{"id":"https://openalex.org/W2947447457","doi":"https://doi.org/10.1145/3318236.3318255","title":"An Opcode Sequences Analysis Method For Unknown Malware Detection","display_name":"An Opcode Sequences Analysis Method For Unknown Malware Detection","publication_year":2019,"publication_date":"2019-03-15","ids":{"openalex":"https://openalex.org/W2947447457","doi":"https://doi.org/10.1145/3318236.3318255","mag":"2947447457"},"language":"en","primary_location":{"id":"doi:10.1145/3318236.3318255","doi":"https://doi.org/10.1145/3318236.3318255","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3318236.3318255","pdf_url":null,"source":{"id":"https://openalex.org/S7407086143","display_name":"International Conference on Geoinformatics and Data Analysis (ICGDA)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2019 2nd International Conference on Geoinformatics and Data Analysis","raw_type":"proceedings-article"},"volume":null,"type":"conference-paper","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Zhi Sun","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I2800372957","display_name":"China Electronics Technology Group Corporation","ror":"https://ror.org/0098hst83","country_code":"CN","type":"company","lineage":["https://openalex.org/I2800372957"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhi Sun","raw_affiliation_strings":["Cyberspace Security Technology Laboratory of CETC, Cyberspace Security Key Laboratory of Sichuan Province, China Electronic Technology Cyber Security Co., Ltd, Chengdu, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Cyberspace Security Technology Laboratory of CETC, Cyberspace Security Key Laboratory of Sichuan Province, China Electronic Technology Cyber Security Co., Ltd, Chengdu, China","institution_ids":["https://openalex.org/I2800372957"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5060097356","display_name":"Zhihong Rao","orcid":"https://orcid.org/0000-0002-2342-7256","observed_orcids":["https://orcid.org/0000-0002-2342-7256"]},"institutions":[{"id":"https://openalex.org/I2800372957","display_name":"China Electronics Technology Group Corporation","ror":"https://ror.org/0098hst83","country_code":"CN","type":"company","lineage":["https://openalex.org/I2800372957"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhihong Rao","raw_affiliation_strings":["Cyberspace Security Technology Laboratory of CETC, Cyberspace Security Key Laboratory of Sichuan Province, China Electronic Technology Cyber Security Co., Ltd, Chengdu, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Cyberspace Security Technology Laboratory of CETC, Cyberspace Security Key Laboratory of Sichuan Province, China Electronic Technology Cyber Security Co., Ltd, Chengdu, China","institution_ids":["https://openalex.org/I2800372957"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Jianfeng Chen","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I2800372957","display_name":"China Electronics Technology Group Corporation","ror":"https://ror.org/0098hst83","country_code":"CN","type":"company","lineage":["https://openalex.org/I2800372957"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jianfeng Chen","raw_affiliation_strings":["Cyberspace Security Technology Laboratory of CETC, Cyberspace Security Key Laboratory of Sichuan Province, China Electronic Technology Cyber Security Co., Ltd, Chengdu, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Cyberspace Security Technology Laboratory of CETC, Cyberspace Security Key Laboratory of Sichuan Province, China Electronic Technology Cyber Security Co., Ltd, Chengdu, China","institution_ids":["https://openalex.org/I2800372957"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5027190108","display_name":"Rui Xu","orcid":"https://orcid.org/0000-0003-4177-7804","observed_orcids":["https://orcid.org/0000-0003-4177-7804"]},"institutions":[{"id":"https://openalex.org/I2800372957","display_name":"China Electronics Technology Group Corporation","ror":"https://ror.org/0098hst83","country_code":"CN","type":"company","lineage":["https://openalex.org/I2800372957"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Rui Xu","raw_affiliation_strings":["Cyberspace Security Technology Laboratory of CETC, Cyberspace Security Key Laboratory of Sichuan Province, China Electronic Technology Cyber Security Co., Ltd, Chengdu, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Cyberspace Security Technology Laboratory of CETC, Cyberspace Security Key Laboratory of Sichuan Province, China Electronic Technology Cyber Security Co., Ltd, Chengdu, China","institution_ids":["https://openalex.org/I2800372957"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5036348438","display_name":"Da