{"id":"https://openalex.org/W3091011807","doi":"https://doi.org/10.1109/eit48999.2020.9208284","title":"An Empirical Study of API Calls in Ransomware","display_name":"An Empirical Study of API Calls in Ransomware","publication_year":2020,"publication_date":"2020-07-01","ids":{"openalex":"https://openalex.org/W3091011807","doi":"https://doi.org/10.1109/eit48999.2020.9208284","mag":"3091011807"},"language":"en","primary_location":{"id":"doi:10.1109/eit48999.2020.9208284","is_oa":false,"landing_page_url":"https://doi.org/10.1109/eit48999.2020.9208284","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2020 IEEE International Conference on Electro Information Technology (EIT)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5049640604","display_name":"Pranshu Bajpai","orcid":"https://orcid.org/0000-0003-4662-4049"},"institutions":[{"id":"https://openalex.org/I87216513","display_name":"Michigan State University","ror":"https://ror.org/05hs6h993","country_code":"US","type":"education","lineage":["https://openalex.org/I87216513"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Pranshu Bajpai","raw_affiliation_strings":["Michigan State University, East Lansing, Michigan, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Michigan State University, East Lansing, Michigan, USA","institution_ids":["https://openalex.org/I87216513"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5036446758","display_name":"Richard Enbody","orcid":"https://orcid.org/0000-0002-2415-5651"},"institutions":[{"id":"https://openalex.org/I87216513","display_name":"Michigan State University","ror":"https://ror.org/05hs6h993","country_code":"US","type":"education","lineage":["https://openalex.org/I87216513"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Richard Enbody","raw_affiliation_strings":["Michigan State University, East Lansing, Michigan, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Michigan State University, East Lansing, Michigan, USA","institution_ids":["https://openalex.org/I87216513"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I87216513"],"apc_list":null,"apc_paid":null,"fwci":0.6573,"has_fulltext":false,"cited_by_count":8,"citation_normalized_percentile":{"value":0.66802352,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":93,"max":98},"biblio":{"volume":null,"issue":null,"first_page":"443","last_page":"448"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.991100013256073,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9904000163078308,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/ransomware","display_name":"Ransomware","score":0.9770330190658569},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7900711894035339},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.6572529673576355},{"id":"https://openalex.org/keywords/cryptography","display_name":"Cryptography","score":0.587787389755249},{"id":"https://openalex.org/keywords/profiling","display_name":"Profiling (computer programming)","score":0.46027302742004395},{"id":"https://openalex.org/keywords/abstraction","display_name":"Abstraction","score":0.4441637694835663},{"id":"https://openalex.org/keywords/cryptographic-primitive","display_name":"Cryptographic primitive","score":0.41078445315361023},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.2540469169616699},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.21555611491203308},{"id":"https://openalex.org/keywords/cryptographic-protocol","display_name":"Cryptographic protocol","score":0.1183672547340393}],"concepts":[{"id":"https://openalex.org/C2777667771","wikidata":"https://www.wikidata.org/wiki/Q926331","display_name":"Ransomware","level":3,"score":0.9770330190658569},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7900711894035339},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6572529673576355},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.587787389755249},{"id":"https://openalex.org/C187191949","wikidata":"https://www.wikidata.org/wiki/Q1138496","display_name":"Profiling (computer programming)","level":2,"score":0.46027302742004395},{"id":"https://openalex.org/C124304363","wikidata":"https://www.wikidata.org/wiki/Q673661","display_name":"Abstraction","level":2,"score":0.4441637694835663},{"id":"https://openalex.org/C15927051","wikidata":"https://www.wikidata.org/wiki/Q246593","display_name":"Cryptographic