{"id":"https://openalex.org/W109909280","doi":null,"title":"Impeding Malware Analysis Using Conditional Code Obfuscation","display_name":"Impeding Malware Analysis Using Conditional Code Obfuscation","publication_year":2008,"publication_date":"2008-02-01","ids":{"openalex":"https://openalex.org/W109909280","mag":"109909280"},"language":"en","primary_location":{"id":"pmh:oai:CiteSeerX.psu:10.1.1.110.2395","doi":null,"is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.110.2395","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://www-static.cc.gatech.edu/~giffin/papers/ndss08/SLG+08.pdf","raw_type":"text"},"volume":null,"type":"article","is_traditional":true,"indexed_in":[],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100800993","display_name":"Monirul I. Sharif","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Monirul I. Sharif","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5017862259","display_name":"Andrea Lanzi","orcid":"https://orcid.org/0000-0002-1544-3758","observed_orcids":["https://orcid.org/0000-0002-1544-3758"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Andrea Lanzi","raw_affiliation_strings":[],"raw_orcid":"https://orcid.org/0000-0002-1544-3758","affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5109033662","display_name":"Jonathon T. Giffin","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jonathon Giffin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5047140382","display_name":"Wenke Lee","orcid":"https://orcid.org/0000-0003-2761-1277","observed_orcids":["https://orcid.org/0000-0003-2761-1277","https://orcid.org/0000-0002-9984-6879"]},"institutions":[{"id":"https://openalex.org/I130701444","display_name":"Georgia Institute of Technology","ror":"https://ror.org/01zkghx44","country_code":"US","type":"education","lineage":["https://openalex.org/I130701444"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Wenke Lee","raw_affiliation_strings":["Georgia Institute of Technology, Atlanta, United States"],"raw_orcid":"https://orcid.org/0000-0003-2761-1277","affiliations":[{"raw_affiliation_string":"Georgia Institute of Technology, Atlanta, United States","institution_ids":["https://openalex.org/I130701444"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":22.5147,"has_fulltext":false,"cited_by_count":229,"citation_normalized_percentile":{"value":0.99546638,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":93,"max":100},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"13"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9829000234603882,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9829000234603882,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.016699999570846558,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware-obfuscation","display_name":"malware obfuscation","score":0.9269999861717224},{"id":"https://openalex.org/keywords/malware-analysis","display_name":"malware analysis","score":0.7889999747276306},{"id":"https://openalex.org/keywords/code-encryption","display_name":"code encryption","score":0.6779999732971191},{"id":"https://openalex.org/keywords/dynamic-key-generation","display_name":"dynamic key generation","score":0.5360000133514404},{"id":"https://openalex.org/keywords/malware-evasion","display_name":"malware evasion","score":0.3100000023841858}],"concepts":[{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.9291291236877441},{"id":"https://openalex.org/C40305131","wikidata":"https://www.wikidata.org/wiki/Q2616305","display_name":"Obfuscation","level":2,"score":0.9279909133911133},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8758495450019836},{"id":"https://openalex.org/C84525096","wikidata":"https://www.wikidata.org/wiki/Q3506050","display_name":"Cryptovirology","level":3,"score":0.8001443147659302},{"id":"https://openalex.org/C2779395397","wikidata":"https://www.wikidata.org/wiki/Q15731404","display_name":"Malware analysis","level":3,"score":0.6610430479049683},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.5426770448684692},{"id":"https://openalex.org/C169590947","wikidata":"https://www.wikidata.org/wiki/Q47506","display_name":"Compiler","level":2,"score":0.5151897668838501},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.5116224884986877},{"id":"https://openalex.org/C2779639559","wikidata":"https://www.wikidata.org/wiki/Q7661178","display_name":"Symbolic execution","level":3,"score":0.5066174268722534},{"id":"https://openalex.org/C137287247","wikidata":"https://www.wikidata.org/wiki/Q1329550","display_name":"Static program analysis","level":4,"score":0.4856337606906891},{"id":"https://openalex.org/C207850805","wikidata":"https://www.wikidata.org/wiki/Q269608","display_name":"Reverse engineering","level":2,"score":0.4706403911113739},{"id":"https://openalex.org/C148730421","wikidata":"https://www.wikidata.org/wiki/Q141090","display_name":"Encryption","level":2,"score":0.4696615934371948},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.4659116566181183},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.44856026768684387},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.41017934679985046},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.36335983872413635},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.32052817940711975},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.19123193621635437},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.12911087274551392},{"id":"https://openalex.org/C529173508","wikidata":"https://www.wikidata.org/wiki/Q638608","display_name":"Software