{"id":"https://openalex.org/W2621204675","doi":"https://doi.org/10.1007/978-3-319-60876-1_6","title":"Finding the Needle: A Study of the PE32 Rich Header and Respective Malware Triage","display_name":"Finding the Needle: A Study of the PE32 Rich Header and Respective Malware Triage","publication_year":2017,"publication_date":"2017-01-01","ids":{"openalex":"https://openalex.org/W2621204675","doi":"https://doi.org/10.1007/978-3-319-60876-1_6","mag":"2621204675"},"language":"en","primary_location":{"id":"doi:10.1007/978-3-319-60876-1_6","is_oa":false,"landing_page_url":"https://doi.org/10.1007/978-3-319-60876-1_6","pdf_url":null,"source":{"id":"https://openalex.org/S106296714","display_name":"Lecture notes in computer science","issn_l":"0302-9743","issn":["0302-9743","1611-3349"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"book series"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Lecture Notes in Computer Science","raw_type":"book-chapter"},"type":"book-chapter","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5037134897","display_name":"George D. Webster","orcid":"https://orcid.org/0000-0002-1591-8952"},"institutions":[{"id":"https://openalex.org/I62916508","display_name":"Technical University of Munich","ror":"https://ror.org/02kkvpp62","country_code":"DE","type":"education","lineage":["https://openalex.org/I62916508"]}],"countries":["DE"],"is_corresponding":true,"raw_author_name":"George D. Webster","raw_affiliation_strings":["Technical University of Munich, Munich, Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Technical University of Munich, Munich, Germany","institution_ids":["https://openalex.org/I62916508"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5080832826","display_name":"Bojan Kolosnjaji","orcid":null},"institutions":[{"id":"https://openalex.org/I62916508","display_name":"Technical University of Munich","ror":"https://ror.org/02kkvpp62","country_code":"DE","type":"education","lineage":["https://openalex.org/I62916508"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Bojan Kolosnjaji","raw_affiliation_strings":["Technical University of Munich, Munich, Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Technical University of Munich, Munich, Germany","institution_ids":["https://openalex.org/I62916508"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5040739193","display_name":"Christian von Pentz","orcid":null},"institutions":[{"id":"https://openalex.org/I62916508","display_name":"Technical University of Munich","ror":"https://ror.org/02kkvpp62","country_code":"DE","type":"education","lineage":["https://openalex.org/I62916508"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Christian von Pentz","raw_affiliation_strings":["Technical University of Munich, Munich, Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Technical University of Munich, Munich, Germany","institution_ids":["https://openalex.org/I62916508"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5051806891","display_name":"Julian Kirsch","orcid":null},"institutions":[{"id":"https://openalex.org/I62916508","display_name":"Technical University of Munich","ror":"https://ror.org/02kkvpp62","country_code":"DE","type":"education","lineage":["https://openalex.org/I62916508"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Julian Kirsch","raw_affiliation_strings":["Technical University of Munich, Munich, Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Technical University of Munich, Munich, Germany","institution_ids":["https://openalex.org/I62916508"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5044431274","display_name":"Zachary D. Hanif","orcid":null},"institutions":[{"id":"https://openalex.org/I62916508","display_name":"Technical University of Munich","ror":"https://ror.org/02kkvpp62","country_code":"DE","type":"education","lineage":["https://openalex.org/I62916508"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Zachary D. Hanif","raw_affiliation_strings":["Technical University of Munich, Munich, Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Technical University of Munich, Munich, Germany","institution_ids":["https://openalex.org/I62916508"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5065154871","display_name":"Apostolis Zarras","orcid":"https://orcid.org/0000-0002-8480-6989"},"institutions":[{"id":"https://openalex.org/I62916508","display_name":"Technical University of Munich","ror":"https://ror.org/02kkvpp62","country_code":"DE","type":"education","lineage":["https://openalex.org/I62916508"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Apostolis Zarras","raw_affiliation_strings":["Technical University of Munich, Munich, Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Technical University of Munich, Munich, Germany","institution_ids":["https://openalex.org/I62916508"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5073408463","display_name":"Claudia Eckert","orcid":"https://orcid.org/0000-0002-2201-3828"},"institutions":[{"id":"https://openalex.org/I62916508","display_name":"Technical University of Munich","ror":"https://ror.org/02kkvpp62","country_code":"DE","type":"education","lineage":["https://openalex.org/I62916508"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Claudia Eckert","raw_affiliation_strings":["Technical University of Munich, Munich, Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Technical University of