{"id":"https://openalex.org/W7203840205","doi":"https://doi.org/10.25045/forensic.gov.2026.18","title":"Deep Learning for Malware Detection: TransformerBased Analysis of Windows Executables","display_name":"Deep Learning for Malware Detection: TransformerBased Analysis of Windows Executables","publication_year":2026,"publication_date":"2026-08-10","ids":{"openalex":"https://openalex.org/W7203840205","doi":"https://doi.org/10.25045/forensic.gov.2026.18"},"language":"en","primary_location":{"id":"doi:10.25045/forensic.gov.2026.18","doi":"https://doi.org/10.25045/forensic.gov.2026.18","is_oa":true,"landing_page_url":"https://doi.org/10.25045/forensic.gov.2026.18","pdf_url":"https://doi.org/10.25045/forensic.gov.2026.18","source":{"id":"https://openalex.org/S7407104651","display_name":"Republican Scientific-Practical Conference \"Actual Problems of Cybersecurity and Digital Forensics\"","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"\u201cKibert\u0259hl\u00fck\u0259sizlik v\u0259 r\u0259q\u0259msal kriminalistikan\u0131n aktual probleml\u0259ri\u201d respublika elmi-praktiki konfrans\u0131","raw_type":"proceedings-article"},"volume":null,"type":"conference-paper","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"bronze","oa_url":"https://doi.org/10.25045/forensic.gov.2026.18","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5040791152","display_name":"Elshan Baghirov","orcid":"https://orcid.org/0000-0002-5940-4136","observed_orcids":["https://orcid.org/0000-0002-5940-4136"]},"institutions":[{"id":"https://openalex.org/I4405273140","display_name":"Institute of Information Technology","ror":"https://ror.org/05betsd49","country_code":"AZ","type":"facility","lineage":["https://openalex.org/I4210115115","https://openalex.org/I4405273140"]}],"countries":["AZ"],"is_corresponding":true,"raw_author_name":"Elshan Baghirov","raw_affiliation_strings":["Institute of Information Technology, Baku, Azerbaijan"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Technology, Baku, Azerbaijan","institution_ids":["https://openalex.org/I4405273140"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5040791152"],"corresponding_institution_ids":["https://openalex.org/I4405273140"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.0,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"100","last_page":"106"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware-detection","display_name":"malware detection","score":1.0},{"id":"https://openalex.org/keywords/windows-executable-files","display_name":"Windows executable files","score":0.7099999785423279},{"id":"https://openalex.org/keywords/portable-executable","display_name":"Portable Executable","score":0.7369999885559082},{"id":"https://openalex.org/keywords/transformer","display_name":"transformer models","score":0.7519999742507935},{"id":"https://openalex.org/keywords/self-attention","display_name":"self-attention","score":0.972000002861023},{"id":"https://openalex.org/keywords/entropy-features","display_name":"entropy features","score":0.9139999747276306},{"id":"https://openalex.org/keywords/multimodal-fusion","display_name":"multimodal fusion","score":0.7860000133514404},{"id":"https://openalex.org/keywords/attention-visualization","display_name":"attention visualization","score":0.7839999794960022},{"id":"https://openalex.org/keywords/explainability","display_name":"explainability","score":0.6380000114440918}],"concepts":[{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.7770000100135803},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7730000019073486},{"id":"https://openalex.org/C160145156","wikidata":"https://www.wikidata.org/wiki/Q778586","display_name":"Executable","level":2,"score":0.7723000049591064},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.7368999719619751},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.6722999811172485},{"id":"https://openalex.org/C43364308","wikidata":"https://www.wikidata.org/wiki/Q8799","display_name":"Byte","level":2,"score":0.6144000291824341},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.49140000343322754},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.42730000615119934},{"id":"https://openalex.org/C106301342","wikidata":"https://www.wikidata.org/wiki/Q4117933","display_name":"Entropy (arrow of time)","level":2,"score":0.39649999141693115},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.37869998812675476},{"id":"https://openalex.org/C508378895","wikidata":"https://www.wikidata.org/wiki/Q1406","display_name":"Microsoft Windows","level":3,"score":0.3560999929904938},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.34850001335144043},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.34439998865127563},{"id":"https://openalex.org/C132964779","wikidata":"https://www.wikidata.org/wiki/Q2110223","display_name":"Raw