{"id":"https://openalex.org/W4413925588","doi":"https://doi.org/10.1109/access.2025.3605020","title":"A Threat-Informed Approach to Malware Evasion Using DRM and TLS Callbacks","display_name":"A Threat-Informed Approach to Malware Evasion Using DRM and TLS Callbacks","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W4413925588","doi":"https://doi.org/10.1109/access.2025.3605020"},"language":"en","primary_location":{"id":"doi:10.1109/access.2025.3605020","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2025.3605020","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1109/access.2025.3605020","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5116481166","display_name":"Swayam Tejas Padhy","orcid":null},"institutions":[{"id":"https://openalex.org/I164861460","display_name":"Manipal Academy of Higher Education","ror":"https://ror.org/02xzytt36","country_code":"IN","type":"education","lineage":["https://openalex.org/I164861460"]}],"countries":["IN"],"is_corresponding":false,"raw_author_name":"Swayam Tejas Padhy","raw_affiliation_strings":["Department of Computer Science and Engineering, Manipal Institute of Technology, Manipal Academy of Higher Education, Manipal, Karnataka, India"],"raw_orcid":"https://orcid.org/0009-0001-0800-647X","affiliations":[{"raw_affiliation_string":"Department of Computer Science and Engineering, Manipal Institute of Technology, Manipal Academy of Higher Education, Manipal, Karnataka, India","institution_ids":["https://openalex.org/I164861460"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5103258673","display_name":"P B Shanthi","orcid":null},"institutions":[{"id":"https://openalex.org/I164861460","display_name":"Manipal Academy of Higher Education","ror":"https://ror.org/02xzytt36","country_code":"IN","type":"education","lineage":["https://openalex.org/I164861460"]}],"countries":["IN"],"is_corresponding":false,"raw_author_name":"P. B. Shanthi","raw_affiliation_strings":["Department of Computer Science and Engineering, Manipal Institute of Technology, Manipal Academy of Higher Education, Manipal, Karnataka, India"],"raw_orcid":"https://orcid.org/0000-0003-3276-7073","affiliations":[{"raw_affiliation_string":"Department of Computer Science and Engineering, Manipal Institute of Technology, Manipal Academy of Higher Education, Manipal, Karnataka, India","institution_ids":["https://openalex.org/I164861460"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5060755524","display_name":"Gururaj Bijur","orcid":"https://orcid.org/0000-0002-7529-7449"},"institutions":[{"id":"https://openalex.org/I164861460","display_name":"Manipal Academy of Higher Education","ror":"https://ror.org/02xzytt36","country_code":"IN","type":"education","lineage":["https://openalex.org/I164861460"]}],"countries":["IN"],"is_corresponding":false,"raw_author_name":"Gururaj Bijur","raw_affiliation_strings":["Department of Computer Science and Engineering, Manipal Institute of Technology, Manipal Academy of Higher Education, Manipal, Karnataka, India"],"raw_orcid":"https://orcid.org/0000-0002-7529-7449","affiliations":[{"raw_affiliation_string":"Department of Computer Science and Engineering, Manipal Institute of Technology, Manipal Academy of Higher Education, Manipal, Karnataka, India","institution_ids":["https://openalex.org/I164861460"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100769654","display_name":"S Hemalatha","orcid":null},"institutions":[{"id":"https://openalex.org/I164861460","display_name":"Manipal Academy of Higher Education","ror":"https://ror.org/02xzytt36","country_code":"IN","type":"education","lineage":["https://openalex.org/I164861460"]}],"countries":["IN"],"is_corresponding":false,"raw_author_name":"S. Hemalatha","raw_affiliation_strings":["Department of Computer Science and Engineering, Manipal Institute of Technology, Manipal Academy of Higher Education, Manipal, Karnataka, India"],"raw_orcid":"https://orcid.org/0000-0002-1826-0738","affiliations":[{"raw_affiliation_string":"Department of Computer Science and Engineering, Manipal Institute of Technology, Manipal Academy of Higher Education, Manipal, Karnataka, India","institution_ids":["https://openalex.org/I164861460"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I164861460"],"apc_list":{"value":1850,"currency":"USD","value_usd":1850},"apc_paid":{"value":1850,"currency":"USD","value_usd":1850},"fwci":1.8049,"has_fulltext":false,"cited_by_count":2,"citation_normalized_percentile":{"value":0.86518615,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":97,"max":98},"biblio":{"volume":"13","issue":null,"first_page":"155195","last_page":"155202"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9980000257492065,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.995199978351593,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7680679559707642},{"id":"https://openalex.org/keywords/callback","display_name":"Callback","score":0.7335755825042725},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.7038958072662354},{"id":"https://openalex.org/keywords/evasion","display_name":"Evasion (ethics)","score":0.675510048866272},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.6056612133979797},{"id":"https://openalex.org/keywords/internet-privacy","display_name":"Internet