{"id":"https://openalex.org/W2766123777","doi":"https://doi.org/10.1007/s11416-017-0307-5","title":"Intelligent OS X malware threat detection with code inspection","display_name":"Intelligent OS X malware threat detection with code inspection","publication_year":2017,"publication_date":"2017-10-20","ids":{"openalex":"https://openalex.org/W2766123777","doi":"https://doi.org/10.1007/s11416-017-0307-5","mag":"2766123777"},"language":"en","primary_location":{"id":"doi:10.1007/s11416-017-0307-5","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s11416-017-0307-5","pdf_url":"https://link.springer.com/content/pdf/10.1007/s11416-017-0307-5.pdf","source":{"id":"https://openalex.org/S2764922190","display_name":"Journal of Computer Virology and Hacking Techniques","issn_l":"1772-9890","issn":["1772-9890","1772-9904","2263-8733"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Computer Virology and Hacking Techniques","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://link.springer.com/content/pdf/10.1007/s11416-017-0307-5.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5030715288","display_name":"Hamed Haddad Pajouh","orcid":null},"institutions":[{"id":"https://openalex.org/I204490172","display_name":"Shiraz University of Technology","ror":"https://ror.org/04bxa3v83","country_code":"IR","type":"education","lineage":["https://openalex.org/I204490172"]}],"countries":["IR"],"is_corresponding":false,"raw_author_name":"Hamed Haddad Pajouh","raw_affiliation_strings":["Department of Computer Engineering and Information, Technology, Shiraz University of Technology, Shiraz, Iran"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Engineering and Information, Technology, Shiraz University of Technology, Shiraz, Iran","institution_ids":["https://openalex.org/I204490172"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5038019914","display_name":"Ali Dehghantanha","orcid":"https://orcid.org/0000-0002-9294-7554"},"institutions":[{"id":"https://openalex.org/I54459138","display_name":"University of Salford","ror":"https://ror.org/01tmqtf75","country_code":"GB","type":"education","lineage":["https://openalex.org/I54459138"]}],"countries":["GB"],"is_corresponding":true,"raw_author_name":"Ali Dehghantanha","raw_affiliation_strings":["School of Computing, Science and Engineering, University of Salford, Salford, UK"],"raw_orcid":"https://orcid.org/0000-0002-9294-7554","affiliations":[{"raw_affiliation_string":"School of Computing, Science and Engineering, University of Salford, Salford, UK","institution_ids":["https://openalex.org/I54459138"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5084301091","display_name":"Raouf Khayami","orcid":null},"institutions":[{"id":"https://openalex.org/I204490172","display_name":"Shiraz University of Technology","ror":"https://ror.org/04bxa3v83","country_code":"IR","type":"education","lineage":["https://openalex.org/I204490172"]}],"countries":["IR"],"is_corresponding":false,"raw_author_name":"Raouf Khayami","raw_affiliation_strings":["Department of Computer Engineering and Information, Technology, Shiraz University of Technology, Shiraz, Iran"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Engineering and Information, Technology, Shiraz University of Technology, Shiraz, Iran","institution_ids":["https://openalex.org/I204490172"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5001746807","display_name":"Kim\u2010Kwang Raymond Choo","orcid":"https://orcid.org/0000-0001-9208-5336"},"institutions":[{"id":"https://openalex.org/I170239107","display_name":"University of South Australia","ror":"https://ror.org/01p93h210","country_code":"AU","type":"education","lineage":["https://openalex.org/I170239107"]},{"id":"https://openalex.org/I45438204","display_name":"The University of Texas at San Antonio","ror":"https://ror.org/01kd65564","country_code":"US","type":"education","lineage":["https://openalex.org/I45438204"]}],"countries":["AU","US"],"is_corresponding":false,"raw_author_name":"Kim-Kwang Raymond Choo","raw_affiliation_strings":["Department of Information Systems and Cyber Security, The University of Texas at San Antonio, San Antonio, TX, 78249, USA","School of Information Technology and Mathematical Sciences, University of South Australia, Adelaide, SA, 5095, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Information Systems and Cyber Security, The University of Texas at San Antonio, San Antonio, TX, 78249, USA","institution_ids":["https://openalex.org/I45438204"]},{"raw_affiliation_string":"School of Information Technology and Mathematical Sciences, University of South Australia, Adelaide, SA, 