{"id":"https://openalex.org/W4406950656","doi":"https://doi.org/10.48550/arxiv.2501.16619","title":"SHIELD: A Host-Independent Framework for Ransomware Detection using Deep Filesystem Features","display_name":"SHIELD: A Host-Independent Framework for Ransomware Detection using Deep Filesystem Features","publication_year":2025,"publication_date":"2025-01-28","ids":{"openalex":"https://openalex.org/W4406950656","doi":"https://doi.org/10.48550/arxiv.2501.16619"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2501.16619","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2501.16619","pdf_url":"https://arxiv.org/pdf/2501.16619","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2501.16619","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5116075597","display_name":"Md Raz","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I57206974","display_name":"New York University","ror":"https://ror.org/0190ak572","country_code":"US","type":"education","lineage":["https://openalex.org/I57206974"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Raz, Md","raw_affiliation_strings":["Department of ECE , NYU Tandon School of Engineering , Brooklyn , NY 11201 , USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of ECE , NYU Tandon School of Engineering , Brooklyn , NY 11201 , USA","institution_ids":["https://openalex.org/I57206974"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5068986465","display_name":"Venkata Sai Charan Putrevu","orcid":"https://orcid.org/0000-0003-4535-8690","observed_orcids":["https://orcid.org/0000-0003-4535-8690"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Putrevu, Venkata Sai Charan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5054769060","display_name":"P. Krishnamurthy","orcid":"https://orcid.org/0000-0001-8264-7972","observed_orcids":["https://orcid.org/0000-0001-8264-7972"]},"institutions":[{"id":"https://openalex.org/I57206974","display_name":"New York University","ror":"https://ror.org/0190ak572","country_code":"US","type":"education","lineage":["https://openalex.org/I57206974"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Krishnamurthy, Prashanth","raw_affiliation_strings":["Department of ECE , NYU Tandon School of Engineering , Brooklyn , NY 11201 , USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of ECE , NYU Tandon School of Engineering , Brooklyn , NY 11201 , USA","institution_ids":["https://openalex.org/I57206974"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5082413942","display_name":"Farshad Khorrami","orcid":"https://orcid.org/0000-0002-8418-004X","observed_orcids":["https://orcid.org/0000-0002-8418-004X"]},"institutions":[{"id":"https://openalex.org/I57206974","display_name":"New York University","ror":"https://ror.org/0190ak572","country_code":"US","type":"education","lineage":["https://openalex.org/I57206974"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Khorrami, Farshad","raw_affiliation_strings":["Department of ECE , NYU Tandon School of Engineering , Brooklyn , NY 11201 , USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of ECE , NYU Tandon School of Engineering , Brooklyn , NY 11201 , USA","institution_ids":["https://openalex.org/I57206974"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5059648257","display_name":"Ramesh Karri","orcid":"https://orcid.org/0000-0001-7989-5617","observed_orcids":["https://orcid.org/0000-0001-7989-5617"]},"institutions":[{"id":"https://openalex.org/I57206974","display_name":"New York University","ror":"https://ror.org/0190ak572","country_code":"US","type":"education","lineage":["https://openalex.org/I57206974"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Karri, Ramesh","raw_affiliation_strings":["Department of ECE , NYU Tandon School of Engineering , Brooklyn , NY 11201 , USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of ECE , NYU Tandon School of Engineering , Brooklyn , NY 11201 , USA","institution_ids":["https://openalex.org/I57206974"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":2,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9804999828338623,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9804999828338623,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.0142000000923872,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.0017999999690800905,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/ransomware-detection","display_name":"ransomware detection","score":1.0}],"concepts":[{"id":"https://openalex.org/C2777667771","wikidata":"https://www.wikidata.org/wiki/Q926331","display_name":"Ransomware","level":3,"score":0.7379797697067261},{"id":"https://openalex.org/C126831891","wikidata":"https://www.wikidata.org/wiki/Q221673","display_name":"Host (biology)","level":2,"score":0.7215801477432251},{"id":"https://openalex.org/C125620115","wikidata":"https://www.wikidata.org/wiki/Q845249","display_name":"Logging","level":2,"score":0.6405530571937561},{"id":"https://openalex.org/C32833848","wikidata":"https://www.wikidata.org/wiki/Q4115054","display_name":"Extensibility","level":2,"score":0.6363308429718018},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5301364660263062},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4143044352531433},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.3550475835800171},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.32693108916282654},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.14818990230560303},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.12875914573669434},{"id":"https://openalex.org/C18903297","wikidata":"https://www.wikidata.org/wiki/Q7150","display_name":"Ecology","level":1,"score":0.11319762468338013}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2501.16619","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2501.16619","pdf_url":"https://arxiv.org/pdf/2501.16619","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2501.16619","doi":"https://doi.org/10.48550/arxiv.2501.16619","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2501.16619","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2501.16619","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2501.16619","pdf_url":"https://arxiv.org/pdf/2501.16619","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"study_designs":[],"awards":[{"id":"https://openalex.org/G5733000932","display_name":null,"funder_award_id":"HR00112390029","funder_id":"https://openalex.org/F4320332180","funder_display_name":"Defense Advanced Research Projects Agency"}],"funders":[{"id":"https://openalex.org/F4320306084","display_name":"U.S. Department of Energy","ror":"https://ror.org/01bj3aw27"},{"id":"https://openalex.org/F4320332180","display_name":"Defense Advanced Research Projects Agency","ror":"https://ror.org/02caytj08"},{"id":"https://openalex.org/F4320332815","display_name":"Advanced Research Projects Agency","ror":"https://ror.org/02caytj08"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4406950656.pdf","grobid_xml":"https://content.openalex.org/works/W4406950656.grobid-xml"},"referenced_works_count":3,"referenced_works":["https://openalex.org/W4389767645","https://openalex.org/W4403709708","https://openalex.org/W4405957680"],"related_works":["https://openalex.org/W4391462991","https://openalex.org/W6892230151","https://openalex.org/W7203826662","https://openalex.org/W3208935820","https://openalex.org/W7213950858","https://openalex.org/W3129101061","https://openalex.org/W7223236564","https://openalex.org/W7155171275","https://openalex.org/W3028964877","https://openalex.org/W6910569045"],"abstract_inverted_index":{"Ransomware's":[0],"escalating":[1],"sophistication":[2],"necessitates":[3],"tamper-resistant,":[4],"off-host":[5,204],"detection":[6,22,99],"solutions":[7],"that":[8,85,146,202],"capture":[9],"deep":[10,93],"disk":[11,94,140,171,176],"activity":[12,95],"beyond":[13],"the":[14,104,130,160],"reach":[15],"of":[16,51,76,106,175],"a":[17,49,63,165],"compromised":[18],"operating":[19],"system.":[20],"Existing":[21],"systems":[23],"use":[24],"host/kernel":[25],"signals":[26],"or":[27,89,223],"rely":[28],"on":[29,196],"coarse":[30],"block-I/O":[31],"statistics,":[32],"which":[33],"are":[34],"easy":[35],"to":[36,91,182],"evade":[37],"and":[38,73,81,100,118,214],"miss":[39],"filesystem":[40,43],"semantics.":[41],"The":[42],"layer":[44],"itself":[45],"remains":[46],"underexplored":[47],"as":[48],"source":[50],"robust":[52],"indicators":[53],"for":[54,70,96,156,184,217],"storage-controller-level":[55],"defense.":[56],"To":[57],"address":[58],"this,":[59],"we":[60],"present":[61],"SHIELD:":[62],"Secure":[64],"Host-Independent":[65],"Extensible":[66],"Metric":[67],"Logging":[68],"Framework":[69],"Tamper-Proof":[71],"Detection":[72],"Real-Time":[74],"Mitigation":[75],"Ransomware":[77],"Threats.":[78],"SHIELD":[79,169],"parses":[80],"logs":[82],"filesystem-level":[83],"features":[84],"cannot":[86],"be":[87],"evaded":[88],"obfuscated":[90],"expose":[92],"real-time":[97],"ML-based":[98],"mitigation.":[101],"We":[102],"evaluate":[103],"efficacy":[105],"these":[107],"metrics":[108,150],"through":[109],"experiments":[110],"with":[111],"both":[112],"binary":[113,132],"(benign":[114],"vs.":[115],"malicious":[116,139],"behavior)":[117],"multiclass":[119],"(ransomware":[120],"strain":[121],"identification)":[122],"classifiers.":[123],"In":[124,164],"evaluations":[125],"across":[126],"diverse":[127],"ransomware":[128,209],"families,":[129],"best":[131],"classifier":[133],"achieves":[134],"97.29%":[135],"accuracy":[136],"in":[137,220],"identifying":[138],"behavior.":[141],"A":[142],"hardware-only":[143],"feature":[144],"set":[145],"excludes":[147],"all":[148],"transport-layer":[149],"retains":[151],"95.97%":[152],"accuracy,":[153],"confirming":[154],"feasibility":[155],"FPGA/ASIC":[157],"deployment":[158],"within":[159,173],"storage":[161,221],"controller":[162],"datapath.":[163],"proof-of-concept":[166],"closed-loop":[167],"deployment,":[168],"halts":[170],"operations":[172],"tens":[174],"actions,":[177],"limiting":[178],"targeted":[179],"files":[180],"affected":[181],"<0.4%":[183],"zero-shot":[185],"strains":[186],"at":[187],"small":[188],"action-windows,":[189],"while":[190],"maintaining":[191],"low":[192],"false-positive":[193],"rates":[194],"(<3.6%)":[195],"unseen":[197],"benign":[198],"applications.":[199],"Results":[200],"demonstrate":[201],"filesystem-aware,":[203],"telemetry":[205],"enables":[206],"accurate,":[207],"resilient":[208],"detection,":[210],"including":[211],"intermittent/partial":[212],"encryption,":[213],"is":[215],"practical":[216],"embedded":[218],"integration":[219],"controllers":[222],"alongside":[224],"other":[225],"defense":[226],"mechanisms.":[227]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":1}],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2025-01-30T00:00:00"}