{"id":"https://openalex.org/W2884852924","doi":"https://doi.org/10.1016/j.diin.2018.04.011","title":"On the viability of data collection using Google Rapid Response for enterprise-level malware research","display_name":"On the viability of data collection using Google Rapid Response for enterprise-level malware research","publication_year":2018,"publication_date":"2018-07-01","ids":{"openalex":"https://openalex.org/W2884852924","doi":"https://doi.org/10.1016/j.diin.2018.04.011","mag":"2884852924"},"language":"en","primary_location":{"id":"doi:10.1016/j.diin.2018.04.011","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.diin.2018.04.011","pdf_url":null,"source":{"id":"https://openalex.org/S67081940","display_name":"Digital Investigation","issn_l":"1742-2876","issn":["1742-2876","1873-202X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Digital Investigation","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1016/j.diin.2018.04.011","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5036113623","display_name":"Rayan Mosli","orcid":"https://orcid.org/0000-0002-8694-7996"},"institutions":[{"id":"https://openalex.org/I155173764","display_name":"Rochester Institute of Technology","ror":"https://ror.org/00v4yb702","country_code":"US","type":"education","lineage":["https://openalex.org/I155173764"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Rayan Mosli","raw_affiliation_strings":["College of Computing and Information Science, Rochester Institute of Technology, Rochester, NY, USA","Faculty of Computing and Information Technology, King Abdul-Aziz University, Jeddah, Saudi Arabia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"College of Computing and Information Science, Rochester Institute of Technology, Rochester, NY, USA","institution_ids":["https://openalex.org/I155173764"]},{"raw_affiliation_string":"Faculty of Computing and Information Technology, King Abdul-Aziz University, Jeddah, Saudi Arabia","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100770278","display_name":"Bo Yuan","orcid":"https://orcid.org/0000-0001-6612-9948"},"institutions":[{"id":"https://openalex.org/I155173764","display_name":"Rochester Institute of Technology","ror":"https://ror.org/00v4yb702","country_code":"US","type":"education","lineage":["https://openalex.org/I155173764"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Bo Yuan","raw_affiliation_strings":["College of Computing and Information Science, Rochester Institute of Technology, Rochester, NY, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"College of Computing and Information Science, Rochester Institute of Technology, Rochester, NY, USA","institution_ids":["https://openalex.org/I155173764"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5101532352","display_name":"Yin Pan","orcid":"https://orcid.org/0009-0005-2080-9522"},"institutions":[{"id":"https://openalex.org/I155173764","display_name":"Rochester Institute of Technology","ror":"https://ror.org/00v4yb702","country_code":"US","type":"education","lineage":["https://openalex.org/I155173764"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yin Pan","raw_affiliation_strings":["College of Computing and Information Science, Rochester Institute of Technology, Rochester, NY, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"College of Computing and Information Science, Rochester Institute of Technology, Rochester, NY, USA","institution_ids":["https://openalex.org/I155173764"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5036113623"],"corresponding_institution_ids":["https://openalex.org/I155173764"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":{"value":0.07718121,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":"26","issue":null,"first_page":"S139","last_page":"S139"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9923999905586243,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9923999905586243,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9377999901771545,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.930400013923645,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8695884346961975},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.6706453561782837},{"id":"https://openalex.org/keywords/sandbox","display_name":"Sandbox (software development)","score":0.6112070083618164},{"id":"https://openalex.org/keywords/data-collection","display_name":"Data collection","score":0.5598597526550293},{"id":"https://openalex.org/keywords/triage","display_name":"Triage","score":0.5132867693901062},{"id":"https://openalex.org/keywords/automation","display_name":"Automation","score":0.42170393466949463},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.33310186862945557},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.2809707522392273}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8695884346961975},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.6706453561782837},{"id":"https://openalex.org/C167981075","wikidata":"https://www.wikidata.org/wiki/Q2667186","display_name":"Sandbox (software development)","level":2,"score":0.6112070083618164},{"id":"https://openalex.org/C133462117","wikidata":"https://www.wikidata.org/wiki/Q4929239","display_name":"Data