Published November 30, 2024 | Version v1
Software Open

Detecting Ransomware Despite I/O Overhead: A Practical Multi-Staged Approach

Creators

  • 1. ROR icon RWTH Aachen University
  • 2. Cyber Analysis & Defense, Fraunhofer FKIE

Description

This artifact contains the code to reproduce the experiments for the NDSS'25 paper: Detecting Ransomware Despite I/O Overhead: A Practical Multi-Staged Approach. The paper's results were obtained by running on a Windows 11 22H2 Pro machine equipped with a SATA SSD and this repository provides instructions to run the benchmarks on real hardware.

A pre-compiled version of the driver is contained in IRPLogger_compiled_amd64.zip.

Files

ndss25_764_artifacts.zip

Files (747.5 MB)

Name Size Download all
md5:2444fadeae7e46e7024d2f9ba6654aba
43.9 kB Preview Download
md5:035c5a9b2c53a17a7e738c62446fb274
747.5 MB Preview Download

Additional details

Software

Programming language
Python, C++, Jupyter Notebook