privacy","score":0.5159767270088196},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.16874924302101135}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7680679559707642},{"id":"https://openalex.org/C204495577","wikidata":"https://www.wikidata.org/wiki/Q1205349","display_name":"Callback","level":2,"score":0.7335755825042725},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.7038958072662354},{"id":"https://openalex.org/C2781251061","wikidata":"https://www.wikidata.org/wiki/Q5416089","display_name":"Evasion (ethics)","level":3,"score":0.675510048866272},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.6056612133979797},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.5159767270088196},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.16874924302101135},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C203014093","wikidata":"https://www.wikidata.org/wiki/Q101929","display_name":"Immunology","level":1,"score":0.0},{"id":"https://openalex.org/C8891405","wikidata":"https://www.wikidata.org/wiki/Q1059","display_name":"Immune system","level":2,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/access.2025.3605020","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2025.3605020","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:4fb9a4540b3b4b54b4c3e353fab546db","is_oa":true,"landing_page_url":"https://doaj.org/article/4fb9a4540b3b4b54b4c3e353fab546db","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Access, Vol 13, Pp 155195-155202 (2025)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1109/access.2025.3605020","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2025.3605020","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":19,"referenced_works":["https://openalex.org/W2003568760","https://openalex.org/W2019500454","https://openalex.org/W2052854541","https://openalex.org/W2140807364","https://openalex.org/W2150231791","https://openalex.org/W2496872468","https://openalex.org/W2807637148","https://openalex.org/W2988961468","https://openalex.org/W3007135727","https://openalex.org/W3147694637","https://openalex.org/W3153302004","https://openalex.org/W3194131055","https://openalex.org/W4281687663","https://openalex.org/W4323240627","https://openalex.org/W4389829966","https://openalex.org/W4390018122","https://openalex.org/W4392980220","https://openalex.org/W4400170336","https://openalex.org/W4405137318"],"related_works":["https://openalex.org/W2613684332","https://openalex.org/W2283761799","https://openalex.org/W2126556840","https://openalex.org/W2117563254","https://openalex.org/W2783112941","https://openalex.org/W2526398307","https://openalex.org/W2470029541","https://openalex.org/W4387065217","https://openalex.org/W4368275542","https://openalex.org/W2470502009"],"abstract_inverted_index":{"As":[0],"adversaries":[1],"refine":[2],"their":[3],"techniques":[4,144],"to":[5,17,36,47,74,161,171],"avoid":[6],"detection,":[7],"Advanced":[8],"Persistent":[9],"Threats":[10],"(APTs)":[11],"are":[12,58],"increasingly":[13],"exploring":[14],"unconventional":[15],"mechanisms":[16],"maintain":[18],"stealth.":[19],"This":[20,158],"paper":[21,94,159],"introduces":[22,122],"a":[23,48,96,102,106,137,148,163],"novel":[24],"approach":[25],"that":[26,167],"leverages":[27],"Digital":[28],"Rights":[29],"Management":[30],"(DRM)":[31],"as":[32],"an":[33],"anti-analysis":[34,111],"shield":[35],"prevent":[37],"reverse":[38],"engineering":[39],"and":[40,55,110,128,140],"forensic":[41],"investigation.":[42],"By":[43],"binding":[44],"malware":[45],"execution":[46,80],"specific":[49],"machine":[50],"through":[51],"DRM":[52],"fingerprinting,":[53],"sandbox,":[54],"virtual-machine":[56],"analysis":[57],"effectively":[59],"thwarted.":[60],"To":[61,113],"harden":[62],"this":[63],"mechanism,":[64,142],"anti-debugging":[65],"via":[66],"Thread":[67],"Local":[68],"Storage":[69],"(TLS)":[70],"callbacks":[71],"is":[72,136],"implemented":[73],"detect":[75],"debuggers":[76],"before":[77],"the":[78,89,99,133,143],"main":[79,91],"begins,":[81],"rendering":[82],"any":[83],"debugging":[84],"attempt":[85],"futile":[86],"by":[87,154],"nullifying":[88],"malware\u2019s":[90],"function.":[92],"The":[93],"presents":[95],"proof-of-concept":[97],"in":[98],"form":[100],"of":[101],"DLL":[103],"injector,":[104],"showcasing":[105],"stealthy":[107],"persistence":[108,141],"mechanism":[109],"measures.":[112],"further":[114],"complicate":[115],"analysis,":[116],"Import":[117],"Address":[118],"Table":[119],"(IAT)":[120],"camouflage":[121],"whitelisted":[123],"API":[124],"noise,":[125],"misleading":[126],"defenders":[127],"evading":[129],"static":[130],"detection.":[131],"While":[132],"current":[134],"implementation":[135],"minimal":[138],"loader":[139],"outlined":[145],"here":[146],"provide":[147],"blueprint":[149],"for":[150],"more":[151],"sophisticated":[152],"operations":[153],"advanced":[155],"threat":[156],"actors.":[157],"aims":[160],"highlight":[162],"unique":[164],"attack":[165],"chain":[166],"could":[168],"be":[169],"utilized":[170],"essentially":[172],"nullify":[173],"modern":[174],"defensive":[175],"mechanisms.":[176]},"counts_by_year":[{"year":2026,"cited_by_count":2}],"updated_date":"2026-03-27T05:58:40.876381","created_date":"2025-10-10T00:00:00"}