He","orcid":"https://orcid.org/0000-0001-5714-8223","observed_orcids":["https://orcid.org/0000-0001-5714-8223"]},"institutions":[{"id":"https://openalex.org/I2800372957","display_name":"China Electronics Technology Group Corporation","ror":"https://ror.org/0098hst83","country_code":"CN","type":"company","lineage":["https://openalex.org/I2800372957"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Da He","raw_affiliation_strings":["Cyberspace Security Technology Laboratory of CETC, Cyberspace Security Key Laboratory of Sichuan Province, China Electronic Technology Cyber Security Co., Ltd, Chengdu, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Cyberspace Security Technology Laboratory of CETC, Cyberspace Security Key Laboratory of Sichuan Province, China Electronic Technology Cyber Security Co., Ltd, Chengdu, China","institution_ids":["https://openalex.org/I2800372957"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5067965873","display_name":"Hui Yang","orcid":"https://orcid.org/0000-0003-4850-3822","observed_orcids":["https://orcid.org/0000-0003-4850-3822"]},"institutions":[{"id":"https://openalex.org/I2800372957","display_name":"China Electronics Technology Group Corporation","ror":"https://ror.org/0098hst83","country_code":"CN","type":"company","lineage":["https://openalex.org/I2800372957"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hui Yang","raw_affiliation_strings":["Cyberspace Security Technology Laboratory of CETC, Cyberspace Security Key Laboratory of Sichuan Province, China Electronic Technology Cyber Security Co., Ltd, Chengdu, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Cyberspace Security Technology Laboratory of CETC, Cyberspace Security Key Laboratory of Sichuan Province, China Electronic Technology Cyber Security Co., Ltd, Chengdu, China","institution_ids":["https://openalex.org/I2800372957"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100454179","display_name":"Jie Liu","orcid":"https://orcid.org/0000-0003-0895-7598","observed_orcids":["https://orcid.org/0000-0003-0895-7598","https://orcid.org/0009-0008-7013-924X"]},"institutions":[{"id":"https://openalex.org/I2800372957","display_name":"China Electronics Technology Group Corporation","ror":"https://ror.org/0098hst83","country_code":"CN","type":"company","lineage":["https://openalex.org/I2800372957"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jie Liu","raw_affiliation_strings":["Cyberspace Security Technology Laboratory of CETC, Cyberspace Security Key Laboratory of Sichuan Province, China Electronic Technology Cyber Security Co., Ltd, Chengdu, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Cyberspace Security Technology Laboratory of CETC, Cyberspace Security Key Laboratory of Sichuan Province, China Electronic Technology Cyber Security Co., Ltd, Chengdu, China","institution_ids":["https://openalex.org/I2800372957"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I2800372957"],"apc_list":null,"apc_paid":null,"fwci":2.3011,"has_fulltext":false,"cited_by_count":35,"citation_normalized_percentile":{"value":0.88385552,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":88,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"15","last_page":"19"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/unknown-malware-detection","display_name":"unknown malware detection","score":0.9520000219345093},{"id":"https://openalex.org/keywords/opcode-sequences","display_name":"opcode sequences","score":0.8939999938011169},{"id":"https://openalex.org/keywords/portable-executable-files","display_name":"portable executable files","score":0.8209999799728394},{"id":"https://openalex.org/keywords/windows-malware","display_name":"Windows malware","score":0.652999997138977},{"id":"https://openalex.org/keywords/static-analysis","display_name":"static analysis","score":0.8059999942779541},{"id":"https://openalex.org/keywords/malware-classification","display_name":"malware classification","score":0.6460000276565552}],"concepts":[{"id":"https://openalex.org/C52173422","wikidata":"https://www.wikidata.org/wiki/Q766483","display_name":"Opcode","level":2,"score":0.9913934469223022},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.9197632074356079},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8291473984718323},{"id":"https://openalex.org/C160145156","wikidata":"https://www.wikidata.org/wiki/Q778586","display_name":"Executable","level":2,"score":0.6609194874763489},{"id":"https://openalex.org/C12267149","wikidata":"https://www.wikidata.org/wiki/Q282453","display_name":"Support vector