{"id":"https://openalex.org/W4412968658","doi":"https://doi.org/10.1007/s10515-025-00538-0","title":"DESCG: data encoding scheme classification with GNN in binary analysis","display_name":"DESCG: data encoding scheme classification with GNN in binary analysis","publication_year":2025,"publication_date":"2025-07-18","ids":{"openalex":"https://openalex.org/W4412968658","doi":"https://doi.org/10.1007/s10515-025-00538-0"},"language":"en","primary_location":{"id":"doi:10.1007/s10515-025-00538-0","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10515-025-00538-0","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10515-025-00538-0.pdf","source":{"id":"https://openalex.org/S4210177399","display_name":"Automated Software Engineering","issn_l":"0928-8910","issn":["0928-8910","1573-7535"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Automated Software Engineering","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://link.springer.com/content/pdf/10.1007/s10515-025-00538-0.pdf","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5101790265","display_name":"Xushu Dai","orcid":"https://orcid.org/0009-0007-4008-6557"},"institutions":[{"id":"https://openalex.org/I130769515","display_name":"Pennsylvania State University","ror":"https://ror.org/04p491231","country_code":"US","type":"education","lineage":["https://openalex.org/I130769515"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Xushu Dai","raw_affiliation_strings":["The College of Information Sciences and Technology, The Pennsylvania State University, University Park, PA, 16802, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"The College of Information Sciences and Technology, The Pennsylvania State University, University Park, PA, 16802, USA","institution_ids":["https://openalex.org/I130769515"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5070865664","display_name":"Nanqing Luo","orcid":null},"institutions":[{"id":"https://openalex.org/I130769515","display_name":"Pennsylvania State University","ror":"https://ror.org/04p491231","country_code":"US","type":"education","lineage":["https://openalex.org/I130769515"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Nanqing Luo","raw_affiliation_strings":["The College of Information Sciences and Technology, The Pennsylvania State University, University Park, PA, 16802, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"The College of Information Sciences and Technology, The Pennsylvania State University, University Park, PA, 16802, USA","institution_ids":["https://openalex.org/I130769515"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101769226","display_name":"Haizhou Wang","orcid":"https://orcid.org/0000-0002-4130-1833"},"institutions":[{"id":"https://openalex.org/I130769515","display_name":"Pennsylvania State University","ror":"https://ror.org/04p491231","country_code":"US","type":"education","lineage":["https://openalex.org/I130769515"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Haizhou Wang","raw_affiliation_strings":["The College of Information Sciences and Technology, The Pennsylvania State University, University Park, PA, 16802, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"The College of Information Sciences and Technology, The Pennsylvania State University, University Park, PA, 16802, USA","institution_ids":["https://openalex.org/I130769515"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100664786","display_name":"Zhilong Wang","orcid":"https://orcid.org/0000-0002-1910-3654"},"institutions":[{"id":"https://openalex.org/I130769515","display_name":"Pennsylvania State University","ror":"https://ror.org/04p491231","country_code":"US","type":"education","lineage":["https://openalex.org/I130769515"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Zhilong Wang","raw_affiliation_strings":["The College of Information Sciences and Technology, The Pennsylvania State University, University Park, PA, 16802, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"The College of Information Sciences and Technology, The Pennsylvania State University, University Park, PA, 16802, USA","institution_ids":["https://openalex.org/I130769515"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5114514352","display_name":"Chen Cao","orcid":"https://orcid.org/0000-0003-1579-3755"},"institutions":[{"id":"https://openalex.org/I130769515","display_name":"Pennsylvania State University","ror":"https://ror.org/04p491231","country_code":"US","type":"education","lineage":["https://openalex.org/I130769515"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Chen Cao","raw_affiliation_strings":["The Behrend College, The Pennsylvania State University, Erie, PA, 16563, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"The Behrend College, The Pennsylvania State University, Erie, PA, 16563, USA","institution_ids":["https://openalex.org/I130769515"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5101719623","display_name":"Peng Liu","orcid":"https://orcid.org/0000-0001-8024-4344"},"institutions":[{"id":"https://openalex.org/I130769515","display_name":"Pennsylvania State University","ror":"https://ror.org/04p491231","country_code":"US","type":"education","lineage":["https://openalex.org/I130769515"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Peng Liu","raw_affiliation_strings":["The College of Information Sciences and Technology, The Pennsylvania State University, University Park, PA, 16802, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"The