{"id":"https://openalex.org/W7225663254","doi":"https://doi.org/10.3390/computers15110814","title":"How Much Have We Really Progressed? A Leakage-Free Re-Evaluation of API Call-Based Malware Family Classification on Mal-API-2019 and APIMDS","display_name":"How Much Have We Really Progressed? A Leakage-Free Re-Evaluation of API Call-Based Malware Family Classification on Mal-API-2019 and APIMDS","publication_year":2026,"publication_date":"2026-11-08","ids":{"openalex":"https://openalex.org/W7225663254","doi":"https://doi.org/10.3390/computers15110814"},"language":"en","primary_location":{"id":"doi:10.3390/computers15110814","doi":"https://doi.org/10.3390/computers15110814","is_oa":true,"landing_page_url":"https://doi.org/10.3390/computers15110814","pdf_url":null,"source":{"id":"https://openalex.org/S4210228075","display_name":"Computers","issn_l":"2073-431X","issn":["2073-431X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["cwts-core","doaj","norway-1","poland-20","russia-white-list-2"],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computers","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.3390/computers15110814","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5106554958","display_name":"En Naji El Bouchtioui","orcid":"https://orcid.org/0009-0007-6341-0516","observed_orcids":["https://orcid.org/0009-0007-6341-0516"]},"institutions":[{"id":"https://openalex.org/I3121676899","display_name":"Universit\u00e9 Ibn-Tofail","ror":"https://ror.org/02wj89n04","country_code":"MA","type":"education","lineage":["https://openalex.org/I3121676899"]}],"countries":["MA"],"is_corresponding":true,"raw_author_name":"En Naji El Bouchtioui","raw_affiliation_strings":["Department of Computer Science, Faculty of Sciences, Ibn Tofail University, Kenitra 14000, Morocco"],"raw_orcid":"https://orcid.org/0009-0007-6341-0516","affiliations":[{"raw_affiliation_string":"Department of Computer Science, Faculty of Sciences, Ibn Tofail University, Kenitra 14000, Morocco","institution_ids":["https://openalex.org/I3121676899"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5032675439","display_name":"Asmae Bentaleb","orcid":"https://orcid.org/0000-0003-4428-0019","observed_orcids":["https://orcid.org/0000-0003-4428-0019"]},"institutions":[{"id":"https://openalex.org/I3121676899","display_name":"Universit\u00e9 Ibn-Tofail","ror":"https://ror.org/02wj89n04","country_code":"MA","type":"education","lineage":["https://openalex.org/I3121676899"]}],"countries":["MA"],"is_corresponding":true,"raw_author_name":"Asmae Bentaleb","raw_affiliation_strings":["Department of Computer Science, Faculty of Sciences, Ibn Tofail University, Kenitra 14000, Morocco"],"raw_orcid":"https://orcid.org/0000-0003-4428-0019","affiliations":[{"raw_affiliation_string":"Department of Computer Science, Faculty of Sciences, Ibn Tofail University, Kenitra 14000, Morocco","institution_ids":["https://openalex.org/I3121676899"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5033330486","display_name":"J\u00e2afar Abouchabaka","orcid":"https://orcid.org/0000-0003-3193-8416","observed_orcids":["https://orcid.org/0000-0003-3193-8416","https://orcid.org/0000-0002-7275-7999"]},"institutions":[{"id":"https://openalex.org/I3121676899","display_name":"Universit\u00e9 Ibn-Tofail","ror":"https://ror.org/02wj89n04","country_code":"MA","type":"education","lineage":["https://openalex.org/I3121676899"]}],"countries":["MA"],"is_corresponding":false,"raw_author_name":"Jaafar Abouchabaka","raw_affiliation_strings":["Department of Computer Science, Faculty of Sciences, Ibn Tofail University, Kenitra 14000, Morocco"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, Faculty of Sciences, Ibn Tofail University, Kenitra 