machine","level":2,"score":0.520996630191803},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5181430578231812},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.48862224817276},{"id":"https://openalex.org/C2780801425","wikidata":"https://www.wikidata.org/wiki/Q5164392","display_name":"Construct (python library)","level":2,"score":0.4673593044281006},{"id":"https://openalex.org/C2780967490","wikidata":"https://www.wikidata.org/wiki/Q1291200","display_name":"Mobile malware","level":3,"score":0.46332117915153503},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4619178771972656},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.45224839448928833},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.15632551908493042},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.10878333449363708},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.08565676212310791}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3318236.3318255","doi":"https://doi.org/10.1145/3318236.3318255","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3318236.3318255","pdf_url":null,"source":{"id":"https://openalex.org/S7407086143","display_name":"International Conference on Geoinformatics and Data Analysis (ICGDA)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2019 2nd International Conference on Geoinformatics and Data Analysis","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320335777","display_name":"National Key Research and Development Program of China","ror":null}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":14,"referenced_works":["https://openalex.org/W1864102666","https://openalex.org/W1880262756","https://openalex.org/W1968519345","https://openalex.org/W1973403081","https://openalex.org/W2034938003","https://openalex.org/W2079215333","https://openalex.org/W2121749752","https://openalex.org/W2144112223","https://openalex.org/W2154223969","https://openalex.org/W2397347223","https://openalex.org/W2560674852","https://openalex.org/W2791290067","https://openalex.org/W3144756387","https://openalex.org/W4230271844"],"related_works":["https://openalex.org/W2079215333","https://openalex.org/W7096541538","https://openalex.org/W4391564059","https://openalex.org/W4207001006","https://openalex.org/W36091977","https://openalex.org/W1542951322","https://openalex.org/W2889044831","https://openalex.org/W2027721581","https://openalex.org/W2902612505","https://openalex.org/W2003791967"],"abstract_inverted_index":{"One":[0],"of":[1,30,38,50,60,89,107,109,117],"the":[2,16,31,36,48,105,123],"main":[3],"challenges":[4,34],"in":[5,132],"security":[6,37],"today":[7],"is":[8,138,157],"defending":[9],"against":[10],"unknown":[11,176],"malware":[12,26,43],"attacks":[13],"which":[14,137],"have":[15],"potential":[17],"to":[18,54,63,69,140],"harm":[19],"a":[20,56,82],"computer":[21,39],"or":[22],"network.":[23],"Hence,":[24],"detecting":[25,86],"has":[27,53],"become":[28],"one":[29],"most":[32],"important":[33],"for":[35,85],"systems.":[40],"The":[41],"known":[42],"detection":[44],"methods":[45],"based":[46],"on":[47,159],"appearance":[49],"opcode":[51,100,111],"sequences":[52,101],"construct":[55],"matrix":[57],"from":[58],"programs":[59],"different":[61,115],"architectures":[62],"extract":[64],"high-level":[65],"features.":[66],"In":[67],"order":[68],"resolve":[70],"high":[71],"dimensional":[72],"inputs":[73],"vector":[74],"and":[75,91,113,119,150,164,174],"differences":[76],"assembly":[77],"instruction,":[78],"this":[79],"paper":[80],"proposes":[81],"novel":[83],"method":[84,125,156],"static":[87],"characteristics":[88],"32-bit":[90,118],"64-bit":[92,120],"malicious":[93],"Portable":[94],"Executable":[95],"(PE)":[96],"Windows":[97],"files":[98],"by":[99],"analysis.":[102],"By":[103],"compute":[104],"frequency":[106],"occurrence":[108],"each":[110],"sequence":[112],"distinguishing":[114],"types":[116],"PE":[121],"files,":[122],"proposed":[124],"shows":[126],"promising":[127],"results":[128,166],"with":[129,134],"less":[130],"complexity":[131],"comparison":[133],"previous":[135],"studies,":[136],"beneficial":[139],"train":[141],"machine":[142],"learning":[143],"model":[144],"such":[145],"as":[146],"k-nearest":[147],"neighbor":[148],"(KNN)":[149],"back-propagation":[151],"neural":[152],"network":[153],"(BP).":[154],"Our":[155],"evaluated":[158],"more":[160],"than":[161],"20,000":[162],"samples,":[163],"experimental":[165],"show":[167],"that":[168],"our":[169],"system":[170],"can":[171],"effectively":[172],"detect":[173],"classify":[175],"malware.":[177]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":4},{"year":2024,"cited_by_count":11},{"year":2023,"cited_by_count":6},{"year":2022,"cited_by_count":6},{"year":2021,"cited_by_count":5},{"year":2020,"cited_by_count":1},{"year":2019,"cited_by_count":1}],"updated_date":"2026-11-04T10:54:05.112534","created_date":"2019-06-07T00:00:00"}