data","level":2,"score":0.3285999894142151},{"id":"https://openalex.org/C2781251061","wikidata":"https://www.wikidata.org/wiki/Q5416089","display_name":"Evasion (ethics)","level":3,"score":0.3253999948501587},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.3061999976634979},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.29280000925064087},{"id":"https://openalex.org/C153083717","wikidata":"https://www.wikidata.org/wiki/Q6535263","display_name":"Leverage (statistics)","level":2,"score":0.2921999990940094},{"id":"https://openalex.org/C40305131","wikidata":"https://www.wikidata.org/wiki/Q2616305","display_name":"Obfuscation","level":2,"score":0.27970001101493835},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.272599995136261},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.2506999969482422}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.25045/forensic.gov.2026.18","doi":"https://doi.org/10.25045/forensic.gov.2026.18","is_oa":true,"landing_page_url":"https://doi.org/10.25045/forensic.gov.2026.18","pdf_url":"https://doi.org/10.25045/forensic.gov.2026.18","source":{"id":"https://openalex.org/S7407104651","display_name":"Republican Scientific-Practical Conference \"Actual Problems of Cybersecurity and Digital Forensics\"","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"\u201cKibert\u0259hl\u00fck\u0259sizlik v\u0259 r\u0259q\u0259msal kriminalistikan\u0131n aktual probleml\u0259ri\u201d respublika elmi-praktiki konfrans\u0131","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.25045/forensic.gov.2026.18","doi":"https://doi.org/10.25045/forensic.gov.2026.18","is_oa":true,"landing_page_url":"https://doi.org/10.25045/forensic.gov.2026.18","pdf_url":"https://doi.org/10.25045/forensic.gov.2026.18","source":{"id":"https://openalex.org/S7407104651","display_name":"Republican Scientific-Practical Conference \"Actual Problems of Cybersecurity and Digital Forensics\"","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"\u201cKibert\u0259hl\u00fck\u0259sizlik v\u0259 r\u0259q\u0259msal kriminalistikan\u0131n aktual probleml\u0259ri\u201d respublika elmi-praktiki konfrans\u0131","raw_type":"proceedings-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7203840205.pdf","grobid_xml":"https://content.openalex.org/works/W7203840205.grobid-xml"},"referenced_works_count":11,"referenced_works":["https://openalex.org/W1816313093","https://openalex.org/W2150423842","https://openalex.org/W2963341956","https://openalex.org/W3006334803","https://openalex.org/W3111237076","https://openalex.org/W4385688277","https://openalex.org/W4393276298","https://openalex.org/W4400267597","https://openalex.org/W4409320654","https://openalex.org/W4409919312","https://openalex.org/W4412876938"],"related_works":["https://openalex.org/W4404609239","https://openalex.org/W4399881981","https://openalex.org/W7169649120","https://openalex.org/W3136733941","https://openalex.org/W7202202342","https://openalex.org/W4394994376","https://openalex.org/W7118172778","https://openalex.org/W4313315004","https://openalex.org/W4387490025","https://openalex.org/W7170086662"],"abstract_inverted_index":{"Malware":[0],"detection":[1],"is":[2,24,49,69,88],"challenged":[3],"by":[4],"unprecedented":[5],"threats":[6],"exceeding":[7],"560,000":[8],"new":[9],"variants":[10],"daily.":[11],"A":[12,38],"Transformerbased":[13],"deep":[14],"learning":[15],"approach":[16],"for":[17,85],"detecting":[18],"malicious":[19],"Windows":[20],"Portable":[21],"Executable":[22],"files":[23],"presented.":[25],"Raw":[26],"byte":[27],"sequences":[28],"are":[29],"processed":[30],"using":[31],"self-attention":[32],"mechanisms,":[33],"eliminating":[34],"manual":[35],"feature":[36],"engineering.":[37],"multi-modal":[39],"framework":[40],"combining":[41],"raw":[42],"bytes,":[43],"PE":[44],"metadata,":[45],"and":[46,58,80],"entropy":[47],"features":[48],"implemented.":[50],"Through":[51],"experimental":[52],"evaluation":[53],"on":[54],"EMBER2024":[55],"(3.2M":[56],"samples)":[57],"SOREL-20M":[59],"(20M":[60],"samples),":[61],"95.1%":[62],"accuracy":[63],"with":[64],"0.4%":[65],"false":[66],"positive":[67],"rate":[68],"demonstrated,":[70],"significantly":[71],"outperforming":[72],"baseline":[73],"methods":[74],"including":[75],"LightGBM":[76],"(92.7%),":[77],"MalConv":[78],"(93.4%),":[79],"LSTM":[81],"approaches":[82],"(91.8%).":[83],"Explainability":[84],"forensic":[86],"analysis":[87],"provided":[89],"through":[90],"attention":[91],"visualization.":[92]},"counts_by_year":[],"updated_date":"2026-11-04T10:54:05.112534","created_date":"2026-08-21T00:00:00"}