{"id":"https://openalex.org/W4413679808","doi":"https://doi.org/10.1109/csr64739.2025.11130172","title":"HyperDtct: Hypervisor-based Ransomware Detection using System Calls","display_name":"HyperDtct: Hypervisor-based Ransomware Detection using System Calls","publication_year":2025,"publication_date":"2025-08-04","ids":{"openalex":"https://openalex.org/W4413679808","doi":"https://doi.org/10.1109/csr64739.2025.11130172"},"language":"en","primary_location":{"id":"doi:10.1109/csr64739.2025.11130172","is_oa":false,"landing_page_url":"https://doi.org/10.1109/csr64739.2025.11130172","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE International Conference on Cyber Security and Resilience (CSR)","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.1109/CSR64739.2025.11130172","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5071602128","display_name":"Jan von der Assen","orcid":"https://orcid.org/0000-0002-0591-8887"},"institutions":[{"id":"https://openalex.org/I202697423","display_name":"University of Zurich","ror":"https://ror.org/02crff812","country_code":"CH","type":"education","lineage":["https://openalex.org/I202697423"]}],"countries":["CH"],"is_corresponding":true,"raw_author_name":"Jan von der Assen","raw_affiliation_strings":["University of Zurich UZH,Communication Systems Group CSG,Department of Informatics,Zürich,Switzerland,CH-8050"],"affiliations":[{"raw_affiliation_string":"University of Zurich UZH,Communication Systems Group CSG,Department of Informatics,Zürich,Switzerland,CH-8050","institution_ids":["https://openalex.org/I202697423"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5063531116","display_name":"Alberto Huertas Celdr\u00e1n","orcid":"https://orcid.org/0000-0001-7125-1710"},"institutions":[{"id":"https://openalex.org/I202697423","display_name":"University of Zurich","ror":"https://ror.org/02crff812","country_code":"CH","type":"education","lineage":["https://openalex.org/I202697423"]}],"countries":["CH"],"is_corresponding":false,"raw_author_name":"Alberto Huertas Celdr\u00e1n","raw_affiliation_strings":["University of Zurich UZH,Communication Systems Group CSG,Department of Informatics,Zürich,Switzerland,CH-8050"],"affiliations":[{"raw_affiliation_string":"University of Zurich UZH,Communication Systems Group CSG,Department of Informatics,Zürich,Switzerland,CH-8050","institution_ids":["https://openalex.org/I202697423"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5009981067","display_name":"Johannes L\u00fcthi","orcid":null},"institutions":[{"id":"https://openalex.org/I202697423","display_name":"University of Zurich","ror":"https://ror.org/02crff812","country_code":"CH","type":"education","lineage":["https://openalex.org/I202697423"]}],"countries":["CH"],"is_corresponding":false,"raw_author_name":"Jan Marc L\u00fcthi","raw_affiliation_strings":["University of Zurich UZH,Communication Systems Group CSG,Department of Informatics,Zürich,Switzerland,CH-8050"],"affiliations":[{"raw_affiliation_string":"University of Zurich UZH,Communication Systems Group CSG,Department of Informatics,Zürich,Switzerland,CH-8050","institution_ids":["https://openalex.org/I202697423"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5008356532","display_name":"Jos\u00e9 Mar\u00eda Jorquera Valero","orcid":"https://orcid.org/0000-0003-1365-7573"},"institutions":[{"id":"https://openalex.org/I80180929","display_name":"Universidad de Murcia","ror":"https://ror.org/03p3aeb86","country_code":"ES","type":"education","lineage":["https://openalex.org/I80180929"]}],"countries":["ES"],"is_corresponding":false,"raw_author_name":"Jos\u00e9 Mar\u00eda Jorquera Valero","raw_affiliation_strings":["University of Murcia,Department of Information and Communications Engineering,Murcia,Spain,30100"],"affiliations":[{"raw_affiliation_string":"University of Murcia,Department of Information and Communications Engineering,Murcia,Spain,30100","institution_ids":["https://openalex.org/I80180929"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5092446295","display_name":"Francisco Enguix","orcid":"https://orcid.org/0009-0002-8144-318X"},"institutions":[{"id":"https://openalex.org/I4210131846","display_name":"Artificial