{"id":"https://openalex.org/W4319083647","doi":"https://doi.org/10.3390/app13031972","title":"Features Engineering to Differentiate between Malware and Legitimate Software","display_name":"Features Engineering to Differentiate between Malware and Legitimate Software","publication_year":2023,"publication_date":"2023-02-03","ids":{"openalex":"https://openalex.org/W4319083647","doi":"https://doi.org/10.3390/app13031972"},"language":"en","primary_location":{"id":"doi:10.3390/app13031972","doi":"https://doi.org/10.3390/app13031972","is_oa":true,"landing_page_url":"https://doi.org/10.3390/app13031972","pdf_url":"https://www.mdpi.com/2076-3417/13/3/1972/pdf?version=1675390251","source":{"id":"https://openalex.org/S4210205812","display_name":"Applied Sciences","issn_l":"2076-3417","issn":["2076-3417"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["anvur-class-a","anvur-scientific","cwts-core","doaj","norway-1","oarl","poland-100","russia-white-list-2","vabb-shw"],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Applied Sciences","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://www.mdpi.com/2076-3417/13/3/1972/pdf?version=1675390251","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5026418646","display_name":"Ammar Yahya Daeef","orcid":"https://orcid.org/0000-0003-2180-676X","observed_orcids":["https://orcid.org/0000-0003-2180-676X"]},"institutions":[{"id":"https://openalex.org/I4210115078","display_name":"Middle Technical University","ror":"https://ror.org/02fvkg758","country_code":"IQ","type":"education","lineage":["https://openalex.org/I4210115078"]}],"countries":["IQ"],"is_corresponding":false,"raw_author_name":"Ammar Yahya Daeef","raw_affiliation_strings":["Technical Institute for Administration, Middle Technical University, Baghdad 10074, Iraq"],"raw_orcid":"https://orcid.org/0000-0003-2180-676X","affiliations":[{"raw_affiliation_string":"Technical Institute for Administration, Middle Technical University, Baghdad 10074, Iraq","institution_ids":["https://openalex.org/I4210115078"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5000023371","display_name":"Ali Al\u2010Naji","orcid":"https://orcid.org/0000-0002-8840-9235","observed_orcids":["https://orcid.org/0000-0002-8840-9235"]},"institutions":[{"id":"https://openalex.org/I170239107","display_name":"University of South Australia","ror":"https://ror.org/01p93h210","country_code":"AU","type":"education","lineage":["https://openalex.org/I170239107","https://openalex.org/I4405259444"]},{"id":"https://openalex.org/I4210115078","display_name":"Middle Technical University","ror":"https://ror.org/02fvkg758","country_code":"IQ","type":"education","lineage":["https://openalex.org/I4210115078"]}],"countries":["AU","IQ"],"is_corresponding":true,"raw_author_name":"Ali Al-Naji","raw_affiliation_strings":["Electrical Engineering Technical College, Middle Technical University, Baghdad 10022, Iraq","School of Engineering, University of South Australia, Mawson Lakes, SA 5095, Australia"],"raw_orcid":"https://orcid.org/0000-0002-8840-9235","affiliations":[{"raw_affiliation_string":"Electrical Engineering Technical College, Middle Technical University, Baghdad 10022, Iraq","institution_ids":["https://openalex.org/I4210115078"]},{"raw_affiliation_string":"School of Engineering, University of South Australia, Mawson Lakes, SA 5095, Australia","institution_ids":["https://openalex.org/I170239107"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5079916783","display_name":"Ali Kareem Nahar","orcid":"https://orcid.org/0000-0002-6301-0447","observed_orcids":["https://orcid.org/0000-0002-6301-0447"]},"institutions":[{"id":"https://openalex.org/I171256487","display_name":"University of Technology - Iraq","ror":"https://ror.org/01w1ehb86","country_code":"IQ","type":"education","lineage":["https://openalex.org/I171256487"]}],"countries":["IQ"],"is_corresponding":false,"raw_author_name":"Ali K. Nahar","raw_affiliation_strings":["Electrical Engineering Department, University of Technology, Baghdad 10066, Iraq"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Electrical Engineering Department, University of Technology, Baghdad 10066, Iraq","institution_ids":["https://openalex.org/I171256487"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5090327828","display_name":"Javaan Chahl","orcid":"https://orcid.org/0000-0001-6496-0543","observed_orcids":["https://orcid.org/0000-0001-6496-0543"]},"institutions":[{"id":"https://openalex.org/I170239107","display_name":"University of South Australia","ror":"https://ror.org/01p93h210","country_code":"AU","type":"education","lineage":["https://openalex.org/I170239107","https://openalex.org/I4405259444"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Javaan Chahl","raw_affiliation_strings":["School of Engineering, University of South Australia, Mawson Lakes, SA 5095, Australia"],"raw_orcid":"https://orcid.org/0000-0001-6496-0543","affiliations":[{"raw_affiliation_string":"School of Engineering, University of South Australia, Mawson Lakes, SA 