College of Information Sciences and Technology, The Pennsylvania State University, University Park, PA, 16802, USA","institution_ids":["https://openalex.org/I130769515"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5101719623"],"corresponding_institution_ids":["https://openalex.org/I130769515"],"apc_list":{"value":2290,"currency":"EUR","value_usd":2890},"apc_paid":{"value":2290,"currency":"EUR","value_usd":2890},"fwci":0.9024,"has_fulltext":true,"cited_by_count":1,"citation_normalized_percentile":{"value":0.74663641,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":91,"max":95},"biblio":{"volume":"32","issue":"2","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9850000143051147,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.979200005531311,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8467713594436646},{"id":"https://openalex.org/keywords/scalability","display_name":"Scalability","score":0.6026721596717834},{"id":"https://openalex.org/keywords/binary-code","display_name":"Binary code","score":0.5925031304359436},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.5464457869529724},{"id":"https://openalex.org/keywords/encoding","display_name":"Encoding (memory)","score":0.5333089232444763},{"id":"https://openalex.org/keywords/hash-function","display_name":"Hash function","score":0.49814581871032715},{"id":"https://openalex.org/keywords/encryption","display_name":"Encryption","score":0.4602126181125641},{"id":"https://openalex.org/keywords/reverse-engineering","display_name":"Reverse engineering","score":0.458079993724823},{"id":"https://openalex.org/keywords/heuristic","display_name":"Heuristic","score":0.4354044497013092},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.43001341819763184},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.41399070620536804},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.3877338171005249},{"id":"https://openalex.org/keywords/binary-number","display_name":"Binary number","score":0.3719596862792969},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.34158530831336975},{"id":"https://openalex.org/keywords/database","display_name":"Database","score":0.16496312618255615},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.13103601336479187}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8467713594436646},{"id":"https://openalex.org/C48044578","wikidata":"https://www.wikidata.org/wiki/Q727490","display_name":"Scalability","level":2,"score":0.6026721596717834},{"id":"https://openalex.org/C63435697","wikidata":"https://www.wikidata.org/wiki/Q864135","display_name":"Binary code","level":3,"score":0.5925031304359436},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5464457869529724},{"id":"https://openalex.org/C125411270","wikidata":"https://www.wikidata.org/wiki/Q18653","display_name":"Encoding (memory)","level":2,"score":0.5333089232444763},{"id":"https://openalex.org/C99138194","wikidata":"https://www.wikidata.org/wiki/Q183427","display_name":"Hash function","level":2,"score":0.49814581871032715},{"id":"https://openalex.org/C148730421","wikidata":"https://www.wikidata.org/wiki/Q141090","display_name":"Encryption","level":2,"score":0.4602126181125641},{"id":"https://openalex.org/C207850805","wikidata":"https://www.wikidata.org/wiki/Q269608","display_name":"Reverse engineering","level":2,"score":0.458079993724823},{"id":"https://openalex.org/C173801870","wikidata":"https://www.wikidata.org/wiki/Q201413","display_name":"Heuristic","level":2,"score":0.4354044497013092},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.43001341819763184},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.41399070620536804},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3877338171005249},{"id":"https://openalex.org/C48372109","wikidata":"https://www.wikidata.org/wiki/Q3913","display_name":"Binary number","level":2,"score":0.3719596862792969},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.34158530831336975},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.16496312618255615},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.13103601336479187},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C94375191","wikidata":"https://www.wikidata.org/wiki/Q11205","display_name":"Arithmetic","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1007/s10515-025-00538-0","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10515-025-00538-0","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10515-025-00538-0.pdf","source":{"id":"https://openalex.org/S4210177399","display_name":"Automated Software Engineering","issn_l":"0928-8910","issn":["0928-8910","1573-7535"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Automated Software Engineering","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1007/s10515-025-00538-0","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10515-025-00538-0","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10515-025-00538-0.pdf","source":{"id":"https://openalex.org/S4210177399","display_name":"Automated Software Engineering","issn_l":"0928-8910","issn":["0928-8910","1573-7535"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Automated Software Engineering","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1391936209","display_name":"Collaborative Research: SaTC: CORE: Medium: Cyber-threat Detection and Diagnosis in Multistage Manufacturing Systems through Cyber and Physical Data