Intelligence Research Institute","ror":"https://ror.org/03c0ach84","country_code":"ES","type":"facility","lineage":["https://openalex.org/I134820265","https://openalex.org/I4210131846"]}],"countries":["ES"],"is_corresponding":false,"raw_author_name":"Francisco Enguix","raw_affiliation_strings":["Universitat Politécnica de Valéncia (UPV), Camino de Vera s/n,Valencian Research Institute for Artificial Intelligence (VRAIN),Valencia,Spain,46022"],"affiliations":[{"raw_affiliation_string":"Universitat Politécnica de Valéncia (UPV), Camino de Vera s/n,Valencian Research Institute for Artificial Intelligence (VRAIN),Valencia,Spain,46022","institution_ids":["https://openalex.org/I4210131846"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5070889566","display_name":"G\u00e9r\u00f4me Bovet","orcid":"https://orcid.org/0000-0002-4534-3483"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"G\u00e9r\u00f4me Bovet","raw_affiliation_strings":["armasuisse Science & Technology,Cyber-Defence Campus,Thun,Switzerland,CH-3602"],"affiliations":[{"raw_affiliation_string":"armasuisse Science & Technology,Cyber-Defence Campus,Thun,Switzerland,CH-3602","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5033030418","display_name":"Burkhard Stiller","orcid":"https://orcid.org/0000-0002-7461-7463"},"institutions":[{"id":"https://openalex.org/I202697423","display_name":"University of Zurich","ror":"https://ror.org/02crff812","country_code":"CH","type":"education","lineage":["https://openalex.org/I202697423"]}],"countries":["CH"],"is_corresponding":false,"raw_author_name":"Burkhard Stiller","raw_affiliation_strings":["University of Zurich UZH,Communication Systems Group CSG,Department of Informatics,Zürich,Switzerland,CH-8050"],"affiliations":[{"raw_affiliation_string":"University of Zurich UZH,Communication Systems Group CSG,Department of Informatics,Zürich,Switzerland,CH-8050","institution_ids":["https://openalex.org/I202697423"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":7,"corresponding_author_ids":["https://openalex.org/A5071602128"],"corresponding_institution_ids":["https://openalex.org/I202697423"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.26703348,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"308","last_page":"313"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9955000281333923,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.983299970626831,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/ransomware","display_name":"Ransomware","score":0.9434088468551636},{"id":"https://openalex.org/keywords/hypervisor","display_name":"Hypervisor","score":0.9038075804710388},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.672023594379425},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.5485792756080627},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.5081048011779785},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.4965055584907532},{"id":"https://openalex.org/keywords/embedded-system","display_name":"Embedded system","score":0.3260631263256073},{"id":"https://openalex.org/keywords/virtualization","display_name":"Virtualization","score":0.15881922841072083},{"id":"https://openalex.org/keywords/cloud-computing","display_name":"Cloud computing","score":0.10454058647155762}],"concepts":[{"id":"https://openalex.org/C2777667771","wikidata":"https://www.wikidata.org/wiki/Q926331","display_name":"Ransomware","level":3,"score":0.9434088468551636},{"id":"https://openalex.org/C112904061","wikidata":"https://www.wikidata.org/wiki/Q1077480","display_name":"Hypervisor","level":4,"score":0.9038075804710388},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.672023594379425},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.5485792756080627},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.5081048011779785},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4965055584907532},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.3260631263256073},{"id":"https://openalex.org/C513985346","wikidata":"https://www.wikidata.org/wiki/Q270471","display_name":"Virtualization","level":3,"score":0.15881922841072083},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.10454058647155762}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1109/csr64739.2025.11130172","is_oa":false,"landing_page_url":"https://doi.org/10.1109/csr64739.2025.11130172","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE International Conference on Cyber Security and Resilience (CSR)","raw_type":"proceedings-article"},{"id":"pmh:doi:10.5167/uzh-291215","is_oa":false,"landing_page_url":null,"pdf_url":null,"source":{"id":"https://openalex.org/S4406922384","display_name":"Open MIND","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"ConferenceItem"},{"id":"pmh:oai:zenodo.org:17934248","is_oa":true,"landing_page_url":"https://doi.org/10.1109/CSR64739.2025.11130172","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"(CSR), 2025 IEEE International Conference on Cyber Security and Resilience, Chania, Crete, Greece, 04-06 August 2025","raw_type":"info:eu-repo/semantics/conferencePaper"}],"best_oa_location":{"id":"pmh:oai:zenodo.org:17934248","is_oa":true,"landing_page_url":"https://doi.org/10.1109/CSR64739.2025.11130172","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"(CSR), 2025 IEEE International Conference on Cyber Security and Resilience, Chania, Crete, Greece, 04-06 August 2025","raw_type":"info:eu-repo/semantics/conferencePaper"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/8","display_name":"Decent work and economic growth","score":0.4300000071525574}],"awards":[],"funders":[{"id":"https://openalex.org/F4320334322","display_name":"HORIZON EUROPE Framework Programme","ror":null}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W1973516247","https://openalex.org/W4241166160","https://openalex.org/W2796290234","https://openalex.org/W2799095291","https://openalex.org/W2470663080","https://openalex.org/W1965252149","https://openalex.org/W3127457055","https://openalex.org/W2519314911","https://openalex.org/W378416953","https://openalex.org/W3133357914"],"abstract_inverted_index":{"Ransomware-as-a-Service":[0],"represents":[1],"an":[2,74],"increasingly":[3],"significant":[4],"threat,":[5],"allowing":[6],"malicious":[7,143],"individuals":[8],"without":[9],"advanced":[10],"technical":[11],"expertise":[12],"to":[13,31,77],"target":[14],"high-value":[15],"entities.":[16],"In":[17],"this":[18,70],"regard,":[19],"cloud":[20],"service":[21],"providers":[22],"have":[23],"become":[24],"primary":[25],"targets":[26],"for":[27,89],"ransomware":[28,90,113],"attacks":[29],"due":[30],"their":[32],"management":[33],"of":[34,43,137],"sensitive":[35],"data":[36],"and":[37,62,85,97,111,142],"critical":[38],"applications.":[39],"Despite":[40],"the":[41,55,60,82,129],"existence":[42],"numerous":[44],"solutions":[45],"detecting":[46],"ransomware,":[47],"many":[48],"are":[49],"ineffective,":[50],"as":[51,59,101,103,116],"they":[52],"operate":[53],"within":[54],"same":[56],"operating":[57],"system":[58,79],"malware":[61],"can":[63,126],"thus":[64],"be":[65],"evaded":[66],"or":[67,118],"manipulated.":[68],"Consequently,":[69],"work":[71],"introduces":[72],"HyperDtct,":[73],"innovative":[75],"approach":[76],"collecting":[78],"calls":[80],"at":[81],"hypervisor":[83],"level":[84],"employing":[86],"Machine":[87],"Learning":[88],"detection.":[91],"The":[92,121],"experiments":[93],"evaluate":[94],"various":[95],"classification":[96],"anomaly":[98],"detection":[99],"algorithms,":[100],"well":[102],"feature":[104],"selection":[105],"techniques,":[106],"utilizing":[107],"thirteen":[108],"benign":[109,141],"workloads":[110],"eleven":[112],"samples":[114,131],"(such":[115],"Babuk":[117],"LockBit":[119],"Dark).":[120],"evaluations":[122],"demonstrate":[123],"that":[124],"HyperDtct":[125],"accurately":[127],"classify":[128],"examined":[130],"with":[132],"a":[133],"high":[134],"$F_{1}$":[135],"score":[136],"0.97,":[138],"distinguishing":[139],"between":[140],"entities":[144],"in":[145],"less":[146],"than":[147],"ten":[148],"seconds.":[149]},"counts_by_year":[],"updated_date":"2026-04-04T16:13:02.066488","created_date":"2025-10-10T00:00:00"}