{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,2,21]],"date-time":"2025-02-21T21:21:46Z","timestamp":1740172906252,"version":"3.37.3"},"reference-count":41,"publisher":"Springer Science and Business Media LLC","issue":"4","license":[{"start":{"date-parts":[[2022,6,15]],"date-time":"2022-06-15T00:00:00Z","timestamp":1655251200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"},{"start":{"date-parts":[[2022,6,15]],"date-time":"2022-06-15T00:00:00Z","timestamp":1655251200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"}],"funder":[{"DOI":"10.13039\/501100003447","name":"State Scholarships Foundation","doi-asserted-by":"publisher","award":["MIS-5033021"],"id":[{"id":"10.13039\/501100003447","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["J Comput Virol Hack Tech"],"DOI":"10.1007\/s11416-022-00423-4","type":"journal-article","created":{"date-parts":[[2022,6,15]],"date-time":"2022-06-15T14:02:56Z","timestamp":1655301776000},"page":"383-406","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["Behavior-based detection and classification of malicious software utilizing structural characteristics of group sequence graphs"],"prefix":"10.1007","volume":"18","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-6684-8459","authenticated-orcid":false,"given":"Stavros D.","family":"Nikolopoulos","sequence":"first","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6427-5519","authenticated-orcid":false,"given":"Iosif","family":"Polenakis","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2022,6,15]]},"reference":[{"key":"423_CR1","doi-asserted-by":"crossref","unstructured":"Babic, D., Reynaud, D., Song, D.: Malware analysis with tree automata inference. In: Proceedings of the 23rd International Conference on Computer Aided Verification (CAV\u201911), pp. 116\u2013131 (2011)","DOI":"10.1007\/978-3-642-22110-1_10"},{"key":"423_CR2","doi-asserted-by":"crossref","unstructured":"Bastian, M., Heymann, S., Jacomy, M.: Gephi: an open source software for exploring and manipulating networks. In: Third International AAAI Conference on weblogs and Social Media (2009)","DOI":"10.1609\/icwsm.v3i1.13937"},{"key":"423_CR3","doi-asserted-by":"crossref","unstructured":"Canzanese, R., Kam, M., Mancoridis, S.: Toward an automatic, online behavioral malware classification system. In: 2013 IEEE 7th International Conference on Self-Adaptive and Self-Organizing Systems, pp. 111\u2013120. IEEE (2013)","DOI":"10.1109\/SASO.2013.8"},{"key":"423_CR4","doi-asserted-by":"crossref","unstructured":"Chaumette, S., Ly, O., Tabary, R.: Automated extraction of polymorphic virus signatures using abstract interpretation. In: 2011 5th International Conference on IEEE Network and System Security (NSS) (2011)","DOI":"10.1109\/ICNSS.2011.6059958"},{"key":"423_CR5","doi-asserted-by":"crossref","unstructured":"Chysi, A., Nikolopoulos, S.D., Polenakis, I.: An algorithmic framework for malicious software detection exploring structural characteristics of behavioral graphs. In: Proceedings of the 21st International Conference on Computer Systems and Technologies\u2019 20, pp. 43\u201350","DOI":"10.1145\/3407982.3408022"},{"key":"423_CR6","doi-asserted-by":"crossref","unstructured":"Christodorescu, M., Jha, S., Seshia, A., Song, D., Bryant, R.E.: Semantics-aware malware detection. In: 2005 IEEE Symposium on Security and Privacy (S &P\u201905) (2005)","DOI":"10.1109\/SP.2005.20"},{"key":"423_CR7","doi-asserted-by":"crossref","unstructured":"Christodorescu, M., Jha, S., Kruegel, C.: Mining specifications of malicious behavior. In: Proceedings of the 6th Joint Meeting of the European Software Engineering Conference and the ACM SIGSOFT Symposium on the Foundations of Software Engineering (2007)","DOI":"10.1145\/1287624.1287628"},{"key":"423_CR8","doi-asserted-by":"publisher","first-page":"73","DOI":"10.1016\/j.cose.2017.10.007","volume":"73","author":"Y Ding","year":"2018","unstructured":"Ding, Y., Xia, X., Chen, S., Li, Y.: A Malware detection method based on family behavior graph. Comput. Secur. 73, 73\u201386 (2018)","journal-title":"Comput. Secur."