14000, Morocco","institution_ids":["https://openalex.org/I3121676899"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5032675439","https://openalex.org/A5106554958"],"corresponding_institution_ids":["https://openalex.org/I3121676899"],"apc_list":{"value":1800,"currency":"CHF","value_usd":2172},"apc_paid":{"value":1800,"currency":"CHF","value_usd":2172},"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.0,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"15","issue":"11","first_page":"814","last_page":"814"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware-family-classification","display_name":"malware family classification","score":0.9639999866485596},{"id":"https://openalex.org/keywords/api-call-sequences","display_name":"API call sequences","score":0.9909999966621399},{"id":"https://openalex.org/keywords/data-leakage","display_name":"data leakage","score":0.6639999747276306},{"id":"https://openalex.org/keywords/ensemble-learning","display_name":"ensemble learning","score":0.5839999914169312},{"id":"https://openalex.org/keywords/n-gram-features","display_name":"n-gram features","score":0.7770000100135803},{"id":"https://openalex.org/keywords/gradient-boosting","display_name":"gradient boosting","score":0.6890000104904175},{"id":"https://openalex.org/keywords/malware-detection","display_name":"malware detection","score":0.30399999022483826}],"concepts":[{"id":"https://openalex.org/C186282968","wikidata":"https://www.wikidata.org/wiki/Q1434261","display_name":"McNemar's test","level":2,"score":0.8199999928474426},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.6741999983787537},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6654999852180481},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.5342000126838684},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4634000062942505},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.42089998722076416},{"id":"https://openalex.org/C48372109","wikidata":"https://www.wikidata.org/wiki/Q3913","display_name":"Binary number","level":2,"score":0.41830000281333923},{"id":"https://openalex.org/C204323151","wikidata":"https://www.wikidata.org/wiki/Q905424","display_name":"Range (aeronautics)","level":2,"score":0.37709999084472656},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.34929999709129333},{"id":"https://openalex.org/C2778112365","wikidata":"https://www.wikidata.org/wiki/Q3511065","display_name":"Sequence (biology)","level":2,"score":0.2924000024795532},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.28870001435279846},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.2874000072479248},{"id":"https://openalex.org/C2777267654","wikidata":"https://www.wikidata.org/wiki/Q3519023","display_name":"Test (biology)","level":2,"score":0.27869999408721924},{"id":"https://openalex.org/C123860398","wikidata":"https://www.wikidata.org/wiki/Q6934605","display_name":"Multiclass classification","level":3,"score":0.2712000012397766},{"id":"https://openalex.org/C2780801425","wikidata":"https://www.wikidata.org/wiki/Q5164392","display_name":"Construct (python library)","level":2,"score":0.25529998540878296},{"id":"https://openalex.org/C66905080","wikidata":"https://www.wikidata.org/wiki/Q17005494","display_name":"Binary classification","level":3,"score":0.25209999084472656},{"id":"https://openalex.org/C119898033","wikidata":"https://www.wikidata.org/wiki/Q3433888","display_name":"Ensemble