{"id":"https://openalex.org/W4411523089","doi":"https://doi.org/10.1145/3728880","title":"Preventing Disruption of System Backup against Ransomware Attacks","display_name":"Preventing Disruption of System Backup against Ransomware Attacks","publication_year":2025,"publication_date":"2025-06-22","ids":{"openalex":"https://openalex.org/W4411523089","doi":"https://doi.org/10.1145/3728880"},"language":"en","primary_location":{"id":"doi:10.1145/3728880","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3728880","pdf_url":null,"source":{"id":"https://openalex.org/S4404663975","display_name":"Proceedings of the ACM on software engineering.","issn_l":"2994-970X","issn":["2994-970X"],"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by-nc","license_id":"https://openalex.org/licenses/cc-by-nc","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM on Software Engineering","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1145/3728880","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5101807623","display_name":"Yiwei Thomas Hou","orcid":"https://orcid.org/0009-0007-5808-9553"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yiwei Hou","raw_affiliation_strings":["Tsinghua University, Beijing, China"],"raw_orcid":"https://orcid.org/0009-0007-5808-9553","affiliations":[{"raw_affiliation_string":"Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101908065","display_name":"Lihua Guo","orcid":"https://orcid.org/0000-0002-4336-7190"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Lihua Guo","raw_affiliation_strings":["Tsinghua University, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-4336-7190","affiliations":[{"raw_affiliation_string":"Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5004909890","display_name":"Chijin Zhou","orcid":"https://orcid.org/0000-0002-6446-247X"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Chijin Zhou","raw_affiliation_strings":["Tsinghua University, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-6446-247X","affiliations":[{"raw_affiliation_string":"Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100406666","display_name":"Quan Zhang","orcid":"https://orcid.org/0000-0001-7778-4243"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Quan Zhang","raw_affiliation_strings":["Tsinghua University, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0001-7778-4243","affiliations":[{"raw_affiliation_string":"Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5025720770","display_name":"Wenhuan Liu","orcid":"https://orcid.org/0000-0002-0450-3591"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Wenhuan Liu","raw_affiliation_strings":["Tsinghua University, Beijing, China","UnionTech, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-0450-3591","affiliations":[{"raw_affiliation_string":"Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]},{"raw_affiliation_string":"UnionTech, Beijing, China","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101708632","display_name":"C. P. Sun","orcid":"https://orcid.org/0000-0002-0862-2491"},"institutions":[{"id":"https://openalex.org/I151746483","display_name":"University of Waterloo","ror":"https://ror.org/01aff2v68","country_code":"CA","type":"education","lineage":["https://openalex.org/I151746483"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Chengnian Sun","raw_affiliation_strings":["University of Waterloo, Waterloo, Canada"],"raw_orcid":"https://orcid.org/0000-0002-0862-2491","affiliations":[{"raw_affiliation_string":"University of Waterloo, Waterloo, Canada","institution_ids":["https://openalex.org/I151746483"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5060117799","display_name":"Yu Jiang","orcid":"https://orcid.org/0000-0003-0955-503X"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yu Jiang","raw_affiliation_strings":["Tsinghua University, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0003-0955-503X","affiliations":[{"raw_affiliation_string":"Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.9024,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":{"value":0.72853515,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":"2","issue":"ISSTA","first_page":"229","last_page":"249"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9965000152587891,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9939000010490417,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/ransomware","display_name":"Ransomware","score":0.9879964590072632},{"id":"https://openalex.org/keywords/backup","display_name":"Backup","score":0.7521591186523438},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6768364310264587},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.5930889844894409},{"id":"https://openalex.org/keywords/encryption","display_name":"Encryption","score":0.43900173902511597},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.36009010672569275},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.20647573471069336}],"concepts":[{"id":"https://openalex.org/C2777667771","wikidata":"https://www.wikidata.org/wiki/Q926331","display_name":"Ransomware","level":3