},{"issue":"3","key":"423_CR9","doi-asserted-by":"publisher","first-page":"177","DOI":"10.1007\/s11416-019-00330-1","volume":"15","author":"R Eskandari","year":"2019","unstructured":"Eskandari, R., Shajari, M., Ghahfarokhi, M.M.: ERES: an extended regular expression signature for polymorphic worm detection. J. Comput. Virol. Hack. Tech. 15(3), 177\u2013194 (2019)","journal-title":"J. Comput. Virol. Hack. Tech."},{"key":"423_CR10","doi-asserted-by":"crossref","unstructured":"Fredrikson, M., Jha, S., Christodorescu, M., Sailer, R., Yan, X.: Synthesizing near-optimal malware specifications from suspicious behaviors. In: 2010 IEEE Symposium on IEEE Security and Privacy (SP), pp. 45\u201360 (2010)","DOI":"10.1109\/SP.2010.11"},{"key":"423_CR11","doi-asserted-by":"crossref","unstructured":"Garg, V., Yadav, R.K.: Malware detection based on API calls frequency. In: 2019 4th International Conference on Information Systems and Computer Networks (ISCON), pp. 400\u2013404. IEEE (2019)","DOI":"10.1109\/ISCON47742.2019.9036219"},{"issue":"3","key":"423_CR12","doi-asserted-by":"publisher","first-page":"153","DOI":"10.1007\/s11416-016-0278-y","volume":"13","author":"H Hashemi","year":"2017","unstructured":"Hashemi, H., Azmoodeh, A., Hamzeh, A., Hashemi, S.: Graph embedding as a new approach for unknown malware detection. J. Comput. Virol. Hack. Tech. 13(3), 153\u2013166 (2017)","journal-title":"J. Comput. Virol. Hack. Tech."},{"issue":"1","key":"423_CR13","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1007\/s11416-018-0314-1","volume":"15","author":"H Hashemi","year":"2019","unstructured":"Hashemi, H., Hamzeh, A.: Visual malware detection using local malicious pattern. J. Comput. Virol. Hack. Tech. 15(1), 1\u201314 (2019)","journal-title":"J. Comput. Virol. Hack. Tech."},{"key":"423_CR14","doi-asserted-by":"crossref","unstructured":"Hassen, M., Chan, P.K.: Scalable function call graph-based malware classification. In: Proceedings of the Seventh ACM on Conference on Data and Application Security and Privacy, pp. 239\u2013248. ACM (2017)","DOI":"10.1145\/3029806.3029824"},{"key":"423_CR15","doi-asserted-by":"crossref","unstructured":"Hu, X., Chiueh, T., Shin, K.G.: Large-scale malware indexing using function-call graphs. In: Proceedings of the 16th ACM Conference on Computer and Communications Security (CCS\u201909), pp. 611\u2013620 (2009)","DOI":"10.1145\/1653662.1653736"},{"key":"423_CR16","doi-asserted-by":"crossref","unstructured":"John, T.S., Thomas, T., Emmanuel, S.: Graph convolutional networks for android malware detection with system call graphs. In: ISEA Conference on Security and Privacy (ISEA-ISAP), pp. 162\u2013170. IEEE (2020)","DOI":"10.1109\/ISEA-ISAP49340.2020.235015"},{"issue":"1\u20132","key":"423_CR17","doi-asserted-by":"publisher","first-page":"13","DOI":"10.1007\/s11416-005-0002-9","volume":"1","author":"ME Karim","year":"2005","unstructured":"Karim, M.E., Walenstein, A., Lakhotia, A., Parida, L.: Malware phylogeny generation using permutations of code. J. Comput. Virol. 1(1\u20132), 13\u201323 (2005)","journal-title":"J. Comput. Virol."},{"issue":"1","key":"423_CR18","doi-asserted-by":"publisher","first-page":"921","DOI":"10.1007\/s10586-017-1110-2","volume":"22","author":"H Kim","year":"2019","unstructured":"Kim, H., Kim, J., Kim, Y., Kim, I., Kim, K.J., Kim, H.: Improvement of malware detection and classification using API call sequence alignment and visualization. Clust. Comput. 22(1), 921\u2013929 (2019)","journal-title":"Clust. Comput."},{"issue":"3","key":"423_CR19","doi-asserted-by":"publisher","first-page":"225","DOI":"10.1007\/s11416-017-0309-3","volume":"14","author":"AV Kozachok","year":"2018","unstructured":"Kozachok, A.V., Kozachok, V.I.: Construction and evaluation of the new heuristic malware detection mechanism based on executable files static analysis. J. Comput. Virol. Hack. Tech. 14(3), 225\u2013231 (2018)","journal-title":"J. Comput. Virol. Hack. Tech."