{"id":"https://openalex.org/W4392883014","doi":"https://doi.org/10.1007/s10207-024-00836-w","title":"A new approach for detecting process injection attacks using memory analysis","display_name":"A new approach for detecting process injection attacks using memory analysis","publication_year":2024,"publication_date":"2024-03-16","ids":{"openalex":"https://openalex.org/W4392883014","doi":"https://doi.org/10.1007/s10207-024-00836-w"},"language":"en","primary_location":{"id":"doi:10.1007/s10207-024-00836-w","doi":"https://doi.org/10.1007/s10207-024-00836-w","is_oa":false,"landing_page_url":"https://doi.org/10.1007/s10207-024-00836-w","pdf_url":null,"source":{"id":"https://openalex.org/S164062316","display_name":"International Journal of Information Security","issn_l":"1615-5262","issn":["1615-5262","1615-5270"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core","dongbi-d","jufo-1","norway-2","poland-100","russia-white-list-2"],"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal of Information Security","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://www.researchsquare.com/article/rs-3252716/latest.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5066169470","display_name":"Mohammed Nasereddin","orcid":"https://orcid.org/0000-0002-3740-9518","observed_orcids":["https://orcid.org/0000-0002-3740-9518"]},"institutions":[{"id":"https://openalex.org/I4210122744","display_name":"Institute of Theoretical and Applied Informatics","ror":"https://ror.org/037p52j25","country_code":"PL","type":"facility","lineage":["https://openalex.org/I4210122744","https://openalex.org/I99542240"]},{"id":"https://openalex.org/I99542240","display_name":"Polish Academy of Sciences","ror":"https://ror.org/01dr6c206","country_code":"PL","type":"government","lineage":["https://openalex.org/I99542240"]}],"countries":["PL"],"is_corresponding":true,"raw_author_name":"Mohammed Nasereddin","raw_affiliation_strings":["Institute of Theoretical and Applied Informatics, Polish Academy of Sciences (IITiS PAN), 44100, Gliwice, Poland"],"raw_orcid":"https://orcid.org/0000-0002-3740-9518","affiliations":[{"raw_affiliation_string":"Institute of Theoretical and Applied Informatics, Polish Academy of Sciences (IITiS PAN), 44100, Gliwice, Poland","institution_ids":["https://openalex.org/I4210122744","https://openalex.org/I99542240"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5039632338","display_name":"Raad S. Al\u2010Qassas","orcid":"https://orcid.org/0000-0002-5836-1111","observed_orcids":["https://orcid.org/0000-0002-5836-1111"]},"institutions":[{"id":"https://openalex.org/I158749337","display_name":"Princess Sumaya University for Technology","ror":"https://ror.org/01jy46q10","country_code":"JO","type":"education","lineage":["https://openalex.org/I158749337"]}],"countries":["JO"],"is_corresponding":false,"raw_author_name":"Raad Al-Qassas","raw_affiliation_strings":["Department of Computer Science, Princess Sumaya University for Technology, Amman, Jordan"],"raw_orcid":"https://orcid.org/0000-0002-5836-1111","affiliations":[{"raw_affiliation_string":"Department of Computer Science, Princess Sumaya University for Technology, Amman, Jordan","institution_ids":["https://openalex.org/I158749337"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":["https://openalex.org/A5066169470"],"corresponding_institution_ids":["https://openalex.org/I4210122744","https://openalex.org/I99542240"],"apc_list":{"value":3490,"currency":"USD","value_usd":3490},"apc_paid":null,"fwci":5.3902,"has_fulltext":false,"cited_by_count":16,"citation_normalized_percentile":{"value":0.95923849,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":95,"max":99},"biblio":{"volume":"23","issue":"3","first_page":"2099","last_page":"2121"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9951000213623047,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9951000213623047,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.002199999988079071,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.002199999988079071,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/fileless-malware","display_name":"fileless malware","score":0.953000009059906},{"id":"https://openalex.org/keywords/memory-analysis","display_name":"memory analysis","score":0.8339999914169312},{"id":"https://openalex.org/keywords/parallel-computing","display_name":"parallel computing","score":0.5950000286102295},{"id":"https://openalex.org/keywords/malware-detection","display_name":"malware detection","score":0.7310000061988831},{"id":"https://openalex.org/keywords/dll-injection","display_name":"DLL injection","score":0.8259999752044678},{"id":"https://openalex.org/keywords/registry-modification","display_name":"registry modification","score":0.7059999704360962}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7694255709648132},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.5981003642082214},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.48328331112861633},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4601145386695862},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.357033371925354},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.22505995631217957}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1007/s10207-024-00836-w","doi":"https://doi.org/10.1007/s10207-024-00836-w","is_oa":false,"landing_page_url":"https://doi.org/10.1007/s10207-024-00836-w","pdf_url":null,"source":{"id":"https://openalex.org/S164062316","display_name":"International Journal of Information