Munich, Munich, Germany","institution_ids":["https://openalex.org/I62916508"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5037134897"],"corresponding_institution_ids":["https://openalex.org/I62916508"],"apc_list":{"value":5000,"currency":"EUR","value_usd":5392},"apc_paid":null,"fwci":4.5754,"has_fulltext":false,"cited_by_count":25,"citation_normalized_percentile":{"value":0.95341385,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":90,"max":98},"biblio":{"volume":null,"issue":null,"first_page":"119","last_page":"138"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9991999864578247,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/header","display_name":"Header","score":0.9084894061088562},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.823271632194519},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.7627708911895752},{"id":"https://openalex.org/keywords/obfuscation","display_name":"Obfuscation","score":0.6181541681289673},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.5187142491340637},{"id":"https://openalex.org/keywords/executable","display_name":"Executable","score":0.5085538625717163},{"id":"https://openalex.org/keywords/triage","display_name":"Triage","score":0.5018136501312256},{"id":"https://openalex.org/keywords/botnet","display_name":"Botnet","score":0.4268161654472351},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.21183624863624573},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.08390116691589355}],"concepts":[{"id":"https://openalex.org/C48105269","wikidata":"https://www.wikidata.org/wiki/Q1141160","display_name":"Header","level":2,"score":0.9084894061088562},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.823271632194519},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.7627708911895752},{"id":"https://openalex.org/C40305131","wikidata":"https://www.wikidata.org/wiki/Q2616305","display_name":"Obfuscation","level":2,"score":0.6181541681289673},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5187142491340637},{"id":"https://openalex.org/C160145156","wikidata":"https://www.wikidata.org/wiki/Q778586","display_name":"Executable","level":2,"score":0.5085538625717163},{"id":"https://openalex.org/C2777120189","wikidata":"https://www.wikidata.org/wiki/Q780067","display_name":"Triage","level":2,"score":0.5018136501312256},{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.4268161654472351},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.21183624863624573},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.08390116691589355},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.0},{"id":"https://openalex.org/C194828623","wikidata":"https://www.wikidata.org/wiki/Q2861470","display_name":"Emergency medicine","level":1,"score":0.0},{"id":"https://openalex.org/C71924100","wikidata":"https://www.wikidata.org/wiki/Q11190","display_name":"Medicine","level":0,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1007/978-3-319-60876-1_6","is_oa":false,"landing_page_url":"https://doi.org/10.1007/978-3-319-60876-1_6","pdf_url":null,"source":{"id":"https://openalex.org/S106296714","display_name":"Lecture notes in computer science","issn_l":"0302-9743","issn":["0302-9743","1611-3349"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"book series"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Lecture Notes in Computer Science","raw_type":"book-chapter"},{"id":"pmh:oai:cris.maastrichtuniversity.nl:publications/b12889f4-8f61-4554-becc-d2e9f8a1a5cd","is_oa":false,"landing_page_url":"https://cris.maastrichtuniversity.nl/en/publications/b12889f4-8f61-4554-becc-d2e9f8a1a5cd","pdf_url":null,"source":{"id":"https://openalex.org/S4306402616","display_name":"Research Publications (Maastricht University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I34352273","host_organization_name":"Maastricht University","host_organization_lineage":["https://openalex.org/I34352273"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Webster, G D, Kolosnjaji, B, Pentz, C V, Kirsch, J, Hanif, Z D, Zarras, A & Eckert, C 2017, Finding the Needle: A Study of the PE32 Rich Header and Respective Malware Triage. in M Polychronakis & M Meier (eds), Detection of Intrusions and Malware, and Vulnerability Assessment - 14th International Conference, DIMVA 2017, 2017. pp. 119-138. https://doi.org/10.1007/978-3-319-60876-1_6","raw_type":"info:eu-repo/semantics/conferenceObject"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":12,"referenced_works":["https://openalex.org/W19161399","https://openalex.org/W152854583","https://openalex.org/W1559833478","https://openalex.org/W1971657219","https://openalex.org/W1977415353","https://openalex.org/W2010910232","https://openalex.org/W2096921767","https://openalex.org/W2114092087","https://openalex.org/W2150423842","https://openalex.org/W2151300580","https://openalex.org/W2493100395","https://openalex.org/W2510021091"],"related_works":["https://openalex.org/W2929621094","https://openalex.org/W1996006176","https://openalex.org/W2620652965","https://openalex.org/W2024170198","https://openalex.org/W4285325964","https://openalex.org/W4296272594","https://openalex.org/W2900526031","https://openalex.org/W2289039654","https://openalex.org/W2728713145","https://openalex.org/W2470502009"],"abstract_inverted_index":null,"counts_by_year":[{"year":2025,"cited_by_count":2},{"year":2024,"cited_by_count":3},{"year":2023,"cited_by_count":2},{"year":2022,"cited_by_count":5},{"year":2021,"cited_by_count":5},{"year":2020,"cited_by_count":4},{"year":2019,"cited_by_count":3},{"year":2017,"cited_by_count":1}],"updated_date":"2026-07-02T09:51:11.867554","created_date":"2025-10-10T00:00:00"}