{"id":"https://openalex.org/W7155484584","doi":"https://doi.org/10.1109/icecco67619.2026.11488789","title":"AI-Based Detection of Evasive Malware Using Machine Learning and Deep Learning Techniques","display_name":"AI-Based Detection of Evasive Malware Using Machine Learning and Deep Learning Techniques","publication_year":2026,"publication_date":"2026-04-10","ids":{"openalex":"https://openalex.org/W7155484584","doi":"https://doi.org/10.1109/icecco67619.2026.11488789"},"language":"en","primary_location":{"id":"doi:10.1109/icecco67619.2026.11488789","doi":"https://doi.org/10.1109/icecco67619.2026.11488789","is_oa":false,"landing_page_url":"https://doi.org/10.1109/icecco67619.2026.11488789","pdf_url":null,"source":{"id":"https://openalex.org/S4306419414","display_name":"International Conference on Electronics, Computer and Computation","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2026 18th International Conference on Electronics, Computer, and Computation (ICECCO)","raw_type":"proceedings-article"},"volume":null,"type":"conference-paper","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5092161266","display_name":"Mohammad Imtiyaz Gulbarga","orcid":"https://orcid.org/0009-0001-6080-5201","observed_orcids":["https://orcid.org/0009-0001-6080-5201"]},"institutions":[{"id":"https://openalex.org/I13377790","display_name":"Ala-Too International University","ror":"https://ror.org/03kj11b67","country_code":"KG","type":"education","lineage":["https://openalex.org/I13377790"]}],"countries":["KG"],"is_corresponding":false,"raw_author_name":"Mohammad Imtiyaz Gulbarga","raw_affiliation_strings":["Ala-Too International University,Department of Computer Science & Engineering,Bishkek,Kyrgyzstan"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Ala-Too International University,Department of Computer Science & Engineering,Bishkek,Kyrgyzstan","institution_ids":["https://openalex.org/I13377790"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5063039198","display_name":"Ruslan Isaev","orcid":"https://orcid.org/0000-0003-4426-8837","observed_orcids":["https://orcid.org/0000-0003-4426-8837"]},"institutions":[{"id":"https://openalex.org/I2800050895","display_name":"Paragon International University","ror":"https://ror.org/02bz9f046","country_code":"KH","type":"education","lineage":["https://openalex.org/I2800050895"]}],"countries":["KH"],"is_corresponding":false,"raw_author_name":"Ruslan Isaev","raw_affiliation_strings":["Paragon International University,Department of Faculty of ICT,Phnom Penh,Cambodia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Paragon International University,Department of Faculty of ICT,Phnom Penh,Cambodia","institution_ids":["https://openalex.org/I2800050895"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5117530586","display_name":"Ruslan Amanov","orcid":"https://orcid.org/0009-0009-3691-9530","observed_orcids":["https://orcid.org/0009-0009-3691-9530"]},"institutions":[{"id":"https://openalex.org/I13377790","display_name":"Ala-Too International University","ror":"https://ror.org/03kj11b67","country_code":"KG","type":"education","lineage":["https://openalex.org/I13377790"]}],"countries":["KG"],"is_corresponding":false,"raw_author_name":"Ruslan Amanov","raw_affiliation_strings":["Ala-Too International University,Department of Engineering and Information,Bishkek,Kyrgyzstan"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Ala-Too International University,Department of Engineering and Information,Bishkek,Kyrgyzstan","institution_ids":["https://openalex.org/I13377790"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.0,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"6"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/memory-forensics","display_name":"memory forensics","score":0.9409999847412109},{"id":"https://openalex.org/keywords/malware-obfuscation","display_name":"malware obfuscation","score":0.6579999923706055},{"id":"https://openalex.org/keywords/polymorphic-malware","display_name":"polymorphic malware","score":0.7979999780654907},{"id":"https://openalex.org/keywords/anti-analysis-techniques","display_name":"anti-analysis techniques","score":0.7680000066757202},{"id":"https://openalex.org/keywords/ensemble-learning","display_name":"ensemble learning","score":0.6930000185966492},{"id":"https://openalex.org/keywords/behavioral-characteristics","display_name":"behavioral characteristics","score":0.7289999723434448},{"id":"https://openalex.org/keywords/ransomware","display_name":"ransomware","score":0.9210000038146973},{"id":"https://openalex.org/keywords/spyware","display_name":"spyware","score":0.9980000257492065},{"id":"https://openalex.org/keywords/trojan-horse","display_name":"Trojan horse","score":0.7799999713897705},{"id":"https://openalex.org/keywords/real-time-malware-detection","display_name":"real-time malware