{"id":"https://openalex.org/W3129929448","doi":"https://doi.org/10.1007/s11416-021-00377-z","title":"Learning metamorphic malware signatures from samples","display_name":"Learning metamorphic malware signatures from samples","publication_year":2021,"publication_date":"2021-02-19","ids":{"openalex":"https://openalex.org/W3129929448","doi":"https://doi.org/10.1007/s11416-021-00377-z","mag":"3129929448"},"language":"en","primary_location":{"id":"doi:10.1007/s11416-021-00377-z","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s11416-021-00377-z","pdf_url":"https://link.springer.com/content/pdf/10.1007/s11416-021-00377-z.pdf","source":{"id":"https://openalex.org/S2764922190","display_name":"Journal of Computer Virology and Hacking Techniques","issn_l":"2263-8733","issn":["2263-8733"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Computer Virology and Hacking Techniques","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://link.springer.com/content/pdf/10.1007/s11416-021-00377-z.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5046074502","display_name":"Marco Campion","orcid":"https://orcid.org/0000-0002-1099-3494"},"institutions":[{"id":"https://openalex.org/I119439378","display_name":"University of Verona","ror":"https://ror.org/039bp8j42","country_code":"IT","type":"education","lineage":["https://openalex.org/I119439378"]}],"countries":["IT"],"is_corresponding":true,"raw_author_name":"Marco Campion","raw_affiliation_strings":["Universit\u00e0 degli Studi di Verona, Verona, Italy"],"raw_orcid":"https://orcid.org/0000-0002-1099-3494","affiliations":[{"raw_affiliation_string":"Universit\u00e0 degli Studi di Verona, Verona, Italy","institution_ids":["https://openalex.org/I119439378"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5005632682","display_name":"Mila Dalla Preda","orcid":"https://orcid.org/0000-0003-2761-4347"},"institutions":[{"id":"https://openalex.org/I119439378","display_name":"University of Verona","ror":"https://ror.org/039bp8j42","country_code":"IT","type":"education","lineage":["https://openalex.org/I119439378"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Mila Dalla\u00a0Preda","raw_affiliation_strings":["Universit\u00e0 degli Studi di Verona, Verona, Italy"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Universit\u00e0 degli Studi di Verona, Verona, Italy","institution_ids":["https://openalex.org/I119439378"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5052881133","display_name":"Roberto Giacobazzi","orcid":"https://orcid.org/0000-0002-9582-3960"},"institutions":[{"id":"https://openalex.org/I119439378","display_name":"University of Verona","ror":"https://ror.org/039bp8j42","country_code":"IT","type":"education","lineage":["https://openalex.org/I119439378"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Roberto Giacobazzi","raw_affiliation_strings":["Universit\u00e0 degli Studi di Verona, Verona, Italy"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Universit\u00e0 degli Studi di Verona, Verona, Italy","institution_ids":["https://openalex.org/I119439378"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":["https://openalex.org/A5046074502"],"corresponding_institution_ids":["https://openalex.org/I119439378"],"apc_list":{"value":2390,"currency":"EUR","value_usd":2990},"apc_paid":{"value":2390,"currency":"EUR","value_usd":2990},"fwci":1.6964,"has_fulltext":true,"cited_by_count":12,"citation_normalized_percentile":{"value":0.84017929,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":98},"biblio":{"volume":"17","issue":"3","first_page":"167","last_page":"183"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.996999979019165,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.9957000017166138,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8466828465461731},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.5342456698417664},{"id":"https://openalex.org/keywords/pascal","display_name":"Pascal (unit)","score":0.4797705113887787},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.4670749008655548},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.45846331119537354},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.38894957304000854},{"id":"https://openalex.org/keywords/algorithm","display_name":"Algorithm","score":0.34048691391944885}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8466828465461731},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.5342456698417664},{"id":"https://openalex.org/C75608658","wikidata":"https://www.wikidata.org/wiki/Q44395","display_name":"Pascal (unit)","level":2,"score":0.4797705113887787},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.4670749008655548},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.45846331119537354},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.38894957304000854},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.34048691391944885},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1007/s11416-021-00377-z","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s11416-021-00377-z","pdf_url":"https://link.springer.com/content/pdf/10.1007/s11416-021-00377-z.pdf","source":{"id":"https://openalex.org/S2764922190","display_name":"Journal of Computer Virology and Hacking Techniques","issn_l":"2263-8733","issn":["2263-8733"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Computer Virology and Hacking Techniques","raw_type":"journal-article"},{"id":"pmh:oai:zenodo.org:145860","is_oa":true,"landing_page_url":"https://www.openaccessrepository.it/record/145860","pdf_url":null,"source":{"id":"https://openalex.org/S4306402478","display_name":"INFM-OAR (INFN Catania)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I4210116497","host_organization_name":"Istituto Nazionale di Fisica Nucleare, Sezione di Catania","host_organization_lineage":["https://openalex.org/I4210116497"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"info:eu-repo/semantics/article"}],"best_oa_location":{"id":"doi:10.1007/s11416-021-00377-z","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s11416-021-00377-z","pdf_url":"https://link.springer.com/content/pdf/10.1007/s11416-021-00377-z.pdf","source":{"id":"https://openalex.org/S2764922190","display_name":"Journal of Computer Virology and Hacking Techniques","issn_l":"2263-8733","issn":["2263-8733"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Computer Virology and Hacking Techniques","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1390751753","display_name":null,"funder_award_id":"Dipartimenti di Eccellenza 2018-2022","funder_id":"https://openalex.org/F4320317295","funder_display_name":"Dipartimenti di Eccellenza"},{"id":"https://openalex.org/G3006576871","display_name":null,"funder_award_id":"2018-2022","funder_id":"https://openalex.org/F4320317295","funder_display_name":"Dipartimenti di Eccellenza"},{"id":"https://openalex.org/G4956079712","display_name":null,"funder_award_id":"2018-2022","funder_id":"https://openalex.org/F4320321873","funder_display_name":"Ministero dell\u2019Istruzione, dell\u2019Universit\u00e0 e della Ricerca"},{"id":"https://openalex.org/G557875060","display_name":null,"funder_award_id":"201784YSZ5","funder_id":"https://openalex.org/F4320321873","funder_display_name":"Ministero dell\u2019Istruzione, dell\u2019Universit\u00e0 e della Ricerca"},{"id":"https://openalex.org/G5647625081","display_name":null,"funder_award_id":"PRIN2017","funder_id":"https://openalex.org/F4320321873","funder_display_name":"Ministero dell\u2019Istruzione, dell\u2019Universit\u00e0 e della Ricerca"}],"funders":[{"id":"https://openalex.org/F4320317295","display_name":"Dipartimenti di Eccellenza","ror":null},{"id":"https://openalex.org/F4320321873","display_name":"Ministero dell\u2019Istruzione, dell\u2019Universit\u00e0 e della Ricerca","ror":"https://ror.org/0166hxq48"},{"id":"https://openalex.org/F4320324120","display_name":"Universit\u00e0 degli Studi di Verona","ror":"https://ror.org/039bp8j42"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W3129929448.pdf","grobid_xml":"https://content.openalex.org/works/W3129929448.grobid-xml"},"referenced_works_count":30,"referenced_works":["https://openalex.org/W71539614","https://openalex.org/W138607541","https://openalex.org/W140639879","https://openalex.org/W168640152","https://openalex.org/W1544837488","https://openalex.org/W1583749395","https://openalex.org/W1595564425","https://openalex.org/W1834926878","https://openalex.org/W1979400615","https://openalex.org/W1980153792","https://openalex.org/W2023764457","https://openalex.org/W2026576099","https://openalex.org/W2051912542","https://openalex.