{"id":"https://openalex.org/W7224764788","doi":"https://doi.org/10.54097/evhnkb11","title":"The Measurement Framework for Underestimated Failure Modes of Past-only Query Policies in Open-World Malware Family Classification","display_name":"The Measurement Framework for Underestimated Failure Modes of Past-only Query Policies in Open-World Malware Family Classification","publication_year":2026,"publication_date":"2026-10-29","ids":{"openalex":"https://openalex.org/W7224764788","doi":"https://doi.org/10.54097/evhnkb11"},"language":"en","primary_location":{"id":"doi:10.54097/evhnkb11","doi":"https://doi.org/10.54097/evhnkb11","is_oa":true,"landing_page_url":"https://doi.org/10.54097/evhnkb11","pdf_url":"https://drpress.org/ojs/index.php/fcis/article/download/36294/35400","source":{"id":"https://openalex.org/S4387283309","display_name":"Frontiers in Computing and Intelligent Systems","issn_l":"2832-6024","issn":["2832-6024"],"is_oa":true,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core"],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by-nc","license_id":"https://openalex.org/licenses/cc-by-nc","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Frontiers in Computing and Intelligent Systems","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://drpress.org/ojs/index.php/fcis/article/download/36294/35400","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5160195285","display_name":"Jiali Che","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I860388503","display_name":"Sias University","ror":"https://ror.org/02z8rzb71","country_code":"CN","type":"education","lineage":["https://openalex.org/I860388503"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jiali Che","raw_affiliation_strings":["Sias University, Xinzheng, Henan, 451100, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Sias University, Xinzheng, Henan, 451100, China","institution_ids":["https://openalex.org/I860388503"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5160214721","display_name":"Haoqing Ren","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I860388503","display_name":"Sias University","ror":"https://ror.org/02z8rzb71","country_code":"CN","type":"education","lineage":["https://openalex.org/I860388503"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Haoqing Ren","raw_affiliation_strings":["Sias University, Xinzheng, Henan, 451100, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Sias University, Xinzheng, Henan, 451100, China","institution_ids":["https://openalex.org/I860388503"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5160219305","display_name":"Tingting Sun","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I860388503","display_name":"Sias University","ror":"https://ror.org/02z8rzb71","country_code":"CN","type":"education","lineage":["https://openalex.org/I860388503"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Tingting Sun","raw_affiliation_strings":["Sias University, Xinzheng, Henan, 451100, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Sias University, Xinzheng, Henan, 451100, China","institution_ids":["https://openalex.org/I860388503"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I860388503"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.8988016,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"18","issue":"2","first_page":"50","last_page":"54"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/failure-modes","display_name":"failure modes","score":0.3240000009536743},{"id":"https://openalex.org/keywords/preregistration","display_name":"preregistration","score":0.7919999957084656},{"id":"https://openalex.org/keywords/motifs","display_name":"motifs","score":0.7889999747276306}],"concepts":[{"id":"https://openalex.org/C2778689934","wikidata":"https://www.wikidata.org/wiki/Q1313396","display_name":"Headline","level":2,"score":0.6924999952316284},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6388000249862671},{"id":"https://openalex.org/C2908647359","wikidata":"https://www.wikidata.org/wiki/Q2625603","display_name":"Population","level":2,"score":0.5139999985694885},{"id":"https://openalex.org/C2780148112","wikidata":"https://www.wikidata.org/wiki/Q1432581","display_name":"Proxy (statistics)","level":2,"score":0.44130000472068787},{"id":"https://openalex.org/C81917197","wikidata":"https://www.wikidata.org/wiki/Q628760","display_name":"Selection (genetic algorithm)","level":2,"score":0.42910000681877136},{"id":"https://openalex.org/C2164484","wikidata":"https://www.wikidata.org/wiki/Q5170150","display_name":"Core (optical fiber)","level":2,"score":0.4000000059604645},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.38260000944137573},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.35600000619888306},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.34709998965263367},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3407000005245209},{"id":"https://openalex.org/C148483581","wikidata":"https://www.wikidata.org/wiki/Q446488","display_name":"Feature selection","level":2,"score":0.2973000109195709},{"id":"https://openalex.org/C197947376","wikidata":"https://www.wikidata.org/wiki/Q5155608","display_name":"Comparability","level":2,"score":0.2939000129699707},{"id":"https://openalex.org/C75684735","wikidata":"https://www.wikidata.org/wiki/Q858810","display_name":"Big data","level":2,"score":0.2930999994277954},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.28130000829696655},{"id":"https://openalex.org/C61797465","wikidata":"https://www.wikidata.org/wiki/Q1188986","display_name":"Term (time)","level":2,"score":0.27619999647140503},{"id":"https://openalex.org/C18762648","wikidata":"https://www.wikidata.org/wiki/Q42213","display_name":"Work (physics)","level":2,"score":0.2743000090122223},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.2646999955177307},{"id":"https://openalex.org/C79897977","wikidata":"https://www.wikidata.org/wiki/Q5054568","display_name":"Causal chain","level":2,"score":0.26420000195503235},{"id":"https://openalex.org/C187691185","wikidata":"https://www.wikidata.org/wiki/Q2020720","display_name":"Grid","level":2,"score":0.2639000117778778}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.54097/evhnkb11","doi":"https://doi.org/10.54097/evhnkb11","is_oa":true,"landing_page_url":"https://doi.org/10.54097/evhnkb11","pdf_url":"https://drpress.org/ojs/index.php/fcis/article/download/36294/35400","source":{"id":"https://openalex.org/S4387283309","display_name":"Frontiers in Computing and Intelligent Systems","issn_l":"2832-6024","issn":["2832-6024"],"is_oa":true,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core"],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by-nc","license_id":"https://openalex.org/licenses/cc-by-nc","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Frontiers in Computing and Intelligent Systems","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.54097/evhnkb11","doi":"https://doi.org/10.54097/evhnkb11","is_oa":true,"landing_page_url":"https://doi.org/10.54097/evhnkb11","pdf_url":"https://drpress.org/ojs/index.php/fcis/article/download/36294/35400","source":{"id":"https://openalex.org/S4387283309","display_name":"Frontiers in Computing and Intelligent Systems","issn_l":"2832-6024","issn":["2832-6024"],"is_oa":true,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core"],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by-nc","license_id":"https://openalex.org/licenses/cc-by-nc","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Frontiers in Computing and Intelligent Systems","raw_type":"journal-article"},"sustainable_development_goals":[{"display_name":"Good health and well-being","score":0.4000000059604645,"id":"https://metadata.un.org/sdg/3"}],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7224764788.pdf","grobid_xml":"https://content.openalex.org/works/W7224764788.grobid-xml"},"referenced_works_count":10,"referenced_works":["https://openalex.org/W3110824252","https://openalex.org/W3178593045","https://openalex.org/W4296068317","https://openalex.org/W4297677416","https://openalex.org/W4384948606","https://openalex.org/W4385412358","https://openalex.org/W4389169163","https://openalex.org/W4412876938","https://openalex.org/W4414987586","https://openalex.org/W7138413809"],"related_works":["https://openalex.org/W7213091880","https://openalex.org/W6884868444","https://openalex.org/W7223260530","https://openalex.org/W2805815600","https://openalex.org/W6906675791","https://openalex.org/W2807452346","https://openalex.org/W4414987586","https://openalex.org/W2735957632","https://openalex.org/W7221210506","https://openalex.org/W7169754408"],"abstract_inverted_index":{"Laboratories":[0],"that":[1,23,95,199],"evaluate":[2],"open-world":[3],"malware":[4],"family":[5],"classifiers":[6],"typically":[7],"ship":[8],"a":[9,16,56,63,71,75,79,217],"query":[10],"or":[11],"abstention":[12],"policy":[13,35,65],"chosen":[14],"on":[15,39],"historical":[17],"proxy":[18],"window.":[19],"The":[20,192],"work":[21,210],"argues":[22],"this":[24],"past-only":[25,77,200],"selection":[26,201],"step":[27],"constitutes":[28],"an":[29,181],"underestimated":[30],"failure":[31],"mode:":[32],"the":[33,40,46,112,131,146,158,163,185,209,214],"proxy-optimal":[34],"can":[36],"be":[37],"unsafe":[38],"next":[41],"unseen-family":[42],"window":[43],"even":[44],"when":[45],"candidate":[47],"grid":[48],"is":[49,128,149,198],"fixed.":[50],"This":[51,167],"problem":[52],"differs":[53],"from":[54],"training":[55],"better":[57],"classifier,":[58],"per-sample":[59],"rejection,":[60],"and":[61,86,89,107,140,176,208],"learning":[62],"detection-and-labeling":[64],"with":[66,109,142],"future":[67,99],"adaptation.":[68],"It":[69],"presents":[70],"rigorous":[72],"measurement":[73],"framework:":[74],"frozen":[76],"protocol,":[78],"ledger":[80],"of":[81,137,171,216],"negative":[82],"selectors,":[83],"split":[84],"safety":[85,159],"efficacy":[87,134,165],"estimands,":[88],"one":[90],"registered":[91],"instance":[92,113],"named":[93],"MPSR-RSG":[94],"never":[96],"reads":[97],"current":[98],"labels.":[100],"On":[101],"development":[102],"windows":[103],"covering":[104],"BODMAS":[105],"PE":[106],"EMBER2024":[108],"18":[110],"comparisons,":[111],"exhibits":[114],"zero":[115],"failures.":[116],"Across":[117],"12":[118],"baseline-failure":[119,144],"windows,":[120,145],"its":[121],"hierarchical-bootstrap":[122],"95%":[123],"CI":[124,148],"for":[125],"failure-rate":[126],"reduction":[127],"[0.25,":[129],"1.00].For":[130],"preregistered":[132],"held-out":[133],"population":[135],"consisting":[136],"Avast-CTU":[138],"CAPEv2":[139],"MOTIF":[141],"9":[143],"corresponding":[147],"[0.22,":[150],"1.00].BODMAS":[151],"Phase":[152],"0a":[153],"cutoffs":[154],"are":[155],"retained":[156],"within":[157],"monitor":[160],"rather":[161,179],"than":[162,180],"confirmatory":[164],"population.":[166],"arrangement":[168],"follows":[169],"considerations":[170],"source":[172],"role,":[173],"chain":[174],"integrity,":[175],"estimand":[177],"identifiability,":[178],"attempt":[182],"to":[183],"improve":[184],"headline":[186],"interval":[187],"by":[188,196],"excluding":[189],"these":[190,206],"data.":[191],"core":[193],"claim":[194],"supported":[195],"experiments":[197],"requires":[202],"high-priority":[203],"evaluation":[204],"under":[205],"constraints,":[207],"does":[211],"not":[212],"prove":[213],"existence":[215],"universal":[218],"selector.":[219]},"counts_by_year":[],"updated_date":"2026-11-06T12:05:46.655746","created_date":"2026-10-31T00:00:00"}