Published security research
Make the evidence reproducible.
I co-authored work on ransomware execution provenance, helping turn sandbox observations into reusable research evidence.
My role
I was a co-author in the LUMS and SRI International collaboration published at ACM CSET 2023.
Where it stands
Published team research. The repository documents the collection pipeline; the dataset is available separately.
What changed.
An open dataset and collection pipeline for reproducible ransomware analysis.
Why provenance
A process log records events. A provenance graph helps connect the processes, files and dependencies behind them. The research used those relationships to make ransomware behavior more inspectable and experiments more reproducible.
The team’s contribution
The project released sandboxed execution logs, inferred provenance graphs and orchestration code. I present this as a collaborative publication, not a system I built alone.
A restrained conclusion
The paper’s pilot evaluated signatures across a defined set of ransomware families and benign traces. That supports a scoped research result, not a claim that the technique detects all ransomware.
The stack
- Python
- SPADE
- Process Monitor
- Provenance graphs
- VirtualBox