org/W2066833290","https://openalex.org/W2086711541","https://openalex.org/W2099194862","https://openalex.org/W2108104525","https://openalex.org/W2110978214","https://openalex.org/W2125011234","https://openalex.org/W2131523719","https://openalex.org/W2138990249","https://openalex.org/W2155535003","https://openalex.org/W2158167094","https://openalex.org/W2171035369","https://openalex.org/W2242756467","https://openalex.org/W2255223209","https://openalex.org/W2442545619","https://openalex.org/W2978879124","https://openalex.org/W4212990661","https://openalex.org/W4241372395"],"related_works":["https://openalex.org/W2097492617","https://openalex.org/W2753240997","https://openalex.org/W1764168690","https://openalex.org/W2537959205","https://openalex.org/W2740895074","https://openalex.org/W1967067605","https://openalex.org/W2056111554","https://openalex.org/W655076135","https://openalex.org/W92485060","https://openalex.org/W2051384178"],"abstract_inverted_index":{"Abstract":[0],"Metamorphic":[1],"malware":[2,38,77],"are":[3,240],"self-modifying":[4],"programs":[5],"which":[6,165,239,261],"apply":[7],"semantic":[8,185],"preserving":[9,186],"transformations":[10],"to":[11,17,40,141,242,278,288],"their":[12],"own":[13],"code":[14,31,95,125,169,214,231,292],"in":[15,233],"order":[16],"foil":[18],"detection":[19,42],"systems":[20,43],"based":[21,44,176],"on":[22,45,177,300],"signature":[23,83],"matching.":[24],"Metamorphism":[25],"impacts":[26],"both":[27],"software":[28,50,58],"security":[29],"and":[30,48,127,159,200],"protection":[32],"technologies:":[33],"it":[34],"is":[35,175],"used":[36,140,189,283],"by":[37,49,190,269,284],"writers":[39],"evade":[41],"pattern":[46],"matching":[47],"developers":[51],"for":[52],"preventing":[53],"malicious":[54],"host":[55],"attacks":[56],"through":[57],"diversification.":[59],"In":[60,205,224],"this":[61,109,206],"paper,":[62],"we":[63,111,226,253,262],"consider":[64],"the":[65,73,93,102,143,156,167,178,184,191,208,211,217,221,228,250,264,267,280,285,290,296],"problem":[66],"of":[67,75,104,123,133,155,180,213,230,235,258,266,298],"automatically":[68],"extracting":[69],"metamorphic":[70,76,82,106,124,145,192,222,286],"signatures":[71],"from":[72,149,260],"analysis":[74],"variants.":[78,146,170,293],"We":[79,294],"define":[80],"a":[81,105,115,121,131,150,255,271],"as":[84,119,129,197,202],"an":[85,163],"abstract":[86],"program":[87],"representation":[88,154],"that":[89,97,117,136],"ideally":[90],"captures":[91],"all":[92],"possible":[94],"variants":[96,126,158,232],"might":[98],"be":[99,195],"generated":[100],"during":[101],"execution":[103],"program.":[107],"For":[108],"purpose,":[110],"developed":[112],"MetaSign":[113,147,299],":":[114],"tool":[116],"takes":[118],"input":[120,157],"collection":[122],"produces,":[128],"output,":[130],"set":[132,257],"transformation":[134,187,281],"rules":[135,199,219,282],"could":[137],"have":[138],"been":[139],"generate":[142,289],"considered":[144,168,291],"starts":[148],"control":[151],"flow":[152],"graph":[153],"agglomerates":[160],"them":[161],"into":[162],"automaton":[164],"approximates":[166],"The":[171],"upper":[172],"approximation":[173],"process":[174],"concept":[179],"widening":[181,251],"automata,":[182],"while":[183,216],"rules,":[188],"program,":[193],"can":[194],"viewed":[196],"rewriting":[198],"modeled":[201],"grammar":[203,209,268,273],"productions.":[204],"setting,":[207],"recognizes":[210],"language":[212,229],"variants,":[215],"production":[218],"model":[220],"transformations.":[223],"particular,":[225],"formalize":[227],"terms":[234],"pure":[236],"context-free":[237,243],"grammars,":[238],"similar":[241],"grammars":[244],"with":[245],"no":[246],"terminal":[247],"symbols.":[248],"After":[249],"process,":[252],"create":[254],"positive":[256],"samples":[259],"extract":[263],"productions":[265],"applying":[270],"learning":[272],"technique.":[274],"This":[275],"allows":[276],"us":[277],"learn":[279],"engine":[287],"validate":[295],"results":[297],"some":[301],"case":[302],"studies.":[303]},"counts_by_year":[{"year":2025,"cited_by_count":1},{"year":2024,"cited_by_count":4},{"year":2023,"cited_by_count":3},{"year":2022,"cited_by_count":3},{"year":2021,"cited_by_count":1}],"updated_date":"2025-11-06T03:46:38.306776","created_date":"2025-10-10T00:00:00"}