{"id":"https://openalex.org/W4200469653","doi":"https://doi.org/10.3991/ijim.v15i24.25401","title":"Malware Detection Using Ensemble N-gram Opcode Sequences","display_name":"Malware Detection Using Ensemble N-gram Opcode Sequences","publication_year":2021,"publication_date":"2021-12-21","ids":{"openalex":"https://openalex.org/W4200469653","doi":"https://doi.org/10.3991/ijim.v15i24.25401"},"language":"en","primary_location":{"id":"doi:10.3991/ijim.v15i24.25401","doi":"https://doi.org/10.3991/ijim.v15i24.25401","is_oa":true,"landing_page_url":"https://doi.org/10.3991/ijim.v15i24.25401","pdf_url":"https://online-journals.org/index.php/i-jim/article/download/25401/10479","source":{"id":"https://openalex.org/S4210177413","display_name":"International Journal of Interactive Mobile Technologies (iJIM)","issn_l":"1865-7923","issn":["1865-7923"],"is_oa":true,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core","jufo-1","norway-1","poland-20","russia-white-list-1"],"host_organization":"https://openalex.org/P4310313744","host_organization_name":"kassel university press","host_organization_lineage":["https://openalex.org/P4310313744"],"host_organization_lineage_names":["kassel university press"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal of Interactive Mobile Technologies (iJIM)","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://online-journals.org/index.php/i-jim/article/download/25401/10479","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5048966460","display_name":"Paul Ntim Yeboah","orcid":"https://orcid.org/0000-0003-2939-2485","observed_orcids":["https://orcid.org/0000-0003-2939-2485"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Paul Ntim Yeboah","raw_affiliation_strings":["Kofi Annan Centre of Excellence in ICT"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Kofi Annan Centre of Excellence in ICT","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5091873655","display_name":"Stephen Kweku Amuquandoh","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I28046988","display_name":"Kwame Nkrumah University of Science and Technology","ror":"https://ror.org/00cb23x68","country_code":"GH","type":"education","lineage":["https://openalex.org/I28046988"]}],"countries":["GH"],"is_corresponding":false,"raw_author_name":"Stephen Kweku Amuquandoh","raw_affiliation_strings":["Kwame Nkrumah University of Science and Technology"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Kwame Nkrumah University of Science and Technology","institution_ids":["https://openalex.org/I28046988"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5033311488","display_name":"Haruna Balle Baz Musah","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Haruna Balle Baz Musah","raw_affiliation_strings":["Kofi Annan Centre of Excellence in ICT"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Kofi Annan Centre of Excellence in ICT","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":260,"currency":"EUR","value_usd":280},"apc_paid":{"value":260,"currency":"EUR","value_usd":280},"fwci":1.3179,"has_fulltext":true,"cited_by_count":15,"citation_normalized_percentile":{"value":0.82793671,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":88,"max":98},"biblio":{"volume":"15","issue":"24","first_page":"19","last_page":"31"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware-detection","display_name":"malware detection","score":1.0},{"id":"https://openalex.org/keywords/zero-day-malware","display_name":"zero-day malware","score":0.9750000238418579},{"id":"https://openalex.org/keywords/opcode-sequences","display_name":"opcode sequences","score":0.7570000290870667},{"id":"https://openalex.org/keywords/n-gram-features","display_name":"n-gram features","score":0.9300000071525574},{"id":"https://openalex.org/keywords/ensemble-learning","display_name":"ensemble learning","score":0.8349999785423279},{"id":"https://openalex.org/keywords/feature-weighting","display_name":"feature