collection","level":2,"score":0.5598597526550293},{"id":"https://openalex.org/C2777120189","wikidata":"https://www.wikidata.org/wiki/Q780067","display_name":"Triage","level":2,"score":0.5132867693901062},{"id":"https://openalex.org/C115901376","wikidata":"https://www.wikidata.org/wiki/Q184199","display_name":"Automation","level":2,"score":0.42170393466949463},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.33310186862945557},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.2809707522392273},{"id":"https://openalex.org/C194828623","wikidata":"https://www.wikidata.org/wiki/Q2861470","display_name":"Emergency medicine","level":1,"score":0.0},{"id":"https://openalex.org/C105795698","wikidata":"https://www.wikidata.org/wiki/Q12483","display_name":"Statistics","level":1,"score":0.0},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.0},{"id":"https://openalex.org/C78519656","wikidata":"https://www.wikidata.org/wiki/Q101333","display_name":"Mechanical engineering","level":1,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0},{"id":"https://openalex.org/C71924100","wikidata":"https://www.wikidata.org/wiki/Q11190","display_name":"Medicine","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1016/j.diin.2018.04.011","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.diin.2018.04.011","pdf_url":null,"source":{"id":"https://openalex.org/S67081940","display_name":"Digital Investigation","issn_l":"1742-2876","issn":["1742-2876","1873-202X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Digital Investigation","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1016/j.diin.2018.04.011","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.diin.2018.04.011","pdf_url":null,"source":{"id":"https://openalex.org/S67081940","display_name":"Digital Investigation","issn_l":"1742-2876","issn":["1742-2876","1873-202X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Digital Investigation","raw_type":"journal-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/9","score":0.550000011920929,"display_name":"Industry, innovation and infrastructure"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W2033352828","https://openalex.org/W2355810117","https://openalex.org/W3098313552","https://openalex.org/W70177500","https://openalex.org/W2034129977","https://openalex.org/W3099773647","https://openalex.org/W1745773915","https://openalex.org/W2765820957","https://openalex.org/W2294212083","https://openalex.org/W4367595269"],"abstract_inverted_index":{"With":[0],"the":[1,11,29,43,53,75,82,102,108,111,116,135,149,153,186,211,215,224,237,259,266,281],"increasing":[2,236],"number":[3,238],"of":[4,13,16,32,37,47,56,77,104,110,128,148,169,239,261,269,284,298],"attacks":[5],"on":[6,70,205],"enterprises,":[7],"which":[8],"often":[9],"involves":[10],"deployment":[12],"some":[14],"form":[15],"malware,":[17],"an":[18,33,163,192],"automated":[19],"method":[20],"for":[21,62,96,132,275,289],"performing":[22],"large-scale":[23,276],"triage":[24,69,97],"has":[25],"become":[26],"essential":[27],"to":[28,41,59,119,229,245,255],"timely":[30],"resolution":[31],"incident.":[34],"The":[35],"purpose":[36],"this":[38,78],"project":[39],"is":[40,195,253,273,286],"combine":[42],"data":[44,61,105,113,226,292],"collection":[45,106,227,293],"capabilities":[46],"Google":[48],"Rapid":[49],"Response":[50],"(GRR)":[51],"with":[52],"flexible":[54],"automation":[55],"Cuckoo":[57],"Sandbox,":[58],"collect":[60],"training":[63],"machine":[64],"learning":[65],"models":[66],"that":[67,84,173,235,280],"perform":[68],"enterprise":[71],"machines.":[72,122],"To":[73],"evaluate":[74],"viability":[76],"approach,":[79],"we":[80,100,124,278],"investigate":[81],"artifacts":[83,172,187,200,222,244],"can":[85,174],"be":[86,175,246],"collected":[87,112,177,189],"using":[88,155,162,178,295],"GRR":[89,216,272,285],"and":[90,107,138,159,214,258],"whether":[91],"they":[92],"provide":[93],"salient":[94],"features":[95],"automation.":[98],"Furthermore,":[99],"consider":[101],"speed":[103],"consistency":[109],"when":[114,143,294],"scaling":[115],"analysis":[117,212,240],"environment":[118],"include":[120,151],"more":[121],"Moreover,":[123],"develop":[125],"multiple":[126],"simulations":[127,150],"benign":[129,136],"computer":[130],"usage":[131],"both":[133],"generating":[134],"dataset":[137],"as":[139],"real-world":[140],"background":[141],"activities":[142],"injecting":[144],"malware":[145,290],"samples.":[146],"Examples":[147],"surfing":[152],"web,":[154],"a":[156,167,206],"word":[157],"editor,":[158],"python":[160],"coding":[161],"IDE.":[164],"We":[165,232],"investigated":[166],"total":[168],"39":[170,199],"Windows":[171],"remotely":[176],"GRR's":[179],"StartFlowAndWait":[180,182,296],"API.":[181],"blocks":[183],"execution":[184],"until":[185,191],"are":[188],"or":[190],"error":[193],"message":[194],"received.":[196],"Collecting":[197],"all":[198],"required":[201],"over":[202],"1":[203],"h":[204],"dedicated":[207],"network":[208,256],"connection":[209],"between":[210],"VM":[213],"server.":[217],"However,":[218],"handpicking":[219],"only":[220],"11":[221],"reduces":[223],"average":[225],"time":[228],"4":[230],"min.":[231],"also":[233],"found":[234,279],"machines":[241],"caused":[242],"less":[243],"successfully":[247],"collected.":[248],"This":[249],"drop":[250],"in":[251],"reliability":[252],"due":[254],"congestion":[257],"waste":[260],"other":[262],"computing":[263],"resources":[264],"from":[265],"blocking":[267],"mechanism":[268],"StartFlowAndWait.":[270],"Although":[271],"designed":[274],"deployment,":[277],"default":[282],"configuration":[283],"not":[287],"sufficient":[288],"research":[291],"instead":[297],"StartFlow.":[299]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2025-11-06T03:46:38.306776","created_date":"2025-10-10T00:00:00"}