{"id":"https://openalex.org/W4411205909","doi":"https://doi.org/10.1109/isdfs65363.2025.11012104","title":"A Behavioral Analysis of Ransomware in Active Directory: A Case Study of BlackMatter, Conti, LockBit, and Midnight","display_name":"A Behavioral Analysis of Ransomware in Active Directory: A Case Study of BlackMatter, Conti, LockBit, and Midnight","publication_year":2025,"publication_date":"2025-04-24","ids":{"openalex":"https://openalex.org/W4411205909","doi":"https://doi.org/10.1109/isdfs65363.2025.11012104"},"language":"en","primary_location":{"id":"doi:10.1109/isdfs65363.2025.11012104","is_oa":false,"landing_page_url":"https://doi.org/10.1109/isdfs65363.2025.11012104","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 13th International Symposium on Digital Forensics and Security (ISDFS)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5064571120","display_name":"Prajna Bhandary","orcid":null},"institutions":[{"id":"https://openalex.org/I79272384","display_name":"University of Maryland, Baltimore County","ror":"https://ror.org/02qskvh78","country_code":"US","type":"education","lineage":["https://openalex.org/I79272384"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Prajna Bhandary","raw_affiliation_strings":["University of Maryland Baltimore County (UMBC),Computer Science and Electrical Engineering Department,Baltimore,MD,USA,21250"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Maryland Baltimore County (UMBC),Computer Science and Electrical Engineering Department,Baltimore,MD,USA,21250","institution_ids":["https://openalex.org/I79272384"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5082416889","display_name":"C.H. Nicholas","orcid":null},"institutions":[{"id":"https://openalex.org/I79272384","display_name":"University of Maryland, Baltimore County","ror":"https://ror.org/02qskvh78","country_code":"US","type":"education","lineage":["https://openalex.org/I79272384"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Charles Nicholas","raw_affiliation_strings":["University of Maryland Baltimore County (UMBC),Computer Science and Electrical Engineering Department,Baltimore,MD,USA,21250"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Maryland Baltimore County (UMBC),Computer Science and Electrical Engineering Department,Baltimore,MD,USA,21250","institution_ids":["https://openalex.org/I79272384"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I79272384"],"apc_list":null,"apc_paid":null,"fwci":4.5234,"has_fulltext":false,"cited_by_count":3,"citation_normalized_percentile":{"value":0.94723066,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"6"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9772999882698059,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9772999882698059,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9699000120162964,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11045","display_name":"Privacy, Security, and Data Protection","score":0.9689000248908997,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/midnight","display_name":"Midnight","score":0.8721281886100769},{"id":"https://openalex.org/keywords/directory","display_name":"Directory","score":0.6140539050102234},{"id":"https://openalex.org/keywords/ransomware","display_name":"Ransomware","score":0.5857154726982117},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.5248256325721741},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.3553597331047058},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.253534197807312},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.13792353868484497},{"id":"https://openalex.org/keywords/physics","display_name":"Physics","score":0.1120341420173645},{"id":"https://openalex.org/keywords/astronomy","display_name":"Astronomy","score":0.06680813431739807}],"concepts":[{"id":"https://openalex.org/C25188466","wikidata":"https://www.wikidata.org/wiki/Q36402","display_name":"Midnight","level":2,"score":0.8721281886100769},{"id":"https://openalex.org/C2777683733","wikidata":"https://www.wikidata.org/wiki/Q201456","display_name":"Directory","level":2,"score":0.6140539050102234},{"id":"https://openalex.org/C2777667771","wikidata":"https://www.wikidata.org/wiki/Q926331","display_name":"Ransomware","level":3,"score":0.5857154726982117},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5248256325721741},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3553597331047058},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.253534197807312},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.13792353868484497},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.1120341420173645},{"id":"https://openalex.org/C1276947","wikidata":"https://www.wikidata.org/wiki/Q333","display_name":"Astronomy","level":1,"score":0.06680813431739807}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/isdfs65363.2025.11012104","is_oa":false,"landing_page_url":"https://doi.org/10.1109/isdfs65363.2025.11012104","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 13th International Symposium on Digital Forensics and Security (ISDFS)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W564328771","https://openalex.org/W4238092097","https://openalex.org/W3201228709","https://openalex.org/W2922354075","https://openalex.org/W2241230381","https://openalex.org/W495203753","https://openalex.org/W2389240028"],"abstract_inverted_index":{"Ransomware":[0],"continues":[1],"to":[2,96,111,143],"be":[3],"a":[4,61,90],"pervasive":[5],"cyber-security":[6],"threat,":[7],"particularly":[8],"in":[9,48,55,66],"enterprise":[10,99,163],"environments":[11],"that":[12,135],"leverage":[13],"Active":[14],"Directory":[15],"(AD)":[16],"for":[17,156,162],"centralized":[18],"management.":[19],"This":[20],"study":[21,50],"focuses":[22],"on":[23,82],"analyzing":[24],"ransomware":[25,38,64,72,84,139],"behavior":[26],"by":[27],"ex-amining":[28],"Windows":[29],"Event":[30],"Logs":[31],"generated":[32],"during":[33],"attacks":[34],"from":[35],"four":[36],"prominent":[37],"families:":[39],"\u201cBlackMatter,\u201d":[40],"\u201cConti,\u201d":[41],"\u201cLockBit,\u201d":[42],"and":[43,76,107,116,131],"\u201cMidnight\u201d11The":[44],"\u201cMidnight\u201d":[45],"samples":[46,85],"included":[47],"this":[49],"were":[51],"labeled":[52],"as":[53,127],"such":[54,126],"the":[56,147,154],"dataset":[57],"[1]\u2013[3].":[58],"Although":[59],"not":[60],"commonly":[62],"recognized":[63],"family":[65],"public":[67],"reports,":[68],"they":[69],"demonstrate":[70],"typical":[71],"behaviors,":[73],"including":[74],"encryption":[75],"system":[77],"compromise..":[78],"We":[79],"conducted":[80],"experiments":[81],"20":[83],"(5":[86],"per":[87],"family)":[88],"within":[89],"controlled":[91],"Proxmox-based":[92],"virtual":[93],"AD":[94,164],"environment":[95],"simulate":[97],"realistic":[98],"conditions.":[100],"Our":[101],"analysis":[102],"applies":[103],"n-gram":[104],"sequence":[105],"modeling":[106],"behavioral":[108,124],"feature":[109],"extraction":[110],"uncover":[112],"distinctive":[113],"event":[114],"patterns":[115],"attack":[117],"paths.":[118],"The":[119],"findings":[120],"reveal":[121],"consistent,":[122],"family-specific":[123],"sequences,":[125],"repetitive":[128],"service":[129],"control":[130],"credential":[132],"validation":[133],"events,":[134],"are":[136],"indicative":[137],"of":[138,150],"activity.":[140],"In":[141],"addition":[142],"offering":[144],"insight":[145],"into":[146],"operational":[148],"methods":[149],"ransomware,":[151],"we":[152],"lay":[153],"groundwork":[155],"automated":[157],"behavior-based":[158],"detection":[159],"mechanisms":[160],"suited":[161],"environments.":[165]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":2}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}