{"id":"https://openalex.org/W4393372521","doi":"https://doi.org/10.1109/ecrime61234.2023.10485506","title":"Ransomware Economics: A Two-Step Approach To Model Ransom Paid","display_name":"Ransomware Economics: A Two-Step Approach To Model Ransom Paid","publication_year":2023,"publication_date":"2023-11-15","ids":{"openalex":"https://openalex.org/W4393372521","doi":"https://doi.org/10.1109/ecrime61234.2023.10485506"},"language":"en","primary_location":{"id":"doi:10.1109/ecrime61234.2023.10485506","is_oa":false,"landing_page_url":"https://doi.org/10.1109/ecrime61234.2023.10485506","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2023 APWG Symposium on Electronic Crime Research (eCrime)","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://research.utwente.nl/en/publications/5fbc4a09-5e4f-4316-94ca-a930c356e1f7","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5046498394","display_name":"Tom Meurs","orcid":"https://orcid.org/0000-0003-0963-5232"},"institutions":[{"id":"https://openalex.org/I94624287","display_name":"University of Twente","ror":"https://ror.org/006hf6230","country_code":"NL","type":"education","lineage":["https://openalex.org/I94624287"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Tom Meurs","raw_affiliation_strings":["University of Twente,Enschede,The Netherlands","University of Twente, Enschede, The Netherlands"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Twente,Enschede,The Netherlands","institution_ids":["https://openalex.org/I94624287"]},{"raw_affiliation_string":"University of Twente, Enschede, The Netherlands","institution_ids":["https://openalex.org/I94624287"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101430075","display_name":"Edward Cartwright","orcid":"https://orcid.org/0000-0003-0194-9368"},"institutions":[{"id":"https://openalex.org/I66943878","display_name":"De Montfort University","ror":"https://ror.org/0312pnr83","country_code":"GB","type":"education","lineage":["https://openalex.org/I66943878"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Edward Cartwright","raw_affiliation_strings":["De Montfort University,Leicester,United Kingdom","De Montfort University, Leicester, United Kingdom"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"De Montfort University,Leicester,United Kingdom","institution_ids":["https://openalex.org/I66943878"]},{"raw_affiliation_string":"De Montfort University, Leicester, United Kingdom","institution_ids":["https://openalex.org/I66943878"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5103091719","display_name":"Anna Cartwright","orcid":"https://orcid.org/0000-0003-1965-842X"},"institutions":[{"id":"https://openalex.org/I124261462","display_name":"Oxford Brookes University","ror":"https://ror.org/04v2twj65","country_code":"GB","type":"education","lineage":["https://openalex.org/I124261462"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Anna Cartwright","raw_affiliation_strings":["Oxford Brookes University,Oxford,United Kingdom","Oxford Brookes University, Oxford, United Kingdom"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Oxford Brookes University,Oxford,United Kingdom","institution_ids":["https://openalex.org/I124261462"]},{"raw_affiliation_string":"Oxford Brookes University, Oxford, United Kingdom","institution_ids":["https://openalex.org/I124261462"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5086905649","display_name":"Marianne Junger","orcid":"https://orcid.org/0000-0002-9515-9860"},"institutions":[{"id":"https://openalex.org/I94624287","display_name":"University of Twente","ror":"https://ror.org/006hf6230","country_code":"NL","type":"education","lineage":["https://openalex.org/I94624287"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Marianne Junger","raw_affiliation_strings":["University of Twente,Enschede,The Netherlands","University of Twente, Enschede, The Netherlands"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Twente,Enschede,The Netherlands","institution_ids":["https://openalex.org/I94624287"]},{"raw_affiliation_string":"University of Twente, Enschede, The Netherlands","institution_ids":["https://openalex.org/I94624287"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5049474157","display_name":"Raphael