Publications

Publications by HASLab

2023

idDL2DL - Interval Syntax to dL

Authors
Santos, J; Figueiredo, D; Madeira, A;

Publication
Theoretical Aspects of Software Engineering - 17th International Symposium, TASE 2023, Bristol, UK, July 4-6, 2023, Proceedings

Abstract

2023

Recent Trends in Algebraic Development Techniques - 26th IFIP WG 1.3 International Workshop, WADT 2022, Aveiro, Portugal, June 28-30, 2022, Revised Selected Papers

Authors
Madeira, A; Martins, MA;

Publication
WADT

Abstract

2023

idDL2DL – Interval Syntax to $$d\mathcal {L}$$

Authors
Santos, J; Figueiredo, D; Madeira, A;

Publication
Theoretical Aspects of Software Engineering - Lecture Notes in Computer Science

Abstract

2023

Distributed Applications and Interoperable Systems - 23rd IFIP WG 6.1 International Conference, DAIS 2023, Held as Part of the 18th International Federated Conference on Distributed Computing Techniques, DisCoTec 2023, Lisbon, Portugal, June 19-23, 2023, Proceedings

Authors
Martínez, MP; Paulo, J;

Publication
DAIS

Abstract

2023

Diagnosing applications' I/O behavior through system call observability

Authors
Esteves, T; Macedo, R; Oliveira, R; Paulo, J;

Publication
CoRR

Abstract

2023

CRIBA: A Tool for Comprehensive Analysis of Cryptographic Ransomware's I/O Behavior

Authors
Esteves, T; Pereira, B; Oliveira, RP; Marco, J; Paulo, J;

Publication
2023 42ND INTERNATIONAL SYMPOSIUM ON RELIABLE DISTRIBUTED SYSTEMS, SRDS 2023

Abstract
Cryptographic ransomware attacks are constantly evolving by obfuscating their distinctive features (e.g., I/O patterns) to bypass detection mechanisms and to run unnoticed at infected servers. Thus, efficiently exploring the I/O behavior of ransomware families is crucial so that security analysts and engineers can better understand these and, with such knowledge, enhance existing detection methods. In this paper, we propose CRIBA, an open-source framework that simplifies the exploration, analysis, and comparison of I/O patterns for Linux cryptographic ransomware. Our solution combines the collection of comprehensive information about system calls issued by ransomware samples, with a customizable and automated analysis and visualization pipeline, including tailored correlation algorithms and visualizations. Our study, including 5 Linux ransomware families, shows that CRIBA provides comprehensive insights about the I/O patterns of these attacks while aiding in exploring common and differentiating traits across families.

CloseRead Abstract