5095, Australia","institution_ids":["https://openalex.org/I170239107"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":["https://openalex.org/A5000023371"],"corresponding_institution_ids":["https://openalex.org/I170239107","https://openalex.org/I4210115078"],"apc_list":{"value":2300,"currency":"CHF","value_usd":2558},"apc_paid":{"value":2300,"currency":"CHF","value_usd":2558},"fwci":3.4403,"has_fulltext":true,"cited_by_count":14,"citation_normalized_percentile":{"value":0.92459783,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":98},"biblio":{"volume":"13","issue":"3","first_page":"1972","last_page":"1972"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware-detection","display_name":"malware detection","score":0.9990000128746033},{"id":"https://openalex.org/keywords/api-call-sequences","display_name":"API call sequences","score":0.9359999895095825},{"id":"https://openalex.org/keywords/feature-engineering","display_name":"feature engineering","score":0.8109999895095825},{"id":"https://openalex.org/keywords/edge-computing","display_name":"edge computing","score":0.8259999752044678},{"id":"https://openalex.org/keywords/real-time-malware-detection","display_name":"real-time malware detection","score":0.875},{"id":"https://openalex.org/keywords/lightweight-machine-learning","display_name":"lightweight machine learning","score":0.5070000290870667},{"id":"https://openalex.org/keywords/jaccard-similarity","display_name":"Jaccard similarity","score":0.7900000214576721},{"id":"https://openalex.org/keywords/random-forest","display_name":"random forest","score":0.6740000247955322},{"id":"https://openalex.org/keywords/long-short-term-memory","display_name":"long short-term memory","score":0.8220000267028809},{"id":"https://openalex.org/keywords/support-vector-machine","display_name":"support vector machine","score":0.7689999938011169},{"id":"https://openalex.org/keywords/k-nearest-neighbors","display_name":"k-nearest neighbors","score":0.9229999780654907}],"concepts":[{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.8110989332199097},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7985992431640625},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.6014164090156555},{"id":"https://openalex.org/C81363708","wikidata":"https://www.wikidata.org/wiki/Q17084460","display_name":"Convolutional neural network","level":2,"score":0.5916310548782349},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5560073852539062},{"id":"https://openalex.org/C169258074","wikidata":"https://www.wikidata.org/wiki/Q245748","display_name":"Random forest","level":2,"score":0.5178223252296448},{"id":"https://openalex.org/C2778579508","wikidata":"https://www.wikidata.org/wiki/Q722192","display_name":"System call","level":2,"score":0.4793689548969269},{"id":"https://openalex.org/C162307627","wikidata":"https://www.wikidata.org/wiki/Q204833","display_name":"Enhanced Data Rates for GSM Evolution","level":2,"score":0.4559306800365448},{"id":"https://openalex.org/C12267149","wikidata":"https://www.wikidata.org/wiki/Q282453","display_name":"Support vector machine","level":2,"score":0.45301181077957153},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.45093074440956116},{"id":"https://openalex.org/C99613125","wikidata":"https://www.wikidata.org/wiki/Q165194","display_name":"Application programming interface","level":2,"score":0.4376547336578369},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.37221282720565796},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.1964518427848816},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.18582379817962646}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.3390/app13031972","doi":"https://doi.org/10.3390/app13031972","is_oa":true,"landing_page_url":"https://doi.org/10.3390/app13031972","pdf_url":"https://www.mdpi.com/2076-3417/13/3/1972/pdf?version=1675390251","source":{"id":"https://openalex.org/S4210205812","display_name":"Applied Sciences","issn_l":"2076-3417","issn":["2076-3417"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["anvur-class-a","anvur-scientific","cwts-core","doaj","norway-1","oarl","poland-100","russia-white-list-2","vabb-shw"],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Applied Sciences","raw_type":"journal-article"},{"id":"pmh:oai:urm_publish:9916716431101831","doi":null,"is_oa":true,"landing_page_url":"https://find.library.unisa.edu.au/discovery/fulldisplay/alma9916716431101831/61USOUTHAUS_INST:ROR","pdf_url":null,"source":{"id":"https://openalex.org/S4306402528","display_name":"UniSA Research Outputs Repository (University of South Australia)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I170239107","host_organization_name":"University of South Australia","host_organization_lineage":["https://openalex.org/I170239107"],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"text"},{"id":"pmh:oai:doaj.org/article:62ebf6dd94054647ad1090fe32627754","doi":null,"is_oa":true,"landing_page_url":"https://doaj.org/article/62ebf6dd94054647ad1090fe32627754","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Applied Sciences, Vol 13, Iss 3, p 1972 (2023)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.3390/app13031972","doi":"https://doi.org/10.3390/app13031972","is_oa":true,"landing_page_url":"https://doi.org/10.3390/app13031972","pdf_url":"https://www.mdpi.com/2076-3417/13/3/1972/pdf?version=1675390251","source":{"id":"https://openalex.org/S4210205812","display_name":"Applied Sciences","issn_l":"2076-3417","issn":["2076-3417"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["anvur-class-a","anvur-scientific","cwts-core","doaj","norway-1","oarl","poland-100","russia-white-list-2","vabb-shw"],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Applied Sciences","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4319083647.pdf","grobid_xml":"https://content.openalex.org/works/W4319083647.grobid-xml"},"referenced_works_count":40,"referenced_works":["https://openalex.org/W1885191653","https://openalex.org/W1966917005","https://openalex.org/W1995416968","https://openalex.org/W2099425933","https://openalex.org/W2307930854","https://openalex.org/W2520494781","https://openalex.org/W2747715470","https://openalex.org/W2754462941","https://openalex.org/W2759756166","https://openalex.org/W2776884785","https://openalex.org/W2808519772","https://openalex.org/W2889435903","https://openalex.org/W2898457271","https://openalex.org/W2917661079","https://openalex.org/W2939746199","https://openalex.org/W2952766703","https://openalex.org/W2969763191","https://openalex.org/W2981089613","https://openalex.org/W2990166555","https://openalex.org/W2997139308","https://openalex.org/W3000953536","https://openalex.org/W3003663951","https://openalex.org/W3007686746","https://openalex.org/W3025864274","https://openalex.org/W3039822732","https://openalex.org/W3090136535","https://openalex.org/W3095563611","https://openalex.org/W3117169309","https://openalex.org/W3127265720","https://openalex.org/W3158694465","https://openalex.org/W3171309826","https://openalex.org/W4210802791","https://openalex.org/W4224306926","https://openalex.org/W4238979297","https://openalex.org/W4288060471","https://openalex.org/W4293106276","https://openalex.org/W4294383271","https://openalex.org/W4308973957","https://openalex.org/W4309089711","https://openalex.org/W6888444293"],"related_works":["https://openalex.org/W4308973957","https://openalex.org/W4388221193","https://openalex.org/W4210802791","https://openalex.org/W4407759826","https://openalex.org/W4292820477","https://openalex.org/W4360982091","https://openalex.org/W4402827750","https://openalex.org/W4312566881","https://openalex.org/W2778638786","https://openalex.org/W1635909507"],"abstract_inverted_index":{"Malware":[0],"is":[1,12,49,76,97],"the":[2,7,36,39,52,60,111,198],"primary":[3],"attack":[4],"vector":[5,148],"against":[6],"modern":[8],"enterprise.":[9],"Therefore,":[10],"it":[11],"crucial":[13,50],"for":[14,200],"businesses":[15],"to":[16,27,71,109,121,183],"exclude":[17],"malware":[18,91,173],"from":[19],"their":[20],"computer":[21],"systems.":[22],"The":[23,68,158,176],"most":[24],"responsive":[25],"solution":[26,48,75],"this":[28,123],"issue":[29],"would":[30],"operate":[31],"in":[32,119,206],"real":[33],"time":[34],"at":[35,51],"edge":[37,53,204],"of":[38,62,135,165],"IT":[40],"system":[41],"using":[42],"artificial":[43],"intelligence.":[44],"However,":[45,82],"a":[46,74,89,98,207],"lightweight":[47],"because":[54],"these":[55],"options":[56],"are":[57,145],"restricted":[58],"by":[59,115],"lack":[61],"available":[63],"memory":[64,186],"and":[65,106,154,174,188],"processing":[66],"power.":[67],"best":[69],"contender":[70],"offer":[72,88],"such":[73],"application":[77],"programming":[78],"interface":[79],"(API)":[80],"calls.":[81],"creating":[83],"API":[84,117,136,166],"call":[85,167],"characteristics":[86],"that":[87,179],"high":[90],"detection":[92],"rate":[93],"with":[94,138],"quick":[95],"execution":[96],"significant":[99],"challenge.":[100],"This":[101,125],"work":[102],"uses":[103],"visualisation":[104],"analysis":[105],"Jaccard":[107],"similarity":[108],"uncover":[110],"hidden":[112],"patterns":[113],"produced":[114],"different":[116],"calls":[118,137],"order":[120],"accomplish":[122],"goal.":[124],"study":[126],"also":[127,196],"compared":[128],"neural":[129,192],"networks":[130,193],"which":[131],"use":[132],"long":[133,184],"sequences":[134],"shallow":[139],"machine":[140,149],"learning":[141],"classifiers.":[142],"Three":[143],"classifiers":[144],"used:":[146],"support":[147],"(SVM),":[150],"k-nearest":[151],"neighbourhood":[152],"(KNN),":[153],"random":[155],"forest":[156],"(RF).":[157],"benchmark":[159],"data":[160],"set":[161],"comprises":[162],"43,876":[163],"examples":[164],"sequences,":[168],"divided":[169],"into":[170],"two":[171],"categories:":[172],"legitimate.":[175],"results":[177],"showed":[178],"RF":[180],"performed":[181],"similarly":[182],"short-term":[185],"(LSTM)":[187],"deep":[189],"graph":[190],"convolutional":[191],"(DGCNNs).":[194],"They":[195],"suggest":[197],"potential":[199],"performing":[201],"inference":[202],"on":[203],"devices":[205],"real-time":[208],"setting.":[209]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":1},{"year":2024,"cited_by_count":5},{"year":2023,"cited_by_count":5}],"updated_date":"2026-10-16T09:59:22.235173","created_date":"2023-02-04T00:00:00"}