Hoheisel","orcid":"https://orcid.org/0000-0002-3621-425X"},"institutions":[{"id":"https://openalex.org/I94624287","display_name":"University of Twente","ror":"https://ror.org/006hf6230","country_code":"NL","type":"education","lineage":["https://openalex.org/I94624287"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Raphael Hoheisel","raw_affiliation_strings":["University of Twente,Enschede,The Netherlands","University of Twente, Enschede, The Netherlands"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Twente,Enschede,The Netherlands","institution_ids":["https://openalex.org/I94624287"]},{"raw_affiliation_string":"University of Twente, Enschede, The Netherlands","institution_ids":["https://openalex.org/I94624287"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5039255435","display_name":"Erik Tews","orcid":null},"institutions":[{"id":"https://openalex.org/I94624287","display_name":"University of Twente","ror":"https://ror.org/006hf6230","country_code":"NL","type":"education","lineage":["https://openalex.org/I94624287"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Erik Tews","raw_affiliation_strings":["University of Twente,Enschede,The Netherlands","University of Twente, Enschede, The Netherlands"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Twente,Enschede,The Netherlands","institution_ids":["https://openalex.org/I94624287"]},{"raw_affiliation_string":"University of Twente, Enschede, The Netherlands","institution_ids":["https://openalex.org/I94624287"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5053272015","display_name":"Abhishta Abhishta","orcid":"https://orcid.org/0000-0001-7122-3103"},"institutions":[{"id":"https://openalex.org/I94624287","display_name":"University of Twente","ror":"https://ror.org/006hf6230","country_code":"NL","type":"education","lineage":["https://openalex.org/I94624287"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Abhishta Abhishta","raw_affiliation_strings":["University of Twente,Enschede,The Netherlands","University of Twente, Enschede, The Netherlands"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Twente,Enschede,The Netherlands","institution_ids":["https://openalex.org/I94624287"]},{"raw_affiliation_string":"University of Twente, Enschede, The Netherlands","institution_ids":["https://openalex.org/I94624287"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":7,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":3.6027,"has_fulltext":true,"cited_by_count":12,"citation_normalized_percentile":{"value":0.9336459,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":95,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"13"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11995","display_name":"FinTech, Crowdfunding, Digital Finance","score":0.9832000136375427,"subfield":{"id":"https://openalex.org/subfields/1404","display_name":"Management Information Systems"},"field":{"id":"https://openalex.org/fields/14","display_name":"Business, Management and Accounting"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},"topics":[{"id":"https://openalex.org/T11995","display_name":"FinTech, Crowdfunding, Digital Finance","score":0.9832000136375427,"subfield":{"id":"https://openalex.org/subfields/1404","display_name":"Management Information Systems"},"field":{"id":"https://openalex.org/fields/14","display_name":"Business, Management and Accounting"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/ransom","display_name":"Ransom","score":0.9468854665756226},{"id":"https://openalex.org/keywords/ransomware","display_name":"Ransomware","score":0.7698047161102295},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.5694075226783752},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.25063058733940125},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.20006439089775085},{"id":"https://openalex.org/keywords/history","display_name":"History","score":0.09410661458969116}],"concepts":[{"id":"https://openalex.org/C2781426709","wikidata":"https://www.wikidata.org/wiki/Q1414572","display_name":"Ransom","level":2,"score":0.9468854665756226},{"id":"https://openalex.org/C2777667771","wikidata":"https://www.wikidata.org/wiki/Q926331","display