5095, Australia","institution_ids":["https://openalex.org/I170239107"]}]}],"institutions":[],"countries_distinct_count":4,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5038019914"],"corresponding_institution_ids":["https://openalex.org/I54459138"],"apc_list":{"value":2990,"currency":"USD","value_usd":2990},"apc_paid":{"value":2990,"currency":"USD","value_usd":2990},"fwci":6.8505,"has_fulltext":true,"cited_by_count":67,"citation_normalized_percentile":{"value":0.97684184,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":96,"max":100},"biblio":{"volume":"14","issue":"3","first_page":"213","last_page":"223"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9984999895095825,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9868000149726868,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.888469398021698},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8692325353622437},{"id":"https://openalex.org/keywords/constant-false-alarm-rate","display_name":"Constant false alarm rate","score":0.6604861617088318},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.6208479404449463},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.5977416038513184},{"id":"https://openalex.org/keywords/support-vector-machine","display_name":"Support vector machine","score":0.5961204767227173},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.5853677988052368},{"id":"https://openalex.org/keywords/false-positive-rate","display_name":"False positive rate","score":0.5363010168075562},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.46113526821136475},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.13471755385398865}],"concepts":[{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.888469398021698},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8692325353622437},{"id":"https://openalex.org/C77052588","wikidata":"https://www.wikidata.org/wiki/Q644307","display_name":"Constant false alarm rate","level":2,"score":0.6604861617088318},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.6208479404449463},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5977416038513184},{"id":"https://openalex.org/C12267149","wikidata":"https://www.wikidata.org/wiki/Q282453","display_name":"Support vector machine","level":2,"score":0.5961204767227173},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.5853677988052368},{"id":"https://openalex.org/C95922358","wikidata":"https://www.wikidata.org/wiki/Q5432725","display_name":"False positive rate","level":2,"score":0.5363010168075562},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.46113526821136475},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.13471755385398865}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1007/s11416-017-0307-5","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s11416-017-0307-5","pdf_url":"https://link.springer.com/content/pdf/10.1007/s11416-017-0307-5.pdf","source":{"id":"https://openalex.org/S2764922190","display_name":"Journal of Computer Virology and Hacking Techniques","issn_l":"1772-9890","issn":["1772-9890","1772-9904","2263-8733"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Computer Virology and Hacking Techniques","raw_type":"journal-article"},{"id":"pmh:oai:usir.salford.ac.uk:44069","is_oa":true,"landing_page_url":"http://usir.salford.ac.uk/id/eprint/44069/1/OSX_malware%20v1.pdf","pdf_url":"http://usir.salford.ac.uk/id/eprint/44069/8/10.1007_s11416-017-0307-5.pdf","source":{"id":"https://openalex.org/S4306401501","display_name":"University of Salford Institutional Repository (University of Salford)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I54459138","host_organization_name":"University of Salford","host_organization_lineage":["https://openalex.org/I54459138"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"Article"},{"id":"pmh:oai:urm_publish:9916161510901831","is_oa":true,"landing_page_url":"https://hdl.handle.net/11541.2/129132","pdf_url":null,"source":{"id":"https://openalex.org/S4306402528","display_name":"UniSA Research Outputs Repository (University of South Australia)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I170239107","host_organization_name":"University of South Australia","host_organization_lineage":["https://openalex.org/I170239107"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"text"}],"best_oa_location":{"id":"doi:10.1007/s11416-017-0307-5","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s11416-017-0307-5","pdf_url":"https://link.springer.com/content/pdf/10.1007/s11416-017-0307-5.pdf","source":{"id":"https://openalex.org/S2764922190","display_name":"Journal of Computer Virology and Hacking Techniques","issn_l":"1772-9890","issn":["1772-9890","1772-9904","2263-8733"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Computer Virology and Hacking Techniques","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G2242686305","display_name":null,"funder_award_id":"FP7-PEOPLE-2013-IIF","funder_id":"https://openalex.org/F4320338368","funder_display_name":"FP7 People: Marie-Curie Actions"},{"id":"https://openalex.org/G7868512380","display_name":null,"funder_award_id":"FP7-PEOPLE-2013","funder_id":"https://openalex.org/F4320338368","funder_display_name":"FP7 People: Marie-Curie