detection","score":0.7139999866485596}],"concepts":[{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.7631999850273132},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.7257999777793884},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6707000136375427},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5016999840736389},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.4415999948978424},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.30390000343322754},{"id":"https://openalex.org/C97385483","wikidata":"https://www.wikidata.org/wiki/Q16954980","display_name":"Deep belief network","level":3,"score":0.29440000653266907},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.2865999937057495},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.27970001101493835},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.27149999141693115},{"id":"https://openalex.org/C81363708","wikidata":"https://www.wikidata.org/wiki/Q17084460","display_name":"Convolutional neural network","level":2,"score":0.27000001072883606},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.26249998807907104},{"id":"https://openalex.org/C2984842247","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep neural networks","level":3,"score":0.2572999894618988},{"id":"https://openalex.org/C77967617","wikidata":"https://www.wikidata.org/wiki/Q4677561","display_name":"Active learning (machine learning)","level":2,"score":0.2513999938964844}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/icecco67619.2026.11488789","doi":"https://doi.org/10.1109/icecco67619.2026.11488789","is_oa":false,"landing_page_url":"https://doi.org/10.1109/icecco67619.2026.11488789","pdf_url":null,"source":{"id":"https://openalex.org/S4306419414","display_name":"International Conference on Electronics, Computer and Computation","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2026 18th International Conference on Electronics, Computer, and Computation (ICECCO)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":27,"referenced_works":["https://openalex.org/W1984999133","https://openalex.org/W2005662348","https://openalex.org/W2010065958","https://openalex.org/W2044660163","https://openalex.org/W2415908313","https://openalex.org/W2612449038","https://openalex.org/W2744934275","https://openalex.org/W2748761731","https://openalex.org/W2766465617","https://openalex.org/W2884916882","https://openalex.org/W2894211014","https://openalex.org/W2968309075","https://openalex.org/W2972262359","https://openalex.org/W2994768176","https://openalex.org/W2998961572","https://openalex.org/W3003302059","https://openalex.org/W3016265004","https://openalex.org/W3104119181","https://openalex.org/W3118382796","https://openalex.org/W3118507196","https://openalex.org/W4293790419","https://openalex.org/W4327952342","https://openalex.org/W4380562987","https://openalex.org/W4385481489","https://openalex.org/W4393276298","https://openalex.org/W4395112285","https://openalex.org/W4408529537"],"related_works":["https://openalex.org/W4414974535","https://openalex.org/W4395112285","https://openalex.org/W4392854681","https://openalex.org/W7128516265","https://openalex.org/W7072064804","https://openalex.org/W4388937774","https://openalex.org/W7133509036","https://openalex.org/W4416908944","https://openalex.org/W4388430735","https://openalex.org/W2436787372"],"abstract_inverted_index":{"Modern":[0],"malware":[1,64,75],"increasingly":[2],"employs":[3],"sophisticated":[4],"evasion":[5],"techniques,":[6],"including":[7],"obfuscation,":[8],"polymorphism,":[9],"and":[10,79,105],"anti-analysis":[11],"mechanisms,":[12],"to":[13,57],"bypass":[14],"traditional":[15,101],"detection":[16,93],"systems.":[17],"Memory":[18],"analysis":[19],"captures":[20],"runtime":[21],"behavioral":[22,60],"characteristics":[23],"that":[24,42],"persist":[25],"regardless":[26],"of":[27,69],"code-level":[28],"alterations,":[29],"limiting":[30],"practical":[31],"deployment.":[32,110],"To":[33],"address":[34],"this":[35],"crucial":[36],"gap,":[37],"we":[38],"propose":[39],"a":[40],"framework":[41],"combines":[43],"memory":[44,71],"forensics":[45],"with":[46],"ensemble":[47,90],"machine":[48],"learning.":[49],"We":[50],"extended":[51],"the":[52],"Advanced-VolMemLyzer":[53],"tool":[54],"from":[55,84],"75":[56],"over":[58],"250":[59],"features,":[61],"targeting":[62],"evasive":[63],"indicators.":[65],"A":[66],"balanced":[67],"dataset":[68],"58,596":[70],"samples":[72],"covering":[73],"three":[74],"families":[76],"Ransomware,":[77],"Spyware,":[78],"Trojan":[80],"Horse":[81],"was":[82],"assembled":[83],"real-world":[85],"specimens.":[86],"The":[87],"two-layer":[88],"stacked":[89],"reached":[91],"99%":[92],"accuracy":[94],"at":[95],"0.23":[96],"seconds":[97],"per":[98],"sample,":[99],"outperforming":[100],"signature-based":[102],"approaches":[103],"(78.4%)":[104],"remaining":[106],"feasible":[107],"for":[108],"real-time":[109]},"counts_by_year":[],"updated_date":"2026-11-10T11:39:43.021295","created_date":"2026-04-25T00:00:00"}