{"id":"https://openalex.org/W2957305577","doi":"https://doi.org/10.1007/s11416-019-00338-7","title":"A Cyber-Kill-Chain based taxonomy of crypto-ransomware features","display_name":"A Cyber-Kill-Chain based taxonomy of crypto-ransomware features","publication_year":2019,"publication_date":"2019-08-07","ids":{"openalex":"https://openalex.org/W2957305577","doi":"https://doi.org/10.1007/s11416-019-00338-7","mag":"2957305577"},"language":"en","primary_location":{"id":"doi:10.1007/s11416-019-00338-7","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s11416-019-00338-7","pdf_url":"https://link.springer.com/content/pdf/10.1007/s11416-019-00338-7.pdf","source":{"id":"https://openalex.org/S2764922190","display_name":"Journal of Computer Virology and Hacking Techniques","issn_l":"1772-9890","issn":["1772-9890","1772-9904","2263-8733"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Computer Virology and Hacking Techniques","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://link.springer.com/content/pdf/10.1007/s11416-019-00338-7.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5041825756","display_name":"Tooska Dargahi","orcid":"https://orcid.org/0000-0002-0908-6483"},"institutions":[{"id":"https://openalex.org/I54459138","display_name":"University of Salford","ror":"https://ror.org/01tmqtf75","country_code":"GB","type":"education","lineage":["https://openalex.org/I54459138"]}],"countries":["GB"],"is_corresponding":true,"raw_author_name":"Tooska Dargahi","raw_affiliation_strings":["University of Salford, Greater Manchester, UK"],"raw_orcid":"https://orcid.org/0000-0002-0908-6483","affiliations":[{"raw_affiliation_string":"University of Salford, Greater Manchester, UK","institution_ids":["https://openalex.org/I54459138"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5038019914","display_name":"Ali Dehghantanha","orcid":"https://orcid.org/0000-0002-9294-7554"},"institutions":[{"id":"https://openalex.org/I79817857","display_name":"University of Guelph","ror":"https://ror.org/01r7awg59","country_code":"CA","type":"education","lineage":["https://openalex.org/I79817857"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Ali Dehghantanha","raw_affiliation_strings":["Cyber Science Lab, School of Computer Science, University of Guelph, Ontario, Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Cyber Science Lab, School of Computer Science, University of Guelph, Ontario, Canada","institution_ids":["https://openalex.org/I79817857"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5022968887","display_name":"Pooneh Nikkhah Bahrami","orcid":null},"institutions":[{"id":"https://openalex.org/I23946033","display_name":"University of Tehran","ror":"https://ror.org/05vf56z40","country_code":"IR","type":"education","lineage":["https://openalex.org/I23946033"]}],"countries":["IR"],"is_corresponding":false,"raw_author_name":"Pooneh Nikkhah Bahrami","raw_affiliation_strings":["University of Tehran, Kish, Iran"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Tehran, Kish, Iran","institution_ids":["https://openalex.org/I23946033"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5063847107","display_name":"Mauro Conti","orcid":"https://orcid.org/0000-0002-3612-1934"},"institutions":[{"id":"https://openalex.org/I138689650","display_name":"University of Padua","ror":"https://ror.org/00240q980","country_code":"IT","type":"education","lineage":["https://openalex.org/I138689650"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Mauro Conti","raw_affiliation_strings":["University of Padua, Padua, Italy"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Padua, Padua, Italy","institution_ids":["https://openalex.org/I138689650"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5007176500","display_name":"Giuseppe Bianchi","orcid":"https://orcid.org/0000-0001-7277-7423"},"institutions":[{"id":"https://openalex.org/I116067653","display_name":"University of Rome Tor Vergata","ror":"https://ror.org/02p77k626","country_code":"IT","type":"education","lineage":["https://openalex.org/I116067653"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Giuseppe Bianchi","raw_affiliation_strings":["University of Rome Tor Vergata, Rome, Italy"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Rome Tor Vergata, Rome, Italy","institution_ids":["https://openalex.org/I116067653"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5005515717","display_name":"Loris Benedetto","orcid":null},"institutions":[{"id":"https://openalex.org/I138689650","display_name":"University of Padua","ror":"https://ror.org/00240q980","country_code":"IT","type":"education","lineage":["https://openalex.org/I138689650"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Loris Benedetto","raw_affiliation_strings":["University of