primitive","level":4,"score":0.41078445315361023},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.2540469169616699},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.21555611491203308},{"id":"https://openalex.org/C33884865","wikidata":"https://www.wikidata.org/wiki/Q1254335","display_name":"Cryptographic protocol","level":3,"score":0.1183672547340393},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0},{"id":"https://openalex.org/C111472728","wikidata":"https://www.wikidata.org/wiki/Q9471","display_name":"Epistemology","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/eit48999.2020.9208284","is_oa":false,"landing_page_url":"https://doi.org/10.1109/eit48999.2020.9208284","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2020 IEEE International Conference on Electro Information Technology (EIT)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16","score":0.7300000190734863}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":21,"referenced_works":["https://openalex.org/W101596157","https://openalex.org/W1557109513","https://openalex.org/W1573526548","https://openalex.org/W1966917005","https://openalex.org/W2002478203","https://openalex.org/W2041130390","https://openalex.org/W2044751544","https://openalex.org/W2055716572","https://openalex.org/W2060145807","https://openalex.org/W2065311994","https://openalex.org/W2086200747","https://openalex.org/W2119359024","https://openalex.org/W2154529672","https://openalex.org/W2592102543","https://openalex.org/W2766662076","https://openalex.org/W2808131992","https://openalex.org/W3008300537","https://openalex.org/W3013376267","https://openalex.org/W4248806346","https://openalex.org/W6678155843","https://openalex.org/W6888875766"],"related_works":["https://openalex.org/W2783353176","https://openalex.org/W18954787","https://openalex.org/W3138083505","https://openalex.org/W4254460476","https://openalex.org/W2339543721","https://openalex.org/W1829339118","https://openalex.org/W3179891621","https://openalex.org/W87530933","https://openalex.org/W2172677935","https://openalex.org/W1700639748"],"abstract_inverted_index":{"Modern":[0],"cryptographic":[1],"ransomware":[2,15,76,141],"pose":[3],"a":[4,61,95],"severe":[5],"threat":[6],"to":[7,23,49,69,135],"the":[8,24,29,43,47,86,99],"security":[9],"of":[10,64,98,109],"individuals":[11],"and":[12,60,118,132],"organizations.":[13],"Targeted":[14],"attacks":[16],"exhibit":[17],"refinement":[18],"in":[19,103,125,153],"attack":[20],"vectors":[21],"owing":[22],"manual":[25],"reconnaissance":[26],"performed":[27],"by":[28,89],"perpetrators":[30],"for":[31,116],"infiltration.":[32],"The":[33],"result":[34],"is":[35,57,67],"an":[36],"impenetrable":[37],"lock":[38],"on":[39,54,85],"multiple":[40],"hosts":[41],"within":[42],"organization":[44],"which":[45],"allows":[46],"cybercriminals":[48],"demand":[50],"hefty":[51],"ransoms.":[52],"Reliance":[53],"prevention":[55],"strategies":[56,79],"not":[58],"sufficient":[59],"firm":[62],"comprehension":[63],"implementation":[65],"details":[66],"necessary":[68],"develop":[70],"effective":[71,120],"solutions":[72],"that":[73,112,142,144],"can":[74,113],"thwart":[75],"after":[77],"preventative":[78],"have":[80],"failed.":[81],"Ransomware":[82],"depend":[83],"heavily":[84],"abstraction":[87],"offered":[88],"Windows":[90],"APIs.":[91],"This":[92],"paper":[93],"provides":[94],"detailed":[96],"review":[97],"common":[100],"API":[101,110,121,136],"calls":[102,111],"ransomware.":[104],"We":[105],"propose":[106],"four":[107],"classes":[108],"be":[114],"used":[115],"profiling":[117],"generating":[119],"call":[122,137],"relationships":[123],"useful":[124],"automated":[126],"detection.":[127],"Finally,":[128],"we":[129],"present":[130],"counts":[131],"visualizations":[133],"pertaining":[134],"extraction":[138],"from":[139,148],"real-world":[140],"demonstrate":[143],"even":[145],"advanced":[146],"variants":[147],"different":[149],"families":[150],"carry":[151],"similarities":[152],"implementation.":[154]},"counts_by_year":[{"year":2024,"cited_by_count":4},{"year":2023,"cited_by_count":2},{"year":2021,"cited_by_count":2}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}