Security","issn_l":"1615-5262","issn":["1615-5262","1615-5270"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core","dongbi-d","jufo-1","norway-2","poland-100","russia-white-list-2"],"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal of Information Security","raw_type":"journal-article"},{"id":"doi:10.21203/rs.3.rs-3252716/v1","doi":"https://doi.org/10.21203/rs.3.rs-3252716/v1","is_oa":true,"landing_page_url":"http://dx.doi.org/10.21203/rs.3.rs-3252716/v1","pdf_url":"https://www.researchsquare.com/article/rs-3252716/latest.pdf","source":{"id":"https://openalex.org/S4306525896","display_name":"Research Square","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Research Square","raw_type":"posted-content"}],"best_oa_location":{"id":"doi:10.21203/rs.3.rs-3252716/v1","doi":"https://doi.org/10.21203/rs.3.rs-3252716/v1","is_oa":true,"landing_page_url":"http://dx.doi.org/10.21203/rs.3.rs-3252716/v1","pdf_url":"https://www.researchsquare.com/article/rs-3252716/latest.pdf","source":{"id":"https://openalex.org/S4306525896","display_name":"Research Square","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Research Square","raw_type":"posted-content"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4392883014.pdf","grobid_xml":"https://content.openalex.org/works/W4392883014.grobid-xml"},"referenced_works_count":40,"referenced_works":["https://openalex.org/W1484851474","https://openalex.org/W1513639492","https://openalex.org/W2034304522","https://openalex.org/W2087336585","https://openalex.org/W2187143963","https://openalex.org/W2520494781","https://openalex.org/W2567372275","https://openalex.org/W2751661638","https://openalex.org/W2754184747","https://openalex.org/W2759575792","https://openalex.org/W2787382884","https://openalex.org/W2800516023","https://openalex.org/W2803523233","https://openalex.org/W2887670066","https://openalex.org/W2889205290","https://openalex.org/W2891327276","https://openalex.org/W2894211014","https://openalex.org/W2895892359","https://openalex.org/W2922511789","https://openalex.org/W2959173014","https://openalex.org/W2964357511","https://openalex.org/W2994152001","https://openalex.org/W2998074434","https://openalex.org/W3026827345","https://openalex.org/W3035157465","https://openalex.org/W3049395662","https://openalex.org/W3097672813","https://openalex.org/W3116565206","https://openalex.org/W3121304609","https://openalex.org/W3130732469","https://openalex.org/W3132223643","https://openalex.org/W3209679731","https://openalex.org/W3213401320","https://openalex.org/W4200380830","https://openalex.org/W4205990635","https://openalex.org/W4230846333","https://openalex.org/W4234532623","https://openalex.org/W4246563960","https://openalex.org/W4384282837","https://openalex.org/W6701576959"],"related_works":["https://openalex.org/W4328028490","https://openalex.org/W4253533353","https://openalex.org/W4413175256","https://openalex.org/W3138056083","https://openalex.org/W4287883763","https://openalex.org/W4327952342","https://openalex.org/W7140327420","https://openalex.org/W7133511616","https://openalex.org/W4399118899","https://openalex.org/W4406861863"],"abstract_inverted_index":{"Abstract":[0],"This":[1],"paper":[2],"introduces":[3],"a":[4,26,40,163,198],"new":[5,41,120],"approach":[6,19,71],"for":[7,35,53,66,98],"examining":[8],"and":[9,76,100,125,151,186],"analyzing":[10],"fileless":[11],"malware":[12,111],"artifacts":[13],"in":[14,115,128,173],"computer":[15],"memory.":[16],"The":[17,69,155],"proposed":[18,70],"offers":[20],"the":[21,33,50,60,63,86,91,94,116,119,169,174,187],"distinct":[22],"advantage":[23],"of":[24,30,62,96,109,118,166,176,204],"conducting":[25],"comprehensive":[27],"live":[28],"analysis":[29],"memory":[31,37],"without":[32],"need":[34],"periodic":[36],"dumping.":[38],"Once":[39],"process":[42,65,95,135,145,182],"arrives,":[43],"log":[44],"files":[45],"are":[46],"collected":[47],"by":[48,80],"monitoring":[49],"Event":[51],"Tracing":[52],"Windows":[54],"facility":[55],"as":[56,58],"well":[57],"listing":[59],"executables":[61],"active":[64],"violation":[67],"detection.":[68],"significantly":[72],"reduces":[73],"detection":[74,156,199],"time":[75,200],"minimizes":[77],"resource":[78],"consumption":[79],"adopting":[81],"parallel":[82],"computing":[83],"(programming),":[84],"where":[85],"main":[87],"software":[88],"(Master)":[89],"divides":[90],"work,":[92],"organizes":[93],"searching":[97],"artifacts,":[99],"distributes":[101],"tasks":[102],"to":[103,191],"several":[104,178],"agents":[105],"(Slaves).":[106],"A":[107],"dataset":[108],"17411":[110],"samples":[112],"is":[113],"used":[114],"assessment":[117],"approach.":[121],"It":[122],"provided":[123],"satisfactory":[124],"reliable":[126],"results":[127],"dealing":[129],"with":[130,162,201],"at":[131],"least":[132],"six":[133],"different":[134,181],"injection":[136,183],"techniques":[137,184],"including":[138],"classic":[139],"DLL":[140,143,153],"injection,":[141,144,148],"reflective":[142],"hollowing,":[146],"hook":[147],"registry":[149],"modifications,":[150],".NET":[152],"injection.":[154],"accuracy":[157,170],"rate":[158,165],"has":[159],"reached":[160],"99.93%":[161],"false-positive":[164],"0.068%.":[167],"Moreover,":[168],"was":[171,189],"monitored":[172],"case":[175],"launching":[177],"malwares":[179],"using":[180],"simultaneously,":[185],"detector":[188],"able":[190],"detect":[192],"them":[193],"efficiently.":[194],"Also,":[195],"it":[196],"achieved":[197],"an":[202],"average":[203],"0.052":[205],"msec":[206],"per":[207],"detected":[208],"malware.":[209]},"counts_by_year":[{"year":2026,"cited_by_count":5},{"year":2025,"cited_by_count":8},{"year":2024,"cited_by_count":3}],"updated_date":"2026-11-09T13:22:03.289127","created_date":"2024-03-17T00:00:00"}