weighting","score":0.7329999804496765},{"id":"https://openalex.org/keywords/obfuscated-malware","display_name":"obfuscated malware","score":0.7770000100135803},{"id":"https://openalex.org/keywords/binary-classification","display_name":"binary classification","score":0.7839999794960022},{"id":"https://openalex.org/keywords/random-forest","display_name":"random forest","score":0.8889999985694885}],"concepts":[{"id":"https://openalex.org/C52173422","wikidata":"https://www.wikidata.org/wiki/Q766483","display_name":"Opcode","level":2,"score":0.9736649990081787},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.7753530740737915},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7306486368179321},{"id":"https://openalex.org/C117884012","wikidata":"https://www.wikidata.org/wiki/Q94489","display_name":"n-gram","level":3,"score":0.6194865703582764},{"id":"https://openalex.org/C169258074","wikidata":"https://www.wikidata.org/wiki/Q245748","display_name":"Random forest","level":2,"score":0.5986738204956055},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.5293779373168945},{"id":"https://openalex.org/C45942800","wikidata":"https://www.wikidata.org/wiki/Q245652","display_name":"Ensemble learning","level":2,"score":0.5236206650733948},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5216789245605469},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.46791011095046997},{"id":"https://openalex.org/C119898033","wikidata":"https://www.wikidata.org/wiki/Q3433888","display_name":"Ensemble forecasting","level":2,"score":0.45283767580986023},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.40516531467437744},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3470809757709503},{"id":"https://openalex.org/C137293760","wikidata":"https://www.wikidata.org/wiki/Q3621696","display_name":"Language model","level":2,"score":0.08852732181549072},{"id":"https://openalex.org/C9390403","wikidata":"https://www.wikidata.org/wiki/Q3966","display_name":"Computer hardware","level":1,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.3991/ijim.v15i24.25401","doi":"https://doi.org/10.3991/ijim.v15i24.25401","is_oa":true,"landing_page_url":"https://doi.org/10.3991/ijim.v15i24.25401","pdf_url":"https://online-journals.org/index.php/i-jim/article/download/25401/10479","source":{"id":"https://openalex.org/S4210177413","display_name":"International Journal of Interactive Mobile Technologies (iJIM)","issn_l":"1865-7923","issn":["1865-7923"],"is_oa":true,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core","jufo-1","norway-1","poland-20","russia-white-list-1"],"host_organization":"https://openalex.org/P4310313744","host_organization_name":"kassel university press","host_organization_lineage":["https://openalex.org/P4310313744"],"host_organization_lineage_names":["kassel university press"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal of Interactive Mobile Technologies (iJIM)","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.3991/ijim.v15i24.25401","doi":"https://doi.org/10.3991/ijim.v15i24.25401","is_oa":true,"landing_page_url":"https://doi.org/10.3991/ijim.v15i24.25401","pdf_url":"https://online-journals.org/index.php/i-jim/article/download/25401/10479","source":{"id":"https://openalex.org/S4210177413","display_name":"International Journal of Interactive Mobile Technologies (iJIM)","issn_l":"1865-7923","issn":["1865-7923"],"is_oa":true,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core","jufo-1","norway-1","poland-20","russia-white-list-1"],"host_organization":"https://openalex.org/P4310313744","host_organization_name":"kassel university press","host_organization_lineage":["https://openalex.org/P4310313744"],"host_organization_lineage_names":["kassel university press"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal of Interactive Mobile Technologies (iJIM)","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4200469653.pdf","grobid_xml":"https://content.openalex.org/works/W4200469653.grobid-xml"},"referenced_works_count":32,"referenced_works":["https://openalex.org/W601070381","https://openalex.org/W1482612322","https://openalex.org/W1595564425","https://openalex.org/W1680797894","https://openalex.org/W2041404167","https://openalex.org/W2079215333","https://openalex.org/W2100471214","https://openalex.org/W2104495462","https://openalex.org/W2125055259","https://openalex.org/W2149298154","https://openalex.org/W2167975832","https://openalex.org/W2204544304","https://openalex.org/W2325227998","https://openalex.org/W2522351705","https://openalex.org/W2560624365","https://openalex.org/W2736972628","https://openalex.org/W2744520801","https://openalex.org/W2791290067","https://openalex.org/W2801888526","https://openalex.org/W2810114801","https://openalex.org/W2905912674","https://openalex.org/W2911964244","https://openalex.org/W2931858311","https://openalex.org/W2945792041","https://openalex.org/W2947576068","https://openalex.org/W2949755578","https://openalex.org/W2996806689","https://openalex.org/W3007686746","https://openalex.org/W3027831346","https://openalex.org/W3036322304","https://openalex.org/W3087827179","https://openalex.org/W4394449576"],"related_works":["https://openalex.org/W2766474512","https://openalex.org/W2003791967","https://openalex.org/W3202600687","https://openalex.org/W2889044831","https://openalex.org/W4393104593","https://openalex.org/W4403448109","https://openalex.org/W4200233079","https://openalex.org/W4322731458","https://openalex.org/W7117867069","https://openalex.org/W3139383759"],"abstract_inverted_index":{"Conventional":[0],"approaches":[1],"to":[2,8,93,132],"tackling":[3],"malware":[4,49],"attacks":[5],"have":[6],"proven":[7],"be":[9],"futile":[10],"at":[11],"detecting":[12],"never-before-seen":[13],"(zero-day)":[14],"malware.":[15],"Research":[16],"however":[17],"has":[18],"shown":[19],"that":[20],"zero-day":[21],"malicious":[22,104],"files":[23],"are":[24,33,73,87],"mostly":[25],"semantic-preserving":[26],"variants":[27],"of":[28,59,70,125,138,143,147,165],"already":[29],"existing":[30],"malware,":[31],"which":[32],"generated":[34,65],"via":[35],"obfuscation":[36],"methods.":[37],"In":[38],"this":[39],"paper":[40],"we":[41,117],"propose":[42],"and":[43,89,151,158,176],"evaluate":[44],"a":[45,57,76,95,100,119,123,135],"machine":[46],"learning":[47],"based":[48],"detection":[50,163],"model":[51],"using":[52,75,167,183],"ensemble":[53,60,114,142],"approach.":[54],"We":[55],"employ":[56],"strategy":[58],"where":[61],"multiple":[62],"feature":[63,85,115],"sets":[64,86],"from":[66],"different":[67],"n-gram":[68,144,173],"sizes":[69,149,174],"opcode":[71,145],"sequences":[72,146],"trained":[74,83],"single":[77],"classifier.":[78,171],"Model":[79],"predictions":[80],"on":[81,91,98,122],"the":[82,113,129,161],"multi":[84],"weighted":[88],"combined":[90],"average":[92],"make":[94],"final":[96],"verdict":[97],"whether":[99],"binary":[101],"file":[102],"is":[103],"or":[105],"benign.":[106],"To":[107],"obtain":[108],"optimal":[109],"weight":[110,155,184],"combination":[111],"for":[112,186],"sets,":[116],"applied":[118],"grid":[120],"search":[121],"set":[124],"pre-defined":[126],"weights":[127],"in":[128],"range":[130],"0":[131],"1.":[133],"With":[134],"balanced":[136],"dataset":[137],"2000":[139],"samples,":[140],"an":[141],"n":[148],"1":[150],"2":[152,175],"with":[153],"respective":[154],"pair":[156],"0.3":[157],"0.7":[159],"yielded":[160],"best":[162,181],"accuracy":[164],"98.1%":[166],"random":[168],"forest":[169],"(RF)":[170],"Ensemble":[172],"3":[177],"obtained":[178],"99.7%":[179],"as":[180],"precision":[182],"0.5":[185],"both":[187],"models.":[188]},"counts_by_year":[{"year":2026,"cited_by_count":5},{"year":2025,"cited_by_count":4},{"year":2024,"cited_by_count":2},{"year":2023,"cited_by_count":3},{"year":2022,"cited_by_count":1}],"updated_date":"2026-11-13T13:42:25.865203","created_date":"2021-12-31T00:00:00"}