Padua, Padua, Italy"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Padua, Padua, Italy","institution_ids":["https://openalex.org/I138689650"]}]}],"institutions":[],"countries_distinct_count":4,"institutions_distinct_count":5,"corresponding_author_ids":["https://openalex.org/A5041825756"],"corresponding_institution_ids":["https://openalex.org/I54459138"],"apc_list":{"value":2990,"currency":"USD","value_usd":2990},"apc_paid":{"value":2990,"currency":"USD","value_usd":2990},"fwci":7.7248,"has_fulltext":true,"cited_by_count":107,"citation_normalized_percentile":{"value":0.97907686,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":90,"max":100},"biblio":{"volume":"15","issue":"4","first_page":"277","last_page":"305"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9987999796867371,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.996399998664856,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/ransomware","display_name":"Ransomware","score":0.8960968255996704},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7279535531997681},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.49700668454170227},{"id":"https://openalex.org/keywords/taxonomy","display_name":"Taxonomy (biology)","score":0.41211628913879395},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.27583742141723633},{"id":"https://openalex.org/keywords/biology","display_name":"Biology","score":0.08846911787986755},{"id":"https://openalex.org/keywords/zoology","display_name":"Zoology","score":0.06665346026420593}],"concepts":[{"id":"https://openalex.org/C2777667771","wikidata":"https://www.wikidata.org/wiki/Q926331","display_name":"Ransomware","level":3,"score":0.8960968255996704},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7279535531997681},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.49700668454170227},{"id":"https://openalex.org/C58642233","wikidata":"https://www.wikidata.org/wiki/Q8269924","display_name":"Taxonomy (biology)","level":2,"score":0.41211628913879395},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.27583742141723633},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.08846911787986755},{"id":"https://openalex.org/C90856448","wikidata":"https://www.wikidata.org/wiki/Q431","display_name":"Zoology","level":1,"score":0.06665346026420593}],"mesh":[],"locations_count":4,"locations":[{"id":"doi:10.1007/s11416-019-00338-7","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s11416-019-00338-7","pdf_url":"https://link.springer.com/content/pdf/10.1007/s11416-019-00338-7.pdf","source":{"id":"https://openalex.org/S2764922190","display_name":"Journal of Computer Virology and Hacking Techniques","issn_l":"1772-9890","issn":["1772-9890","1772-9904","2263-8733"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Computer Virology and Hacking Techniques","raw_type":"journal-article"},{"id":"pmh:oai:usir.salford.ac.uk:51794","is_oa":true,"landing_page_url":"http://usir.salford.ac.uk/id/eprint/51794/1/ransomware-paper.pdf","pdf_url":"http://usir.salford.ac.uk/id/eprint/51794/9/Dargahi2019_Article_ACyber-Kill-ChainBasedTaxonomy.pdf","source":{"id":"https://openalex.org/S4306401501","display_name":"University of Salford Institutional Repository (University of Salford)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I54459138","host_organization_name":"University of Salford","host_organization_lineage":["https://openalex.org/I54459138"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"Article"},{"id":"pmh:oai:art.torvergata.it:2108/240024","is_oa":false,"landing_page_url":"http://hdl.handle.net/2108/240024","pdf_url":null,"source":{"id":"https://openalex.org/S4306400993","display_name":"Cineca Institutional Research Information System (Tor Vergata University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I116067653","host_organization_name":"University of Rome Tor Vergata","host_organization_lineage":["https://openalex.org/I116067653"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"info:eu-repo/semantics/article"},{"id":"pmh:oai:www.research.unipd.it:11577/3340644","is_oa":true,"landing_page_url":"http://hdl.handle.net/11577/3340644","pdf_url":null,"source":{"id":"https://openalex.org/S4306402547","display_name":"Padua Research Archive (University of Padova)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I138689650","host_organization_name":"University of Padua","host_organization_lineage":["https://openalex.org/I138689650"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"info:eu-repo/semantics/article"}],"best_oa_location":{"id":"doi:10.1007/s11416-019-00338-7","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s11416-019-00338-7","pdf_url":"https://link.springer.com/content/pdf/10.1007/s11416-019-00338-7.pdf","source":{"id":"https://openalex.org/S2764922190","display_name":"Journal of Computer Virology and Hacking Techniques","issn_l":"1772-9890","issn":["1772-9890","1772-9904","2263-8733"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Computer Virology and Hacking Techniques","raw_type":"journal-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/9","score":0.5600000023841858,"display_name":"Industry, innovation and infrastructure"}],"awards":[],"funders":[{"id":"https://openalex.org/F4320311740","display_name":"University of Salford