{"id":"https://openalex.org/W3045322569","doi":"https://doi.org/10.7717/peerj-cs.285","title":"Deep learning based Sequential model for malware analysis using Windows exe API Calls","display_name":"Deep learning based Sequential model for malware analysis using Windows exe API Calls","publication_year":2020,"publication_date":"2020-07-27","ids":{"openalex":"https://openalex.org/W3045322569","doi":"https://doi.org/10.7717/peerj-cs.285","mag":"3045322569","pmid":"https://pubmed.ncbi.nlm.nih.gov/33816936","pmcid":"https://www.ncbi.nlm.nih.gov/pmc/articles/7924690"},"language":"en","primary_location":{"id":"doi:10.7717/peerj-cs.285","doi":"https://doi.org/10.7717/peerj-cs.285","is_oa":true,"landing_page_url":"https://doi.org/10.7717/peerj-cs.285","pdf_url":null,"source":{"id":"https://openalex.org/S4210178049","display_name":"PeerJ Computer Science","issn_l":"2376-5992","issn":["2376-5992"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["cwts-core","doaj","jufo-1","ki-jl-1","norway-1","oarl","poland-70","russia-white-list-2","vabb-shw"],"host_organization":"https://openalex.org/P4310320104","host_organization_name":"PeerJ, Inc.","host_organization_lineage":["https://openalex.org/P4310320104"],"host_organization_lineage_names":["PeerJ, Inc."],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"PeerJ Computer Science","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref","doaj","pubmed"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.7717/peerj-cs.285","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5044259885","display_name":"Ferhat \u00d6zg\u00fcr \u00c7atak","orcid":"https://orcid.org/0000-0002-2434-9966","observed_orcids":["https://orcid.org/0000-0002-2434-9966"]},"institutions":[{"id":"https://openalex.org/I204778367","display_name":"Norwegian University of Science and Technology","ror":"https://ror.org/05xg72x27","country_code":"NO","type":"education","lineage":["https://openalex.org/I204778367"]},{"id":"https://openalex.org/I4210141511","display_name":"TUBITAK BILGEM","ror":"https://ror.org/057kvja37","country_code":"TR","type":"government","lineage":["https://openalex.org/I4210141511"]}],"countries":["NO","TR"],"is_corresponding":true,"raw_author_name":"Ferhat Ozgur Catak","raw_affiliation_strings":["Department of Information Security and Communication Technology, NTNU Norwegian University of Science and Technology, Gj\u00f8vik, Norway","TUBITAK Bilgem Cyber Security Institute, Kocaeli, Turkey"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Information Security and Communication Technology, NTNU Norwegian University of Science and Technology, Gj\u00f8vik, Norway","institution_ids":["https://openalex.org/I204778367"]},{"raw_affiliation_string":"TUBITAK Bilgem Cyber Security Institute, Kocaeli, Turkey","institution_ids":["https://openalex.org/I4210141511"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5080925074","display_name":"Ahmet Faruk Yaz\u0131","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ahmet Faruk Yaz\u0131","raw_affiliation_strings":["Cyber Security Engineering, Istanbul Sehir University, Istanbul, Turkey"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Cyber Security Engineering, Istanbul Sehir University, Istanbul, Turkey","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5026513821","display_name":"Ogerta Elezaj","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I204778367","display_name":"Norwegian University of Science and Technology","ror":"https://ror.org/05xg72x27","country_code":"NO","type":"education","lineage":["https://openalex.org/I204778367"]}],"countries":["NO"],"is_corresponding":false,"raw_author_name":"Ogerta Elezaj","raw_affiliation_strings":["Department of Information Security and Communication Technology, NTNU Norwegian University of Science and Technology, Gj\u00f8vik, Norway"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Information Security and Communication Technology, NTNU Norwegian University of Science and