Actions"}],"funders":[{"id":"https://openalex.org/F4320338368","display_name":"FP7 People: Marie-Curie Actions","ror":"https://ror.org/00k4n6c32"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W2766123777.pdf","grobid_xml":"https://content.openalex.org/works/W2766123777.grobid-xml"},"referenced_works_count":34,"referenced_works":["https://openalex.org/W263545290","https://openalex.org/W1422754336","https://openalex.org/W1560724230","https://openalex.org/W1964241047","https://openalex.org/W1981221397","https://openalex.org/W1999728176","https://openalex.org/W2000052253","https://openalex.org/W2008224380","https://openalex.org/W2050855115","https://openalex.org/W2060537671","https://openalex.org/W2068367774","https://openalex.org/W2077488147","https://openalex.org/W2080157505","https://openalex.org/W2103464385","https://openalex.org/W2128576967","https://openalex.org/W2139212933","https://openalex.org/W2147710616","https://openalex.org/W2148143831","https://openalex.org/W2149684865","https://openalex.org/W2156909104","https://openalex.org/W2162181963","https://openalex.org/W2165885026","https://openalex.org/W2170197386","https://openalex.org/W2192611800","https://openalex.org/W2295341088","https://openalex.org/W2295915781","https://openalex.org/W2324464293","https://openalex.org/W2335024046","https://openalex.org/W2519971059","https://openalex.org/W2557716486","https://openalex.org/W2563273224","https://openalex.org/W2564186131","https://openalex.org/W3195149063","https://openalex.org/W4249213233"],"related_works":["https://openalex.org/W3195168932","https://openalex.org/W1996541855","https://openalex.org/W2968586400","https://openalex.org/W2969928752","https://openalex.org/W4308628406","https://openalex.org/W2798481441","https://openalex.org/W2119148668","https://openalex.org/W2019072634","https://openalex.org/W3081627837","https://openalex.org/W2380006768"],"abstract_inverted_index":{"With":[0],"the":[1,17,119,141,172,242],"increasing":[2,221],"market":[3],"share":[4],"of":[5,19,45,52,64,126,175,181,187,203],"Mac":[6,28],"OS":[7,29,37,78,112],"X":[8,30,38,79,113],"operating":[9],"system,":[10],"there":[11,69],"is":[12],"a":[13,49,87,101,121,124],"corresponding":[14],"increase":[15],"in":[16,61,74,224,239],"number":[18],"malicious":[20],"programs":[21],"(malware)":[22],"designed":[23],"to":[24,77,110,162,178,241],"exploit":[25],"vulnerabilities":[26],"on":[27,106,140,171,185,231],"platforms.":[31],"However,":[32],"existing":[33],"manual":[34],"and":[35,66,100,117,129,200],"heuristic":[36],"malware":[39,80,128,188,208],"detection":[40,63,147,198,232],"techniques":[41,57],"are":[42,211],"not":[43],"capable":[44],"coping":[46],"with":[47,123,149,167],"such":[48],"high":[50],"rate":[51,238],"malware.":[53,114],"While":[54],"machine":[55,89],"learning":[56,90],"offer":[58],"promising":[59],"results":[60,218],"automated":[62],"Windows":[65],"Android":[67],"malware,":[68],"have":[70],"been":[71],"limited":[72],"efforts":[73],"extending":[75],"them":[76],"detection.":[81,189],"In":[82],"this":[83],"paper,":[84],"we":[85,143,193],"propose":[86],"supervised":[88,136],"model.":[91],"The":[92],"model":[93],"applies":[94],"kernel":[95],"base":[96],"Support":[97],"Vector":[98],"Machine":[99,137],"novel":[102],"weighting":[103],"measure":[104],"based":[105,170],"application":[107],"library":[108],"calls":[109],"detect":[111],"For":[115],"training":[116],"evaluating":[118],"model,":[120],"dataset":[122,177],"combination":[125],"152":[127],"450":[130],"benign":[131],"were":[132],"created.":[133],"Using":[134,190],"common":[135],"Learning":[138],"algorithm":[139],"dataset,":[142],"obtain":[144],"over":[145,196],"91%":[146],"accuracy":[148,186,199,233],"3.9%":[150],"false":[151,201,236],"alarm":[152,202,237],"rate.":[153],"We":[154],"also":[155],"utilize":[156],"Synthetic":[157],"Minority":[158],"Over-sampling":[159],"Technique":[160],"(SMOTE)":[161],"create":[163],"three":[164],"synthetic":[165,225],"datasets":[166,192,226],"different":[168,182],"distributions":[169],"refined":[173],"version":[174],"collected":[176],"investigate":[179],"impact":[180],"sample":[183,222],"sizes":[184],"SMOTE":[191],"could":[194],"achieve":[195],"96%":[197],"less":[204],"than":[205],"4%.":[206],"All":[207],"classification":[209],"experiments":[210],"tested":[212],"using":[213],"cross":[214],"validation":[215],"technique.":[216],"Our":[217],"reflect":[219],"that":[220],"size":[223],"has":[227],"direct":[228],"positive":[229],"effect":[230],"while":[234],"increases":[235],"compare":[240],"original":[243],"dataset.":[244]},"counts_by_year":[{"year":2025,"cited_by_count":5},{"year":2024,"cited_by_count":3},{"year":2023,"cited_by_count":6},{"year":2022,"cited_by_count":8},{"year":2021,"cited_by_count":9},{"year":2020,"cited_by_count":13},{"year":2019,"cited_by_count":15},{"year":2018,"cited_by_count":8}],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2017-11-10T00:00:00"}