Demo Data from VLDB 2026 / reviewers in the wild / expert
Ran Feraru
dblp:399/7653
· DBLP profile ↗
1ranked-venue papers
0as first author
1since 2021 · last 2025
—ORCID · none
Domains — the database's venue-derived domains; a paper can count in several
Artificial intelligence and machine learning · 1 · 1 since 2021
Expertise — from the expertise taxonomy: the topics of the expert's papers under the CCF categories. A weight counts papers with recency: 1 for a paper about the topic, 0.3 when the topic is its context, halved every five years.
| Computer architecture, parallel and distributed computing, and storage systems
1 paper |
Storage systems · 100% | |
| Network and information security
1 paper |
Malware analysis · 100% |
Topics — the 4 heaviest of 4, each with the papers that count most for it
| Topic | Weight | Papers | Last | Evidence papers |
|---|---|---|---|---|
Malware analysis › ransomware
ransomware detection |
0.9 | 1 | 2025 | CLEAR: Command Level Annotated Dataset for Ransomware Detection · NeurIPS 2025 |
Storage systems › storage reliability
data recovery |
0.9 | 1 | 2025 | CLEAR: Command Level Annotated Dataset for Ransomware Detection · NeurIPS 2025 |
Storage systems
storage reliability |
0.9 | 1 | 2025 | CLEAR: Command Level Annotated Dataset for Ransomware Detection · NeurIPS 2025 |
Malware analysis
ransomware |
0.3 | 1 | 2025 | CLEAR: Command Level Annotated Dataset for Ransomware Detection · NeurIPS 2025 |
Methods — techniques the papers use, named apart from their topics
sequential model · 1.7
| Year | Publication | Venue | Position |
|---|---|---|---|
| 2025 | CLEAR: Command Level Annotated Dataset for Ransomware DetectionabstractOver the last decade, ransomware detection has become a central topic in cybersecurity research. Due to ransomware's direct interaction with storage devices, analyzing I/O streams has become an effective detection method and represents a vital area of focus for research. A major challenge in this field is the lack of publicly accessible data featuring individual command labeling. To address this problem, we introduce the Command LEvel Annotated Ransomware (CLEAR) dataset, a large-scale collection of storage devices' stream data. The dataset comprises 1,045 TiB of I/O traffic data, featuring malicious traffic from 137 ransomware variants. It offers two orders of magnitude more I/O traffic data and one order of magnitude more ransomware variants than any other publicly accessible dataset. Importantly, it is the only dataset that individually labels each I/O command as either ransomware or benign activity. This labeling enables the use of advanced sequential models, which we show to outperform existing state-of-the-art models by up to 82% in data loss prevention. Additionally, this allows us to create new tasks, such as data recovery, by selectively reverting only the commands recognized as ransomware while preserving benign activity. The CLEAR dataset also includes supplementary auxiliary features derived from the data, which we demonstrate to improve performance through feature ablation studies. Lastly, a critical aspect of any ransomware detection model is its robustness to new, unseen ransomware variants, as new strains constantly emerge. Therefore, we propose a benchmark based on our dataset to evaluate performance against unknown ransomware samples and illustrate its application across different models. Barak Bringoltz, Elisha Halperin, Ran Feraru, Evgeny Blaichman, Amit Berman |
NeurIPS | 3 |