Technology, Gj\u00f8vik, Norway","institution_ids":["https://openalex.org/I204778367"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5101470003","display_name":"Javed Ahmed","orcid":"https://orcid.org/0000-0002-8410-8929","observed_orcids":["https://orcid.org/0000-0002-8410-8929"]},"institutions":[{"id":"https://openalex.org/I204778367","display_name":"Norwegian University of Science and Technology","ror":"https://ror.org/05xg72x27","country_code":"NO","type":"education","lineage":["https://openalex.org/I204778367"]}],"countries":["NO"],"is_corresponding":false,"raw_author_name":"Javed Ahmed","raw_affiliation_strings":["Department of Information Security and Communication Technology, NTNU Norwegian University of Science and Technology, Gj\u00f8vik, Norway"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Information Security and Communication Technology, NTNU Norwegian University of Science and Technology, Gj\u00f8vik, Norway","institution_ids":["https://openalex.org/I204778367"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":["https://openalex.org/A5044259885"],"corresponding_institution_ids":["https://openalex.org/I204778367","https://openalex.org/I4210141511"],"apc_list":{"value":1395,"currency":"USD","value_usd":1395},"apc_paid":{"value":1395,"currency":"USD","value_usd":1395},"fwci":24.0821,"has_fulltext":true,"cited_by_count":179,"citation_normalized_percentile":{"value":0.9958134,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":88,"max":100},"biblio":{"volume":"6","issue":null,"first_page":"e285","last_page":"e285"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware-detection","display_name":"malware detection","score":0.8949999809265137},{"id":"https://openalex.org/keywords/metamorphic-malware","display_name":"metamorphic malware","score":0.9620000123977661},{"id":"https://openalex.org/keywords/malware-behavior","display_name":"malware behavior","score":0.5249999761581421},{"id":"https://openalex.org/keywords/malware-classification","display_name":"malware classification","score":0.7649999856948853},{"id":"https://openalex.org/keywords/lstm","display_name":"LSTM","score":0.8889999985694885},{"id":"https://openalex.org/keywords/malware-dataset","display_name":"malware dataset","score":0.5410000085830688},{"id":"https://openalex.org/keywords/adware","display_name":"adware","score":0.6499999761581421},{"id":"https://openalex.org/keywords/backdoors","display_name":"backdoors","score":0.8489999771118164},{"id":"https://openalex.org/keywords/trojans","display_name":"Trojans","score":0.7269999980926514},{"id":"https://openalex.org/keywords/spyware","display_name":"spyware","score":0.6869999766349792},{"id":"https://openalex.org/keywords/viruses","display_name":"viruses","score":0.5870000123977661},{"id":"https://openalex.org/keywords/worms","display_name":"worms","score":0.8519999980926514},{"id":"https://openalex.org/keywords/droppers","display_name":"droppers","score":0.6629999876022339}],"concepts":[{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.9594759941101074},{"id":"https://openalex.org/C2781045450","wikidata":"https://www.wikidata.org/wiki/Q254569","display_name":"Backdoor","level":2,"score":0.852393627166748},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8427281975746155},{"id":"https://openalex.org/C174333608","wikidata":"https://www.wikidata.org/wiki/Q19635","display_name":"Trojan","level":2,"score":0.6453043818473816},{"id":"https://openalex.org/C84525096","wikidata":"https://www.wikidata.org/wiki/Q3506050","display_name":"Cryptovirology","level":3,"score":0.593826174736023},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5452041029930115},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5306379199028015},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.45654770731925964},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4132741093635559},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.37140780687332153}],"mesh":[],"locations_count":5,"locations":[{"id":"doi:10.7717/peerj-cs.285","doi":"https://doi.org/10.7717/peerj-cs.285","is_oa":true,"landing_page_url":"https://doi.org/10.7717/peerj-cs.285","pdf_url":null,"source":{"id":"https://openalex.org/S4210178049","display_name":"PeerJ Computer Science","issn_l":"2376-5992","issn":["2376-5992"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["cwts-core","doaj","jufo-1","ki-jl-1","norway-1","oarl","poland-70","russia-white-list-2","vabb-shw"],"host_organization":"https://openalex.org/P4310320104","host_organization_name":"PeerJ, Inc.","host_organization_lineage":["https://openalex.org/P4310320104"],"host_organization_lineage_names":["PeerJ, Inc."],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"PeerJ Computer Science","raw_type":"journal-article"},{"id":"pmh:oai:pubmedcentral.nih.gov:7924690","doi":null,"is_oa":true,"landing_page_url":"https://pmc.ncbi.nlm.nih.gov/articles/PMC7924690/","pdf_url":"https://pmc.ncbi.nlm.nih.gov/articles/PMC7924690/pdf/","source":{"id":"https://openalex.org/S2764455111","display_name":"PubMed Central","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I1299303238","host_organization_name":"National Institutes of Health","host_organization_lineage":["https://openalex.org/I1299303238"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"PeerJ Comput Sci","raw_type":"Text"},{"id":"pmid:33816936","doi":null,"is_oa":false,"landing_page_url":"https://pubmed.ncbi.nlm.nih.gov/33816936","pdf_url":null,"source":{"id":"https://openalex.org/S4306525036","display_name":"PubMed","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I1299303238","host_organization_name":"National Institutes of Health","host_organization_lineage":["https://openalex.org/I1299303238"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"PeerJ. Computer science","raw_type":"Journal Article"},{"id":"pmh:oai:doaj.org/article:ea680bf60538492ebc0dfe02e1adee15","doi":null,"is_oa":true,"landing_page_url":"https://doaj.org/article/ea680bf60538492ebc0dfe02e1adee15","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"PeerJ Computer Science, Vol 6, p e285 (2020)","raw_type":"article"},{"id":"pmh:oai:ntnuopen.ntnu.no:11250/2678354","doi":null,"is_oa":true,"landing_page_url":"https://hdl.handle.net/11250/2678354","pdf_url":null,"source":{"id":"https://openalex.org/S7407064446","display_name":"NORA - Norwegian Open Research Archives","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"e285-?","raw_type":"info:eu-repo/semantics/article"}],"best_oa_location":{"id":"doi:10.7717/peerj-cs.285","doi":"https://doi.org/10.7717/peerj-cs.285","is_oa":true,"landing_page_url":"https://doi.org/10.7717/peerj-cs.285","pdf_url":null,"source":{"id":"https://openalex.org/S4210178049","display_name":"PeerJ Computer Science","issn_l":"2376-5992","issn":["2376-5992"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["cwts-core","doaj","jufo-1","ki-jl-1","norway-1","oarl","poland-70","russia-white-list-2","vabb-shw"],"host_organization":"https://openalex.org/P4310320104","host_organization_name":"PeerJ, Inc.","host_organization_lineage":["https://openalex.org/P4310320104"],"host_organization_lineage_names":["PeerJ, Inc."],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"PeerJ Computer Science","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W3045322569.pdf","grobid_xml":"https://content.openalex.org/works/W3045322569.grobid-xml"},"referenced_works_count":30,"referenced_works":["https://openalex.org/W1532325895","https://openalex.org/W1557109513","https://openalex.org/W1652196843","https://openalex.org/W1966917005","https://openalex.org/W2002478203","https://openalex.org/W2020184885","https://openalex.org/W2036575863","https://openalex.org/W2041130390","https://openalex.org/W2051223603","https://openalex.org/W2064675550","https://openalex.org/W2065311994","https://openalex.org/W2092269560","https://openalex.org/W2119954997","https://openalex.org/W2143840485","https://openalex.org/W2154871153","https://openalex.org/W2169783907","https://openalex.org/W2557513839","https://openalex.org/W2763806