{"id":"https://openalex.org/W2164281189","doi":"https://doi.org/10.1002/sec.1148","title":"Three\u2010phase behavior\u2010based detection and classification of known and unknown malware","display_name":"Three\u2010phase behavior\u2010based detection and classification of known and unknown malware","publication_year":2015,"publication_date":"2015-01-08","ids":{"openalex":"https://openalex.org/W2164281189","doi":"https://doi.org/10.1002/sec.1148","mag":"2164281189"},"language":"en","primary_location":{"is_oa":true,"landing_page_url":"https://doi.org/10.1002/sec.1148","pdf_url":null,"source":{"id":"https://openalex.org/S120683614","display_name":"Security and Communication Networks","issn_l":"1939-0122","issn":["1939-0122","1939-0114"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319869","host_organization_name":"Hindawi Publishing Corporation","host_organization_lineage":["https://openalex.org/P4310319869"],"host_organization_lineage_names":["Hindawi Publishing Corporation"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true},"type":"article","type_crossref":"journal-article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":"https://doi.org/10.1002/sec.1148","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5021844836","display_name":"Ying\u2010Dar Lin","orcid":"https://orcid.org/0000-0002-5226-4396"},"institutions":[{"id":"https://openalex.org/I148366613","display_name":"National Yang Ming Chiao Tung University","ror":"https://ror.org/00se2k293","country_code":"TW","type":"education","lineage":["https://openalex.org/I148366613"]}],"countries":["TW"],"is_corresponding":false,"raw_author_name":"Ying\u2010Dar Lin","raw_affiliation_strings":["Department of Computer Science National Chiao Tung University Hsinchu 300 Taiwan"],"affiliations":[{"raw_affiliation_string":"Department of Computer Science National Chiao Tung University Hsinchu 300 Taiwan","institution_ids":["https://openalex.org/I148366613"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5085347760","display_name":"Yuan\u2010Cheng Lai","orcid":"https://orcid.org/0000-0003-3695-5784"},"institutions":[{"id":"https://openalex.org/I154864474","display_name":"National Taiwan University of Science and Technology","ror":"https://ror.org/00q09pe49","country_code":"TW","type":"education","lineage":["https://openalex.org/I154864474"]}],"countries":["TW"],"is_corresponding":false,"raw_author_name":"Yuan\u2010Cheng Lai","raw_affiliation_strings":["Department of Information Management National Taiwan University of Science and Technology Taipei 106 Taiwan"],"affiliations":[{"raw_affiliation_string":"Department of Information Management National Taiwan University of Science and Technology Taipei 106 Taiwan","institution_ids":["https://openalex.org/I154864474"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5047408130","display_name":"Chun\u2010Nan Lu","orcid":null},"institutions":[{"id":"https://openalex.org/I148366613","display_name":"National Yang Ming Chiao Tung University","ror":"https://ror.org/00se2k293","country_code":"TW","type":"education","lineage":["https://openalex.org/I148366613"]}],"countries":["TW"],"is_corresponding":false,"raw_author_name":"Chun\u2010Nan Lu","raw_affiliation_strings":["Department of Computer Science National Chiao Tung University Hsinchu 300 Taiwan"],"affiliations":[{"raw_affiliation_string":"Department of Computer Science National Chiao Tung University Hsinchu 300 Taiwan","institution_ids":["https://openalex.org/I148366613"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5111983896","display_name":"P.-L. Hsu","orcid":null},"institutions":[{"id":"https://openalex.org/I148366613","display_name":"National Yang Ming Chiao Tung University","ror":"https://ror.org/00se2k293","country_code":"TW","type":"education","lineage":["https://openalex.org/I148366613"]}],"countries":["TW"],"is_corresponding":false,"raw_author_name":"Peng\u2010Kai Hsu","raw_affiliation_strings":["Department of Computer Science National Chiao Tung University Hsinchu 300 Taiwan"],"affiliations":[{"raw_affiliation_string":"Department of Computer Science National Chiao Tung University Hsinchu 300 Taiwan","institution_ids":["https://openalex.org/I148366613"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5113696297","display_name":"Chia\u2010Yin Lee","orcid":null},"institutions":[{"id":"https://openalex.org/I148366613","display_name":"National Yang Ming Chiao Tung University","ror":"https://ror.org/00se2k293","country_code":"TW","type":"education","lineage":["https://openalex.org/I148366613"]}],"countries":["TW"],"is_corresponding":false,"raw_author_name":"Chia\u2010Yin Lee","raw_affiliation_strings":["Information & Communication Technology Laboratories National Chiao Tung University Hsinchu 300 Taiwan"],"affiliations":[{"raw_affiliation_string":"Information & Communication Technology Laboratories National Chiao Tung University Hsinchu 300 