forecasting","level":2,"score":0.2500999867916107}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.3390/computers15110814","doi":"https://doi.org/10.3390/computers15110814","is_oa":true,"landing_page_url":"https://doi.org/10.3390/computers15110814","pdf_url":null,"source":{"id":"https://openalex.org/S4210228075","display_name":"Computers","issn_l":"2073-431X","issn":["2073-431X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["cwts-core","doaj","norway-1","poland-20","russia-white-list-2"],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computers","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.3390/computers15110814","doi":"https://doi.org/10.3390/computers15110814","is_oa":true,"landing_page_url":"https://doi.org/10.3390/computers15110814","pdf_url":null,"source":{"id":"https://openalex.org/S4210228075","display_name":"Computers","issn_l":"2073-431X","issn":["2073-431X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["cwts-core","doaj","norway-1","poland-20","russia-white-list-2"],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computers","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W4410929914","https://openalex.org/W4399028375","https://openalex.org/W4308973957","https://openalex.org/W2532612352","https://openalex.org/W6885184181","https://openalex.org/W7225661080","https://openalex.org/W4399930919","https://openalex.org/W4403792226","https://openalex.org/W4411951765","https://openalex.org/W2780450026"],"abstract_inverted_index":{"Dynamic":[0],"application":[1],"programming":[2],"interface":[3],"(API)":[4],"call":[5,67],"sequences":[6,150],"are":[7,31,145,181,198],"widely":[8],"used":[9],"for":[10],"malware":[11],"family":[12],"classification,":[13],"yet":[14],"the":[15,20,88,113,173,179,190],"multiclass":[16],"accuracies":[17],"published":[18,128],"on":[19,39,66,80,98,107,124,131,137,154,175],"Mal-API-2019":[21,40],"benchmark":[22],"range":[23],"from":[24,112],"46.6%":[25],"to":[26,168,192,201],"99.6%,":[27],"under":[28],"protocols":[29,138],"that":[30,139],"rarely":[32],"comparable.":[33],"We":[34],"present":[35],"a":[36,84],"leakage-free":[37],"re-evaluation":[38],"(7107":[41],"sequences,":[42,48],"eight":[43],"families)":[44],"and":[45,57,71,77,93,95,101,115,183,194,209],"APIMDS":[46,99],"(16,942":[47],"six":[49],"classes),":[50],"with":[51,116],"shared":[52],"partitions,":[53],"five-fold":[54],"cross-validation,":[55],"macro-F1":[56,79],"McNemar":[58],"tests.":[59],"An":[60],"unweighted":[61],"ensemble":[62,91],"of":[63,87,158,178,204],"four":[64],"learners":[65],"frequencies,":[68],"TF-IDF":[69],"n-grams":[70,108],"Skip-gram":[72],"embeddings":[73],"reaches":[74],"70.0%":[75],"accuracy":[76],"71.0%":[78],"Mal-API-2019,":[81,155],"significantly":[82],"outperforming":[83],"faithful":[85],"re-implementation":[86],"state-of-the-art":[89],"EPCP":[90,97],"(66.7%":[92],"67.6%),":[94],"matches":[96],"(91.6%":[100],"79.9%).":[102],"A":[103],"single":[104],"gradient-boosting":[105],"model":[106],"is":[109,162],"statistically":[110],"indistinguishable":[111],"ensemble,":[114],"fixed":[117],"configurations,":[118],"deep":[119],"sequential":[120],"models":[121,197],"remain":[122],"behind":[123],"Mal-API-2019.":[125],"The":[126],"highest":[127],"results":[129],"rely":[130],"one-vs-rest":[132],"or":[133,136,144],"binary":[134],"metrics,":[135],"can":[140],"leak":[141],"test":[142,160],"information":[143],"not":[146],"fully":[147],"specified.":[148],"Duplicated":[149],"inflate":[151],"all":[152],"scores:":[153],"about":[156],"12%":[157],"each":[159,185],"split":[161],"seen":[163],"during":[164],"training,":[165],"adding":[166],"1":[167],"3":[169],"points":[170],"without":[171],"changing":[172],"ranking;":[174],"APIMDS,":[176],"45.4%":[177],"samples":[180],"duplicates,":[182],"counting":[184],"distinct":[186],"behaviour":[187],"once":[188],"lowers":[189],"scores":[191],"87.8%":[193],"74.0%.":[195],"N-gram":[196],"also":[199],"robust":[200],"inserted":[202],"blocks":[203],"junk":[205],"calls.":[206],"Our":[207],"partitions":[208],"code":[210],"will":[211],"be":[212],"released":[213],"upon":[214],"publication.":[215]},"counts_by_year":[],"updated_date":"2026-11-11T12:16:26.678958","created_date":"2026-11-10T00:00:00"}