200","https://openalex.org/W2789729245","https://openalex.org/W2901486871","https://openalex.org/W2922329508","https://openalex.org/W2922440217","https://openalex.org/W2942472907","https://openalex.org/W2946514522","https://openalex.org/W2947398662","https://openalex.org/W2954446205","https://openalex.org/W2969763191","https://openalex.org/W2986975783","https://openalex.org/W4213009331","https://openalex.org/W6673536509"],"related_works":["https://openalex.org/W2969763191","https://openalex.org/W4226117603","https://openalex.org/W2997867219","https://openalex.org/W7212153216","https://openalex.org/W4401263608","https://openalex.org/W7160451758","https://openalex.org/W4385076171","https://openalex.org/W4210989030","https://openalex.org/W4320025306","https://openalex.org/W4392121297"],"abstract_inverted_index":{"Malware":[0],"development":[1,225],"has":[2],"seen":[3],"diversity":[4],"in":[5,13,27,143,160,175,264],"terms":[6],"of":[7,16,43,70,91,110,134,139,212,219,226,241,255,267],"architecture":[8],"and":[9,22,79,154,203,272],"features.":[10],"This":[11,30],"advancement":[12],"the":[14,39,44,108,126,132,144,182,209,213,224,239,261,265],"competencies":[15],"malware":[17,28,45,71,77,86,102,141,205,268],"poses":[18],"a":[19,97,118,170,227,274],"severe":[20],"threat":[21],"opens":[23],"new":[24,119,228],"research":[25,74,115,221,262],"dimensions":[26],"detection.":[29],"study":[31,162],"is":[32,38,48,94,163,169,193,223,245],"focused":[33],"on":[34,125,235,258],"metamorphic":[35,60],"malware,":[36,61],"which":[37,62,130,168,192],"most":[40],"advanced":[41],"member":[42],"family.":[46],"It":[47],"quite":[49,194],"impossible":[50],"for":[51,230],"anti-virus":[52],"applications":[53],"using":[54],"traditional":[55],"signature-based":[56],"methods":[57],"to":[58,66,85,95,101,187,207,270,277],"detect":[59],"makes":[63],"it":[64],"difficult":[65],"classify":[67],"this":[68,82,92,114,161,220,278],"type":[69],"accordingly.":[72],"Recent":[73],"literature":[75],"about":[76],"detection":[78,269],"classification":[80,98,157,173,210],"discusses":[81],"issue":[83],"related":[84],"behavior.":[87],"The":[88,137,156,178,253],"main":[89],"goal":[90],"paper":[93,222],"develop":[96],"method":[99,158,174],"according":[100],"types":[103,138],"by":[104,116,181],"taking":[105],"into":[106],"consideration":[107],"behavior":[109,133],"malware.":[111],"We":[112,196],"started":[113],"developing":[117],"dataset":[120,145,229,248,257],"containing":[121],"API":[122,236],"calls":[123],"made":[124],"windows":[127],"operating":[128,232],"system,":[129],"represents":[131],"malicious":[135,140],"software.":[136],"included":[142],"are":[146],"Adware,":[147],"Backdoor,":[148],"Downloader,":[149],"Dropper,":[150],"spyware,":[151],"Trojan,":[152],"Virus,":[153],"Worm.":[155],"used":[159,172],"LSTM":[164,214],"(Long":[165],"Short-Term":[166],"Memory),":[167],"widely":[171],"sequential":[176],"data.":[177],"results":[179],"obtained":[180],"classifier":[183],"demonstrate":[184],"accuracy":[185],"up":[186],"95%":[188],"with":[189,201],"0.83":[190],"$F_1$-score,":[191],"satisfactory.":[195],"also":[197],"run":[198],"our":[199,242,251,256],"experiments":[200],"binary":[202],"multi-class":[204],"datasets":[206],"show":[208],"performance":[211],"model.":[215],"Another":[216],"significant":[217],"contribution":[218,276],"Windows":[231],"systems":[233],"based":[234],"calls.":[237],"To":[238],"best":[240],"knowledge,":[243],"there":[244],"no":[246],"such":[247],"available":[249],"before":[250],"research.":[252],"availability":[254],"GitHub":[259],"facilitates":[260],"community":[263],"domain":[266],"benefit":[271],"make":[273],"further":[275],"domain.":[279]},"counts_by_year":[{"year":2026,"cited_by_count":22},{"year":2025,"cited_by_count":30},{"year":2024,"cited_by_count":41},{"year":2023,"cited_by_count":42},{"year":2022,"cited_by_count":25},{"year":2021,"cited_by_count":18},{"year":2020,"cited_by_count":1}],"updated_date":"2026-11-12T12:28:57.059296","created_date":"2020-07-29T00:00:00"}