Analytics","funder_award_id":"2019340","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G3994444534","display_name":"Towards Provable Security of Real-world Servers: Where Online Learning Meets Server Retrofitting","funder_award_id":"2140175","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G4521288315","display_name":null,"funder_award_id":"ECCS-2140175","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G6815317376","display_name":"CRII: CSR: Understanding and Enhancing Unsafe Rust Code in Resource-constrained Systems","funder_award_id":"2245753","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G8334011003","display_name":null,"funder_award_id":"CNS-2019340","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"},{"id":"https://openalex.org/F4320337392","display_name":"Division of Electrical, Communications and Cyber Systems","ror":"https://ror.org/01krpsy48"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4412968658.pdf","grobid_xml":"https://content.openalex.org/works/W4412968658.grobid-xml"},"referenced_works_count":41,"referenced_works":["https://openalex.org/W157243396","https://openalex.org/W1585630533","https://openalex.org/W1992114977","https://openalex.org/W2038974217","https://openalex.org/W2044688197","https://openalex.org/W2047181172","https://openalex.org/W2057787526","https://openalex.org/W2065995359","https://openalex.org/W2098262260","https://openalex.org/W2116341502","https://openalex.org/W2134633067","https://openalex.org/W2144344516","https://openalex.org/W2284900416","https://openalex.org/W2532962075","https://openalex.org/W2548165777","https://openalex.org/W2670925489","https://openalex.org/W2753395445","https://openalex.org/W2790751137","https://openalex.org/W2886694146","https://openalex.org/W2892187814","https://openalex.org/W2895504842","https://openalex.org/W2897859437","https://openalex.org/W2926178846","https://openalex.org/W2942259124","https://openalex.org/W2942681667","https://openalex.org/W2963408280","https://openalex.org/W2970862273","https://openalex.org/W2978569165","https://openalex.org/W2998038410","https://openalex.org/W2998074434","https://openalex.org/W3105952379","https://openalex.org/W3133719257","https://openalex.org/W3168189449","https://openalex.org/W3186052544","https://openalex.org/W3193654868","https://openalex.org/W3194813479","https://openalex.org/W4206214607","https://openalex.org/W4285586654","https://openalex.org/W4303648996","https://openalex.org/W4312324806","https://openalex.org/W4362615084"],"related_works":["https://openalex.org/W2097492617","https://openalex.org/W2363831530","https://openalex.org/W2753240997","https://openalex.org/W1764168690","https://openalex.org/W4210907385","https://openalex.org/W2055981842","https://openalex.org/W4236027474","https://openalex.org/W2088296667","https://openalex.org/W2963758661","https://openalex.org/W2963284721"],"abstract_inverted_index":{"Abstract":[0],"Binary":[1],"analysis,":[2],"the":[3,22,50,132,137],"process":[4,36],"of":[5,25,34,52,94,151,168,179],"examining":[6],"software":[7],"without":[8,147],"its":[9,192],"source":[10],"code,":[11],"plays":[12],"a":[13,82],"crucial":[14],"role":[15],"in":[16,98],"understanding":[17],"program":[18],"behavior,":[19],"e.g.,":[20],"evaluating":[21],"security":[23],"properties":[24],"commercial":[26],"software,":[27],"and":[28,46,104,125,164,190,194],"analyzing":[29],"malware.":[30],"One":[31],"challenging":[32],"aspect":[33],"this":[35,76],"is":[37,185],"to":[38,49,111,181],"classify":[39],"data":[40,95,119],"encoding":[41,96,153],"schemes,":[42,68],"such":[43],"as":[44],"encryption":[45],"compression,":[47,102],"due":[48],"absence":[51],"high-level":[53],"semantic":[54],"information.":[55],"Existing":[56],"approaches":[57],"either":[58],"rely":[59],"on":[60],"code":[61],"similarity,":[62],"which":[63,72,183],"only":[64],"works":[65],"for":[66,87,188],"known":[67],"or":[69],"heuristic":[70],"rules,":[71],"lack":[73],"scalability.":[74],"In":[75],"paper,":[77],"we":[78],"propose":[79],"DESCG":[80,160,180],",":[81],"novel":[83],"deep":[84],"learning-based":[85],"method":[86],"automatically":[88],"classifying":[89],"four":[90],"widely":[91],"employed":[92],"kinds":[93],"schemes":[97],"binary":[99,116],"programs:":[100],"encryption,":[101],"decompression,":[103],"hashing.":[105],"Our":[106],"approach":[107,143],"leverages":[108],"dynamic":[109],"analysis":[110],"extract":[112],"execution":[113],"traces":[114],"from":[115,122],"programs,":[117],"builds":[118],"dependency":[120],"graphs":[121],"these":[123],"traces,":[124],"incorporates":[126],"critical":[127],"feature":[128,184],"engineering.":[129],"By":[130],"combining":[131],"specialized":[133],"graph":[134],"representation":[135],"with":[136],"Graph":[138],"Neural":[139],"Network":[140],"(GNN),":[141],"our":[142],"enables":[144],"accurate":[145],"classification":[146],"requiring":[148],"prior":[149],"knowledge":[150],"specific":[152],"schemes.":[154],"The":[155],"Evaluation":[156],"result":[157],"shows":[158],"that":[159],"achieves":[161],"97.7%":[162],"accuracy":[163],"an":[165,176],"F1":[166],"score":[167],"97.67%,":[169],"outperforming":[170],"baseline":[171],"models.":[172],"We":[173],"also":[174],"conducted":[175],"extensive":[177],"evaluation":[178],"explore":[182],"more":[186],"important":[187],"it":[189],"examine":[191],"performance":[193],"overhead.":[195]},"counts_by_year":[{"year":2025,"cited_by_count":1}],"updated_date":"2026-06-13T06:13:01.061226","created_date":"2025-10-10T00:00:00"}