Taiwan","institution_ids":["https://openalex.org/I148366613"]}]}],"institution_assertions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":2100,"currency":"USD","value_usd":2100,"provenance":"doaj"},"apc_paid":null,"fwci":2.118,"has_fulltext":false,"cited_by_count":12,"citation_normalized_percentile":{"value":0.808537,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":87,"max":88},"biblio":{"volume":"8","issue":"11","first_page":"2004","last_page":"2015"},"is_retracted":false,"is_paratext":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9933,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.99,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[],"concepts":[{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.8760667},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.83843344},{"id":"https://openalex.org/C94915269","wikidata":"https://www.wikidata.org/wiki/Q1834857","display_name":"Detector","level":2,"score":0.6270555},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.6176347},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.4908672},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.46061563},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.44092953},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.36305237},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.13467094},{"id":"https://openalex.org/C76155785","wikidata":"https://www.wikidata.org/wiki/Q418","display_name":"Telecommunications","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"is_oa":true,"landing_page_url":"https://doi.org/10.1002/sec.1148","pdf_url":null,"source":{"id":"https://openalex.org/S120683614","display_name":"Security and Communication Networks","issn_l":"1939-0122","issn":["1939-0122","1939-0114"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319869","host_organization_name":"Hindawi Publishing Corporation","host_organization_lineage":["https://openalex.org/P4310319869"],"host_organization_lineage_names":["Hindawi Publishing Corporation"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true}],"best_oa_location":{"is_oa":true,"landing_page_url":"https://doi.org/10.1002/sec.1148","pdf_url":null,"source":{"id":"https://openalex.org/S120683614","display_name":"Security and Communication Networks","issn_l":"1939-0122","issn":["1939-0122","1939-0114"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319869","host_organization_name":"Hindawi Publishing Corporation","host_organization_lineage":["https://openalex.org/P4310319869"],"host_organization_lineage_names":["Hindawi Publishing Corporation"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true},"sustainable_development_goals":[],"grants":[],"datasets":[],"versions":[],"referenced_works_count":15,"referenced_works":["https://openalex.org/W1532325895","https://openalex.org/W1608194207","https://openalex.org/W1984350393","https://openalex.org/W2054719909","https://openalex.org/W2072772765","https://openalex.org/W2090061444","https://openalex.org/W2106649514","https://openalex.org/W2117030266","https://openalex.org/W2123978999","https://openalex.org/W2128217000","https://openalex.org/W2129860818","https://openalex.org/W2131332603","https://openalex.org/W2395759032","https://openalex.org/W2539582590","https://openalex.org/W4213009331"],"related_works":["https://openalex.org/W4316881845","https://openalex.org/W4284893819","https://openalex.org/W3152891574","https://openalex.org/W2772446090","https://openalex.org/W2753240997","https://openalex.org/W2740895074","https://openalex.org/W2537959205","https://openalex.org/W2249809453","https://openalex.org/W2097492617","https://openalex.org/W1764168690"],"abstract_inverted_index":{"Abstract":[0],"To":[1],"improve":[2],"both":[3],"accuracy":[4,160],"and":[5,10,21,48,89,116,139,145],"efficiency":[6],"in":[7,28,39,52,66,142,147],"detecting":[8],"known":[9],"even":[11],"unknown":[12],"malware,":[13],"we":[14,111],"propose":[15],"a":[16,25,36,50,67,75,99],"three\u2010phase":[17],"behavior\u2010based":[18],"malware":[19,59,113,157],"detection":[20,133],"classification":[22],"approach,":[23],"with":[24,158],"faster":[26,62],"detector":[27,38,63,87],"the":[29,40,53,85,91,108,118,123,130,136,155],"first":[30],"phase":[31,42,55],"to":[32,43,56,69,80,103,121],"filter":[33],"most":[34],"samples,":[35,47],"slower":[37,86],"second":[41],"observe":[44],"remaining":[45],"ambiguous":[46],"then":[49],"classifier":[51,152],"third":[54,109],"recognize":[57],"their":[58,82,105],"type.":[60],"The":[61,125,150],"executes":[64],"programs":[65],"sandbox":[68],"extract":[70],"representative":[71],"behaviors":[72],"fed":[73,97],"into":[74,98],"trained":[76,100],"artificial":[77],"neural":[78],"network":[79],"evaluate":[81],"maliciousness,":[83],"whereas":[84],"extracts":[88],"matches":[90],"LCSs":[92],"of":[93,161],"system":[94],"call":[95],"sequences":[96],"Bayesian":[101],"model":[102],"calculate":[104,117],"maliciousness.":[106],"In":[107],"phase,":[110],"define":[112],"behavior":[114],"vectors":[115],"cosine":[119],"similarity":[120],"classify":[122],"malware.":[124],"experimental":[126],"results":[127],"show":[128],"that":[129],"hybrid":[131],"two\u2010phase":[132],"scheme":[134],"outperforms":[135],"one\u2010phase":[137],"schemes":[138],"achieves":[140],"3.6%":[141],"false":[143,148],"negative":[144],"6.8%":[146],"positive.":[149],"third\u2010phase":[151],"also":[153],"distinguishes":[154],"known\u2010type":[156],"an":[159],"85.8%.":[162],"Copyright":[163],"\u00a9":[164],"2015":[165],"John":[166],"Wiley":[167],"&":[168],"Sons,":[169],"Ltd.":[170]},"cited_by_api_url":"https://api.openalex.org/works?filter=cites:W2164281189","counts_by_year":[{"year":2022,"cited_by_count":1},{"year":2020,"cited_by_count":1},{"year":2019,"cited_by_count":2},{"year":2018,"cited_by_count":2},{"year":2017,"cited_by_count":2},{"year":2016,"cited_by_count":4}],"updated_date":"2024-12-09T04:26:10.757118","created_date":"2016-06-24"}