},{"key":"423_CR20","first-page":"22","volume":"3","author":"K Mathur","year":"2013","unstructured":"Mathur, K., Hiranwal, S.: A survey on techniques in detection and analyzing malware executables. J. Adv. Res. Comput. Sci. Softw. Eng. 3, 22\u2013428 (2013)","journal-title":"J. Adv. Res. Comput. Sci. Softw. Eng."},{"key":"423_CR21","doi-asserted-by":"crossref","unstructured":"Makandar, A., Patrot, A.: Trojan malware image pattern classification. In: Proceedings of International Conference on Cognition and Recognition, pp. 253\u2013262. Springer, Singapore (2018)","DOI":"10.1007\/978-981-10-5146-3_24"},{"issue":"3","key":"423_CR22","doi-asserted-by":"publisher","first-page":"167","DOI":"10.1007\/s11416-016-0279-x","volume":"13","author":"J Ming","year":"2017","unstructured":"Ming, J., Xu, D., Wu, D.: MalwareHunt: semantics-based malware diffing speedup by normalized basic block memoization. J. Comput. Virol. Hack. Tech. 13(3), 167\u2013178 (2017)","journal-title":"J. Comput. Virol. Hack. Tech."},{"key":"423_CR23","doi-asserted-by":"crossref","unstructured":"Mohaisen, A., West, A.G., Mankin, A., Alrawi, O.: Chatter: classifying malware families using system event ordering. In: 2014 IEEE Conference on Communications and Network Security, pp. 283\u2013291. IEEE (2014)","DOI":"10.1109\/CNS.2014.6997496"},{"key":"423_CR24","doi-asserted-by":"crossref","unstructured":"Mukesh, S.D., Raval, J.A., Upadhyay, H.: Real-time framework for malware detection using machine learning technique. In: International Conference on Information and Communication Technology for Intelligent Systems, pp. 173\u2013182. Springer, Cham (2017)","DOI":"10.1007\/978-3-319-63673-3_21"},{"key":"423_CR25","unstructured":"Newsome, J., Song, D.: Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software. In: Proceedings of the 12th Annual Network and Distributed System Security Symposium (NDSS05) (2005)"},{"key":"423_CR26","doi-asserted-by":"crossref","unstructured":"Nikolopoulos, S.D., Polenakis, I.: A graph-based model for malicious code detection exploiting dependencies of system-call groups. In: Proceedings of the 16th International Conference on Computer Systems and Technologies, pp. 228\u2013235 (2015)","DOI":"10.1145\/2812428.2812432"},{"issue":"1","key":"423_CR27","doi-asserted-by":"publisher","first-page":"29","DOI":"10.1007\/s11416-016-0267-1","volume":"13","author":"SD Nikolopoulos","year":"2017","unstructured":"Nikolopoulos, S.D., Polenakis, I.: A graph-based model for malware detection and classification using system-call groups. J. Comput. Virol. Hack. Tech. 13(1), 29\u201346 (2017)","journal-title":"J. Comput. Virol. Hack. Tech."},{"key":"423_CR28","doi-asserted-by":"crossref","unstructured":"Mpanti, A., Nikolopoulos, S.D., Polenakis, I.: A graph-based model for malicious software detection exploiting domination relations between system-call groups. In: Proceedings of the 19th International Conference on Computer Systems and Technologies, pp. 20\u201326 (2018)","DOI":"10.1145\/3274005.3274028"},{"key":"423_CR29","doi-asserted-by":"crossref","unstructured":"Rezaei, T., Hamze, A.: An efficient approach for malware detection using PE header specifications. In: 2020 6th International Conference on Web Research (ICWR), pp. 234\u2013239. IEEE (2020)","DOI":"10.1109\/ICWR49608.2020.9122312"},{"key":"423_CR30","doi-asserted-by":"crossref","unstructured":"Sami, A., Yadegari, B., Rahimi, H., Peiravian, N., Hashemi, S., Hamze, A.: Malware detection based on mining API calls. In: Proceedings of the 2010 ACM Symposium on Applied Computing, pp. 1020\u20131025 (2010)","DOI":"10.1145\/1774088.1774303"},{"key":"423_CR31","doi-asserted-by":"publisher","first-page":"101773","DOI":"10.1016\/j.cose.2020.101773","volume":"92","author":"J Suaboot","year":"2020","unstructured":"Suaboot, J., Tari, Z., Mahmood, A., Zomaya, A., Li, W.: Sub-curve HMM: a malware detection approach based on partial analysis of API call sequences. Comput. Secur. 92, 101773 (2020)","journal-title":"Comput. Secur."