,"score":0.9879964590072632},{"id":"https://openalex.org/C2780945871","wikidata":"https://www.wikidata.org/wiki/Q194274","display_name":"Backup","level":2,"score":0.7521591186523438},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6768364310264587},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5930889844894409},{"id":"https://openalex.org/C148730421","wikidata":"https://www.wikidata.org/wiki/Q141090","display_name":"Encryption","level":2,"score":0.43900173902511597},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.36009010672569275},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.20647573471069336}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3728880","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3728880","pdf_url":null,"source":{"id":"https://openalex.org/S4404663975","display_name":"Proceedings of the ACM on software engineering.","issn_l":"2994-970X","issn":["2994-970X"],"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by-nc","license_id":"https://openalex.org/licenses/cc-by-nc","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM on Software Engineering","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1145/3728880","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3728880","pdf_url":null,"source":{"id":"https://openalex.org/S4404663975","display_name":"Proceedings of the ACM on software engineering.","issn_l":"2994-970X","issn":["2994-970X"],"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by-nc","license_id":"https://openalex.org/licenses/cc-by-nc","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM on Software Engineering","raw_type":"journal-article"},"sustainable_development_goals":[{"display_name":"Life in Land","id":"https://metadata.un.org/sdg/15","score":0.4099999964237213}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":23,"referenced_works":["https://openalex.org/W2213728018","https://openalex.org/W2559964890","https://openalex.org/W2601591992","https://openalex.org/W2734941459","https://openalex.org/W2752929869","https://openalex.org/W2784113120","https://openalex.org/W2945824389","https://openalex.org/W3039743997","https://openalex.org/W3047892252","https://openalex.org/W3132588576","https://openalex.org/W3184269725","https://openalex.org/W3208935820","https://openalex.org/W4214563588","https://openalex.org/W4285212536","https://openalex.org/W4288760578","https://openalex.org/W4308480022","https://openalex.org/W4315746341","https://openalex.org/W4315925974","https://openalex.org/W4318189316","https://openalex.org/W4353004773","https://openalex.org/W4380990032","https://openalex.org/W4388867283","https://openalex.org/W4399412863"],"related_works":["https://openalex.org/W3201228709","https://openalex.org/W2955195711","https://openalex.org/W2922354075","https://openalex.org/W4389157351","https://openalex.org/W4232561318","https://openalex.org/W3202245533","https://openalex.org/W4253977752","https://openalex.org/W2942879794","https://openalex.org/W2964829536","https://openalex.org/W2904586340"],"abstract_inverted_index":{"The":[0],"ransomware":[1,17,38,65,75,120,129,145,153],"threat":[2],"to":[3,22,35,83,93,112,138],"the":[4,97,107,156],"software":[5],"ecosystem":[6],"has":[7,148],"grown":[8],"rapidly":[9],"in":[10,55,135,155],"recent":[11,128],"years.":[12],"Despite":[13],"being":[14],"well-studied,":[15],"new":[16,33],"variants":[18],"continually":[19],"emerge,":[20],"designed":[21,111],"evade":[23],"existing":[24],"encryption-based":[25],"detection":[26],"mechanisms.":[27],"This":[28],"paper":[29],"introduces":[30],"Remembrall,":[31],"a":[32,68,80],"perspective":[34],"defend":[36],"against":[37],"by":[39],"monitoring":[40],"and":[41,62,102,117],"preventing":[42],"system":[43,114],"backup":[44],"disruptions.":[45],"Focusing":[46],"on":[47,106,127],"deletion":[48],"actions":[49,88],"of":[50],"volume":[51],"shadow":[52],"copies":[53],"(VSC)":[54],"Windows,":[56],"Remembrall":[57,109,126,131,147],"captures":[58],"related":[59],"malicious":[60],"events":[61],"identifies":[63],"all":[64,85],"traces":[66],"as":[67],"real-time":[69],"defense":[70],"tool.":[71],"To":[72],"ensure":[73],"no":[74],"is":[76,110],"missing,":[77],"we":[78],"conduct":[79],"comprehensive":[81],"investigation":[82],"classify":[84],"potential":[86],"attack":[87],"that":[89],"can":[90],"be":[91],"used":[92],"delete":[94],"VSCs":[95],"throughout":[96],"application":[98],"layer,":[99,101],"OS":[100],"hardware":[103],"layer.":[104],"Based":[105],"analysis,":[108],"retrieve":[113],"event":[115],"information":[116],"accurately":[118],"identify":[119],"without":[121],"false":[122],"negatives.":[123],"We":[124],"evaluate":[125],"samples.":[130],"achieves":[132],"4.31%-87.55%":[133],"increase":[134],"F1-score":[136],"compared":[137],"other":[139],"state-of-the-art":[140],"anti-ransomware":[141],"tools":[142],"across":[143],"60":[144],"families.":[146],"also":[149],"detected":[150],"eight":[151],"zero-day":[152],"samples":[154],"experiment.":[157]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-05-21T06:26:12.895304","created_date":"2025-10-10T00:00:00"}