_name":"Ransomware","level":3,"score":0.7698047161102295},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5694075226783752},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.25063058733940125},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.20006439089775085},{"id":"https://openalex.org/C95457728","wikidata":"https://www.wikidata.org/wiki/Q309","display_name":"History","level":0,"score":0.09410661458969116},{"id":"https://openalex.org/C166957645","wikidata":"https://www.wikidata.org/wiki/Q23498","display_name":"Archaeology","level":1,"score":0.0}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1109/ecrime61234.2023.10485506","is_oa":false,"landing_page_url":"https://doi.org/10.1109/ecrime61234.2023.10485506","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2023 APWG Symposium on Electronic Crime Research (eCrime)","raw_type":"proceedings-article"},{"id":"pmh:oai:ris.utwente.nl:publications/5fbc4a09-5e4f-4316-94ca-a930c356e1f7","is_oa":true,"landing_page_url":"https://research.utwente.nl/en/publications/5fbc4a09-5e4f-4316-94ca-a930c356e1f7","pdf_url":null,"source":{"id":"https://openalex.org/S4406922991","display_name":"University of Twente Research Information","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Meurs, T, Cartwright, E, Cartwright, A, Junger, M, Hoheisel, R, Tews, E & Abhishta, A 2024, Ransomware Economics : A Two-Step Approach To Model Ransom Paid. in 2023 APWG Symposium on Electronic Crime Research (eCrime). Proceedings APWG Symposium on Electronic Crime Research (eCrime), vol. 2023, IEEE, Piscataway, NJ, 18th Symposium on Electronic Crime Research, eCrime 2023, Barcelona, Spain, 15/11/23. https://doi.org/10.1109/eCrime61234.2023.10485506","raw_type":"info:eu-repo/semantics/publishedVersion"},{"id":"pmh:oai:ris.utwente.nl:openaire/5fbc4a09-5e4f-4316-94ca-a930c356e1f7","is_oa":true,"landing_page_url":"https://research.utwente.nl/files/324702475/Ecrime2023vPREPRINT.pdf","pdf_url":"https://ris.utwente.nl/ws/files/324702475/Ecrime2023vPREPRINT.pdf","source":{"id":"https://openalex.org/S4406922991","display_name":"University of Twente Research Information","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Meurs, T, Cartwright, E, Cartwright, A, Junger, M, Hoheisel, R, Tews, E & Abhishta, A 2024, Ransomware Economics : A Two-Step Approach To Model Ransom Paid. in 2023 APWG Symposium on Electronic Crime Research (eCrime). Proceedings APWG Symposium on Electronic Crime Research (eCrime), vol. 2023, IEEE, Piscataway, NJ, 18th Symposium on Electronic Crime Research, eCrime 2023, Barcelona, Spain, 15/11/23. https://doi.org/10.1109/eCrime61234.2023.10485506","raw_type":"info:eu-repo/semantics/publishedVersion"}],"best_oa_location":{"id":"pmh:oai:ris.utwente.nl:publications/5fbc4a09-5e4f-4316-94ca-a930c356e1f7","is_oa":true,"landing_page_url":"https://research.utwente.nl/en/publications/5fbc4a09-5e4f-4316-94ca-a930c356e1f7","pdf_url":null,"source":{"id":"https://openalex.org/S4406922991","display_name":"University of Twente Research Information","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Meurs, T, Cartwright, E, Cartwright, A, Junger, M, Hoheisel, R, Tews, E & Abhishta, A 2024, Ransomware Economics : A Two-Step Approach To Model Ransom Paid. in 2023 APWG Symposium on Electronic Crime Research (eCrime). Proceedings APWG Symposium on Electronic Crime Research (eCrime), vol. 2023, IEEE, Piscataway, NJ, 18th Symposium on Electronic Crime Research, eCrime 2023, Barcelona, Spain, 15/11/23. https://doi.org/10.1109/eCrime61234.2023.10485506","raw_type":"info:eu-repo/semantics/publishedVersion"},"sustainable_development_goals":[{"display_name":"Decent work and economic