},{"key":"423_CR32","unstructured":"Szor, P., Ferrie, P.: Hunting for metamorphic. In: Virus Bulletin Conference (2001)"},{"key":"423_CR33","unstructured":"VirusTotal. https:\/\/www.virustotal.com\/gui\/home\/upload. Accessed Jan 2022"},{"key":"423_CR34","unstructured":"Walenstein, A., Lakhotia, A.: The software similarity problem in malware analysis. Internat. Begegnungs-und Forschungszentrum fur Informatik (2007)"},{"key":"423_CR35","doi-asserted-by":"crossref","unstructured":"W\u00fcchner, T., Ochoa, M., Pretschner, A.: Robust and effective malware detection through quantitative data flow graph metrics. In: International Conference on Detection of Intrusions and Malware and Vulnerability Assessment, pp. 98\u2013118. Springer, Cham (2015)","DOI":"10.1007\/978-3-319-20550-2_6"},{"key":"423_CR36","doi-asserted-by":"crossref","unstructured":"W\u00fcchner, T., Ochoa, M., Pretschner, A.: Malware detection with quantitative data flow graphs. In: Proceedings of the 9th ACM Symposium on Information, Computer and Communications Security, pp. 271\u2013282 (2014)","DOI":"10.1145\/2590296.2590319"},{"key":"423_CR37","doi-asserted-by":"crossref","unstructured":"Xiao, F., Lin, Z., Sun, Y., Ma, Y.: Malware detection based on deep learning of behavior graphs. Math. Probl. Eng. (2019)","DOI":"10.1155\/2019\/8195395"},{"key":"423_CR38","doi-asserted-by":"crossref","unstructured":"Xiao, F., Sun, Y., Du, D., Li, X., Luo, M.: A novel malware classification method based on crucial behaviour. Math. Probl. Eng. (2020)","DOI":"10.1155\/2020\/6804290"},{"key":"423_CR39","doi-asserted-by":"publisher","first-page":"35","DOI":"10.1007\/s11416-012-0175-y","volume":"56","author":"M Xu","year":"2013","unstructured":"Xu, M., Wu, L., Qi, S., Xu, J., Zhang, H., Ren, Y., Zheng, N.: A similarity metric method of obfuscated malware using function-call graph. J. Comput. Virol. Hack. Tech. 56, 35\u201347 (2013)","journal-title":"J. Comput. Virol. Hack. Tech."},{"key":"423_CR40","doi-asserted-by":"crossref","unstructured":"You, I., Yim, K.: Malware obfuscation techniques: a brief survey. In: Proceedings of the 5th International Conference on Broadband and Wireless Computing, Communication and Applications (BWCCA\u201910), pp. 297\u2013300 (2010)","DOI":"10.1109\/BWCCA.2010.85"},{"key":"423_CR41","doi-asserted-by":"crossref","unstructured":"Zhong, Y., Yamaki, H., Takakura, H.: A malware classification method based on similarity of function structure. In: 2012 IEEE\/IPSJ 12th International Symposium on Applications and the Internet, pp. 256\u2013261. IEEE (2012)","DOI":"10.1109\/SAINT.2012.48"}],"container-title":["Journal of Computer Virology and Hacking Techniques"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11416-022-00423-4.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s11416-022-00423-4\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11416-022-00423-4.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,9,26]],"date-time":"2024-09-26T23:51:11Z","timestamp":1727394671000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s11416-022-00423-4"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,6,15]]},"references-count":41,"journal-issue":{"issue":"4","published-online":{"date-parts":[[2022,12]]}},"alternative-id":["423"],"URL":"https:\/\/doi.org\/10.1007\/s11416-022-00423-4","relation":{},"ISSN":["2263-8733"],"issn-type":[{"type":"electronic","value":"2263-8733"}],"subject":[],"published":{"date-parts":[[2022,6,15]]},"assertion":[{"value":"25 September 2021","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"14 March 2022","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"15 June 2022","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"Not applicable.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}},{"value":"This research is co-financed by Greece and the European Union (European Social Fund-ESF) through the Operational Programme \u201cHuman Resources Development, Education and Lifelong Learning\u201d in the context of the project \u201cReinforcement of Postdoctoral Researchers\u20142nd Cycle\u201d (MIS-5033021), implemented by the State Scholarships Foundation (IKY).","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Funding"}}]}}