Manchester","ror":"https://ror.org/01tmqtf75"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W2957305577.pdf","grobid_xml":"https://content.openalex.org/works/W2957305577.grobid-xml"},"referenced_works_count":64,"referenced_works":["https://openalex.org/W172558989","https://openalex.org/W606780114","https://openalex.org/W842671342","https://openalex.org/W1827822366","https://openalex.org/W1968185194","https://openalex.org/W1969430674","https://openalex.org/W1973697585","https://openalex.org/W1984233424","https://openalex.org/W1996716108","https://openalex.org/W2020504270","https://openalex.org/W2065323196","https://openalex.org/W2070041400","https://openalex.org/W2089735638","https://openalex.org/W2119359024","https://openalex.org/W2132449440","https://openalex.org/W2137345105","https://openalex.org/W2138471478","https://openalex.org/W2147710616","https://openalex.org/W2171035369","https://openalex.org/W2175365328","https://openalex.org/W2177710037","https://openalex.org/W2189390554","https://openalex.org/W2189515241","https://openalex.org/W2245015425","https://openalex.org/W2296579688","https://openalex.org/W2401125037","https://openalex.org/W2461373307","https://openalex.org/W2461651791","https://openalex.org/W2463535935","https://openalex.org/W2464432954","https://openalex.org/W2493960021","https://openalex.org/W2496077260","https://openalex.org/W2511701350","https://openalex.org/W2513529237","https://openalex.org/W2524919294","https://openalex.org/W2536018345","https://openalex.org/W2539082945","https://openalex.org/W2544488729","https://openalex.org/W2559964890","https://openalex.org/W2563412847","https://openalex.org/W2591102410","https://openalex.org/W2592102543","https://openalex.org/W2601591992","https://openalex.org/W2612123163","https://openalex.org/W2618809693","https://openalex.org/W2619422284","https://openalex.org/W2624784043","https://openalex.org/W2624868107","https://openalex.org/W2745390745","https://openalex.org/W2750688159","https://openalex.org/W2752533296","https://openalex.org/W2756675797","https://openalex.org/W2761623801","https://openalex.org/W2764249719","https://openalex.org/W2765732179","https://openalex.org/W2780577826","https://openalex.org/W2784113120","https://openalex.org/W2800509541","https://openalex.org/W2802988977","https://openalex.org/W3102401396","https://openalex.org/W3122507336","https://openalex.org/W3122821012","https://openalex.org/W3186276894","https://openalex.org/W4213358345"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W3201228709","https://openalex.org/W2922354075","https://openalex.org/W4389157351","https://openalex.org/W4232561318","https://openalex.org/W3202245533","https://openalex.org/W4253977752","https://openalex.org/W2942879794"],"abstract_inverted_index":{"In":[0,126],"spite":[1],"of":[2,24,73,83,95,121,124,134,141,163,171,189,203,220],"being":[3],"just":[4],"a":[5,13,30,35,62,112,155,218],"few":[6],"years":[7],"old,":[8],"ransomware":[9,25,46,50,60,84,101,113,142,183],"is":[10,109,154,202],"quickly":[11],"becoming":[12],"serious":[14],"threat":[15],"to":[16,33,54,131],"our":[17,135,173],"digital":[18],"infrastructures,":[19],"data":[20,40],"and":[21,69,81,89,103,224],"services.":[22],"Majority":[23],"families":[26,80],"are":[27,76],"requesting":[28],"for":[29,206],"ransom":[31],"payment":[32],"restore":[34],"custodian":[36],"access":[37],"or":[38],"decrypt":[39],"which":[41,75],"were":[42],"encrypted":[43],"by":[44],"the":[45,49,92,105,132,137,169,181,207,215,222,228],"earlier.":[47],"Although":[48],"attack":[51,64,225],"strategy":[52],"seems":[53],"be":[55],"simple,":[56],"security":[57,209],"specialists":[58],"ranked":[59],"as":[61,212],"sophisticated":[63],"vector":[65],"with":[66,145,187,217],"many":[67],"variations":[68],"families.":[70],"Wide":[71],"range":[72],"features":[74],"available":[77],"in":[78,158,175],"different":[79],"versions":[82],"further":[85],"complicates":[86],"their":[87],"detection":[88],"analysis.":[90],"Though":[91],"existing":[93],"body":[94,108],"research":[96,107,200,210],"provides":[97,214],"significant":[98],"discussions":[99],"about":[100],"details":[102],"capabilities,":[104],"all":[106],"fragmented.":[110],"Therefore,":[111],"feature":[114],"taxonomy":[115,140,174,185],"would":[116],"advance":[117],"cyber":[118,164,208],"defenders\u2019":[119],"understanding":[120],"associated":[122],"risks":[123],"ransomware.":[125],"this":[127,199],"paper":[128],"we":[129,178],"provide,":[130],"best":[133],"knowledge,":[136],"first":[138],"scientific":[139],"features,":[143],"aligned":[144,186],"Lockheed":[146],"Martin":[147],"Cyber":[148],"Kill":[149],"Chain":[150],"(CKC)":[151],"model.":[152],"CKC":[153],"well-established":[156],"model":[157],"industry":[159],"that":[160,198],"describes":[161],"stages":[162],"intrusion":[165],"attempts.":[166],"To":[167],"ease":[168],"challenge":[170],"applying":[172],"real":[176],"world,":[177],"also":[179],"provide":[180],"corresponding":[182],"defence":[184,194],"Courses":[188],"Action":[190],"matrix":[191],"(an":[192],"intelligence-driven":[193],"model).":[195],"We":[196],"believe":[197],"study":[201],"high":[204],"value":[205],"community,":[211],"it":[213],"researchers":[216],"means":[219],"assessing":[221],"vulnerabilities":[223],"vectors":[226],"towards":[227],"intended":[229],"victims.":[230]},"counts_by_year":[{"year":2026,"cited_by_count":5},{"year":2025,"cited_by_count":8},{"year":2024,"cited_by_count":18},{"year":2023,"cited_by_count":25},{"year":2022,"cited_by_count":19},{"year":2021,"cited_by_count":25},{"year":2020,"cited_by_count":6},{"year":2016,"cited_by_count":1}],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2025-10-10T00:00:00"}