growth","score":0.5099999904632568,"id":"https://metadata.un.org/sdg/8"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":30,"referenced_works":["https://openalex.org/W70589698","https://openalex.org/W1412796528","https://openalex.org/W1974858978","https://openalex.org/W1984487609","https://openalex.org/W2081975038","https://openalex.org/W2129972129","https://openalex.org/W2886765421","https://openalex.org/W2948913639","https://openalex.org/W2955105517","https://openalex.org/W3009452534","https://openalex.org/W3046374425","https://openalex.org/W3159322291","https://openalex.org/W3161067406","https://openalex.org/W3209840240","https://openalex.org/W4200420517","https://openalex.org/W4224077233","https://openalex.org/W4244843651","https://openalex.org/W4281476659","https://openalex.org/W4293697625","https://openalex.org/W4311363665","https://openalex.org/W4318538464","https://openalex.org/W4322505540","https://openalex.org/W4323665564","https://openalex.org/W4379528878","https://openalex.org/W4384129870","https://openalex.org/W4385247756","https://openalex.org/W4385252610","https://openalex.org/W6602839187","https://openalex.org/W6876732806","https://openalex.org/W7037411764"],"related_works":["https://openalex.org/W4237045072","https://openalex.org/W4386388924","https://openalex.org/W2805263553","https://openalex.org/W2614042168","https://openalex.org/W2778994855","https://openalex.org/W2913313394","https://openalex.org/W2989970626","https://openalex.org/W4213358345","https://openalex.org/W4281476659","https://openalex.org/W2914950722"],"abstract_inverted_index":{"Ransomware":[0],"poses":[1],"a":[2,38,109,122,170,220,232,237],"significant":[3],"and":[4,32,136,160,192,227,270],"pressing":[5],"challenge":[6,84],"in":[7,173,209,224,231,240,263],"today's":[8],"society.":[9],"Mitigation":[10],"efforts":[11],"aim":[12],"to":[13,36,43,71,101,130,140,146,163,165,177,219],"reduce":[14],"the":[15,28,56,72,90,133,148,156,161,174,179,196,202,225,241,257],"profitability":[16],"of":[17,30,34,85,93,158,195],"ransomware":[18,68],"attacks.":[19],"Nevertheless,":[20],"limited":[21],"research":[22],"has":[23],"analysed":[24],"factors":[25],"that":[26,53,155,211,253],"influence":[27],"size":[29],"ransom":[31,57,87,119,134,150,180,203,242],"willingness":[33],"businesses":[35],"pay":[37,178],"ransom.":[39],"This":[40],"study":[41],"aims":[42],"address":[44],"this":[45,105],"existing":[46],"gap":[47],"by":[48,59,77,107,117],"conducting":[49],"an":[50,78,166],"empirical":[51],"investigation":[52],"focuses":[54],"on":[55,62,267],"paid":[58,120],"victims.":[60],"Extending":[61],"past":[63],"research,":[64],"we":[65,248],"analyse":[66],"382":[67],"attacks":[69],"reported":[70],"Dutch":[73],"Police":[74],"and/or":[75],"handled":[76],"Incident":[79],"Response":[80],"(IR)":[81],"company.":[82],"One":[83],"modeling":[86],"payments":[88],"is":[89],"large":[91],"proportion":[92],"victims":[94,127],"who":[95],"did":[96],"not":[97],"pay,":[98],"which":[99,112],"leads":[100],"zero-inflation.":[102],"We":[103],"tackled":[104],"problem":[106],"employing":[108],"hurdle":[110],"model,":[111],"effectively":[113],"deals":[114],"with":[115,132],"zero-inflation":[116],"capturing":[118],"as":[121,198],"two-step":[123],"decision-making":[124,260],"process:":[125],"first,":[126],"decide":[128],"whether":[129,176],"comply":[131],"demands,":[135],"if":[137],"they":[138,143],"choose":[139],"do":[141],"so,":[142],"then":[144],"need":[145],"determine":[147],"acceptable":[149],"amount.":[151],"The":[152],"results":[153,208],"indicate":[154],"presence":[157],"backups":[159],"decision":[162,175],"go":[164],"IR":[167],"company":[168],"play":[169],"pivotal":[171],"role":[172],"or":[181],"not.":[182],"In":[183,244],"addition,":[184],"our":[185,246,264],"findings":[186],"identify":[187],"insurance":[188,207],"coverage,":[189],"data":[190,216,268],"exfiltration,":[191],"annual":[193],"revenue":[194,235],"victim":[197],"key":[199],"determinants":[200],"affecting":[201],"amounts.":[204],"Specifically,":[205],"having":[206],"ransoms":[210],"are":[212],"2.8":[213],"times":[214,222],"larger,":[215],"exfiltration":[217,269],"corresponds":[218],"5.5":[221],"increase":[223,230],"ransom,":[226],"each":[228],"1%":[229],"victim's":[233],"yearly":[234],"causes":[236],"0.12%":[238],"rise":[239],"paid.":[243],"concluding":[245],"paper,":[247],"present":[249],"practical":[250],"policy":[251],"recommendations":[252],"take":[254],"into":[255],"account":[256],"two":[258],"crucial":[259],"steps":[261],"outlined":[262],"study,":[265],"focusing":[266],"insurance.":[271]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":7},{"year":2024,"cited_by_count":4}],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2025-10-10T00:00:00"}