development","level":3,"score":0.08820194005966187}],"mesh":[],"locations_count":3,"locations":[{"id":"pmh:oai:CiteSeerX.psu:10.1.1.110.2395","doi":null,"is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.110.2395","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://www-static.cc.gatech.edu/~giffin/papers/ndss08/SLG+08.pdf","raw_type":"text"},{"id":"pmh:oai:CiteSeerX.psu:10.1.1.126.9256","doi":null,"is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.126.9256","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://www.isoc.org/isoc/conferences/ndss/08/papers/19_impeding_malware_analysis.pdf","raw_type":"text"},{"id":"mag:109909280","doi":null,"is_oa":false,"landing_page_url":"http://iseclab.org/people/andrew/download/NDSS08.pdf","pdf_url":null,"source":{"id":"https://openalex.org/S4306420590","display_name":"Network and Distributed System Security Symposium","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":"Network and Distributed System Security Symposium","raw_type":null}],"best_oa_location":null,"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":27,"referenced_works":["https://openalex.org/W1503224444","https://openalex.org/W1544837488","https://openalex.org/W1551162551","https://openalex.org/W1552906779","https://openalex.org/W1567046609","https://openalex.org/W1595564425","https://openalex.org/W2060145807","https://openalex.org/W2060389212","https://openalex.org/W2083477206","https://openalex.org/W2096921767","https://openalex.org/W2101077503","https://openalex.org/W2106899448","https://openalex.org/W2117030266","https://openalex.org/W2126734536","https://openalex.org/W2126851641","https://openalex.org/W2131523719","https://openalex.org/W2132897303","https://openalex.org/W2144344516","https://openalex.org/W2145083214","https://openalex.org/W2152313002","https://openalex.org/W2153185479","https://openalex.org/W2154933195","https://openalex.org/W2159702664","https://openalex.org/W2163292449","https://openalex.org/W2166462894","https://openalex.org/W2167536864","https://openalex.org/W2243437504"],"related_works":["https://openalex.org/W2520143678","https://openalex.org/W1496704300","https://openalex.org/W2560252021","https://openalex.org/W1750905790","https://openalex.org/W3217014199","https://openalex.org/W116627068","https://openalex.org/W7101102252","https://openalex.org/W1996071851","https://openalex.org/W7097509927","https://openalex.org/W1515180657"],"abstract_inverted_index":{"Malware":[0],"programs":[1],"that":[2,47,66,95,114],"incorporate":[3],"trigger-based":[4,51],"behavior":[5,52],"initiate":[6],"malicious":[7],"activities":[8],"based":[9,124],"on":[10,70,108],"conditions":[11],"satisfied":[12],"only":[13],"by":[14,23,63],"specific":[15,50],"inputs.":[16,40],"State-of-the-art":[17],"malware":[18,44,55,98,111,146],"analyzers":[19],"discover":[20],"code":[21,65],"guarded":[22],"triggers":[24],"via":[25],"multiple":[26],"path":[27],"exploration,":[28],"symbolic":[29],"execution,":[30,34],"or":[31],"forced":[32],"conditional":[33],"all":[35],"without":[36],"knowing":[37],"the":[38,79,84,87,130],"trigger":[39,123],"We":[41,89,126],"present":[42],"a":[43,61,75,92,97,119],"obfuscation":[45,147],"technique":[46,58],"automatically":[48,59,102],"conceals":[49],"from":[53,78,86],"these":[54],"analyzers.":[56],"Our":[57],"transforms":[60],"program":[62,100],"encrypting":[64],"is":[67],"conditionally":[68],"dependent":[69],"an":[71,104],"input":[72,80],"value":[73],"with":[74],"key":[76,85],"derived":[77],"and":[81,101,133],"then":[82],"removing":[83],"program.":[88],"have":[90],"implemented":[91],"compiler-level":[93],"tool":[94,116],"takes":[96],"source":[99],"generates":[103],"obfuscated":[105],"binary.":[106],"Experiments":[107],"various":[109],"existing":[110],"samples":[112],"show":[113],"our":[115],"can":[117],"hide":[118],"significant":[120],"portion":[121],"of":[122],"code.":[125],"provide":[127],"insight":[128],"into":[129],"strengths,":[131],"weaknesses,":[132],"possible":[134],"ways":[135],"to":[136,143],"strengthen":[137],"current":[138],"analysis":[139],"approaches":[140],"in":[141],"order":[142],"defeat":[144],"this":[145],"technique.":[148],"1":[149]},"counts_by_year":[{"year":2025,"cited_by_count":2},{"year":2024,"cited_by_count":3},{"year":2023,"cited_by_count":7},{"year":2022,"cited_by_count":8},{"year":2021,"cited_by_count":15},{"year":2020,"cited_by_count":10},{"year":2019,"cited_by_count":21},{"year":2018,"cited_by_count":22},{"year":2017,"cited_by_count":21},{"year":2016,"cited_by_count":19},{"year":2015,"cited_by_count":22},{"year":2014,"cited_by_count":22},{"year":2013,"cited_by_count":11},{"year":2012,"cited_by_count":12}],"updated_date":"2026-11-06T12:05:46.655746","created_date":"2016-06-24T00:00:00"}