://openalex.org/W3127363298","https://openalex.org/W3132588576","https://openalex.org/W3197120839","https://openalex.org/W3209947356","https://openalex.org/W3214926740","https://openalex.org/W4200267592","https://openalex.org/W4211029854","https://openalex.org/W4214919535","https://openalex.org/W4229014078","https://openalex.org/W4293335073","https://openalex.org/W4296438248","https://openalex.org/W4306377502","https://openalex.org/W4312214544","https://openalex.org/W4318189316","https://openalex.org/W4364382428"],"related_works":["https://openalex.org/W6893458801","https://openalex.org/W2775582065","https://openalex.org/W4412786457","https://openalex.org/W2964829536","https://openalex.org/W4392840998","https://openalex.org/W4312214544","https://openalex.org/W4402811700","https://openalex.org/W3198292085","https://openalex.org/W3136914374","https://openalex.org/W7172102436"],"abstract_inverted_index":{"Ransomware":[0],"is":[1,6,47],"a":[2,15,48,87,109,114,153,182],"growing":[3,49],"threat":[4],"and":[5,26,85,139,145,155],"building":[7],"ecosystems":[8],"in":[9,51,61,95,118,135,181],"the":[10,58,120,130,142,147,150,160,172],"form":[11],"of":[12,137,152],"ransomware":[13,64,81,96,106,166,180],"as":[14,83],"service":[16],"(RaaS).":[17],"While":[18],"there":[19,46],"have":[20,35],"been":[21,67],"diverse":[22],"efforts":[23],"to":[24,31,116,158],"detect":[25],"mitigate":[27],"such":[28,33,82],"threats,":[29],"techniques":[30],"bypass":[32],"countermeasures":[34,54],"advanced":[36],"considerably.":[37],"Since":[38],"detecting":[39],"all":[40],"evolving":[41],"threats":[42],"has":[43,65],"become":[44],"challenging,":[45],"interest":[50],"developing":[52],"proactive":[53],"that":[55,92,112,171],"can":[56],"minimize":[57],"damage":[59],"even":[60],"environments":[62],"where":[63],"already":[66],"executed.":[68],"In":[69],"this":[70],"study,":[71],"we":[72],"gained":[73],"insights":[74],"from":[75,104],"an":[76],"attacker\u2019s":[77],"perspective":[78],"by":[79,107],"analyzing":[80],"LockBit":[84],"derived":[86],"generic":[88],"counterstrategy":[89],"against":[90,179],"features":[91],"are":[93],"common":[94],"attacks.":[97],"Our":[98],"proposed":[99,173],"method":[100,148,174],"protects":[101,176],"critical":[102],"files":[103,178],"existing":[105],"applying":[108],"hiding":[110],"strategy":[111,131],"poses":[113],"challenge":[115],"attackers":[117],"finding":[119],"target":[121],"files.":[122],"We":[123],"also":[124],"present":[125],"best":[126],"practices":[127],"for":[128],"implementing":[129],"while":[132],"considering":[133],"both":[134],"terms":[136],"security":[138],"usability":[140],"using":[141,164],"link":[143],"file":[144],"improving":[146],"through":[149],"addition":[151],"linker":[154],"encrypted":[156],"database":[157],"reduce":[159],"attack":[161],"surface.":[162],"By":[163],"real-world":[165],"samples,":[167],"our":[168],"experiments":[169],"show":[170],"successfully":[175],"valuable":[177],"cost-effective":[183],"manner.":[184]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":9},{"year":2024,"cited_by_count":5},{"year":2023,"cited_by_count":3}],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2023-08-30T00:00:00"}