{"id":"https://openalex.org/W4211194511","doi":"https://doi.org/10.1109/ccnc49033.2022.9700530","title":"Malware Family Classification via Residual Prefetch Artifacts","display_name":"Malware Family Classification via Residual Prefetch Artifacts","publication_year":2022,"publication_date":"2022-01-08","ids":{"openalex":"https://openalex.org/W4211194511","doi":"https://doi.org/10.1109/ccnc49033.2022.9700530"},"language":"en","primary_location":{"id":"doi:10.1109/ccnc49033.2022.9700530","is_oa":false,"landing_page_url":"https://doi.org/10.1109/ccnc49033.2022.9700530","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2022 IEEE 19th Annual Consumer Communications & Networking Conference (CCNC)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5075793938","display_name":"Adam Duby","orcid":null},"institutions":[{"id":"https://openalex.org/I192545095","display_name":"United States Military Academy","ror":"https://ror.org/01jepya76","country_code":"US","type":"education","lineage":["https://openalex.org/I1304082316","https://openalex.org/I1330347796","https://openalex.org/I192545095","https://openalex.org/I4210088792"]},{"id":"https://openalex.org/I4210137659","display_name":"American Military Academy","ror":"https://ror.org/02xs6gm19","country_code":"PR","type":"education","lineage":["https://openalex.org/I4210137659"]}],"countries":["PR","US"],"is_corresponding":false,"raw_author_name":"Adam Duby","raw_affiliation_strings":["United States Military Academy"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"United States Military Academy","institution_ids":["https://openalex.org/I4210137659","https://openalex.org/I192545095"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5111373813","display_name":"Teryl Taylor","orcid":"https://orcid.org/0000-0002-4915-1286"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Teryl Taylor","raw_affiliation_strings":["IBM Research"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"IBM Research","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5072959708","display_name":"Yanyan Zhuang","orcid":"https://orcid.org/0000-0002-8407-0801"},"institutions":[{"id":"https://openalex.org/I888729015","display_name":"University of Colorado Colorado Springs","ror":"https://ror.org/054spjc55","country_code":"US","type":"education","lineage":["https://openalex.org/I888729015"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yanyan Zhuang","raw_affiliation_strings":["University of Colorado Colorado Springs"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Colorado Colorado Springs","institution_ids":["https://openalex.org/I888729015"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":8,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"256","last_page":"259"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9994000196456909,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/instruction-prefetch","display_name":"Instruction prefetch","score":0.9113073945045471},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.8921220302581787},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8229407668113708},{"id":"https://openalex.org/keywords/executable","display_name":"Executable","score":0.6382101774215698},{"id":"https://openalex.org/keywords/malware-analysis","display_name":"Malware analysis","score":0.5064440965652466},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.4964964985847473},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.45529037714004517},{"id":"https://openalex.org/keywords/cryptovirology","display_name":"Cryptovirology","score":0.4540170431137085},{"id":"https://openalex.org/keywords/system-call","display_name":"System call","score":0.4126623570919037},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.38363927602767944},{"id":"https://openalex.org/keywords/database","display_name":"Database","score":0.34643787145614624}],"concepts":[{"id":"https://openalex.org/C133588205","wikidata":"https://www.wikidata.org/wiki/Q28455645","display_name":"Instruction prefetch","level":3,"score":0.9113073945045471},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.8921220302581787},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8229407668113708},{"id":"https://openalex.org/C160145156","wikidata":"https://www.wikidata.org/wiki/Q778586","display_name":"Executable","level":2,"score":0.6382101774215698},{"id":"https://openalex.org/C2779395397","wikidata":"https://www.wikidata.org/wiki/Q15731404","display_name":"Malware analysis","level":3,"score":0.5064440965652466},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.4964964985847473},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.45529037714004517},{"id":"https://openalex.org/C84525096","wikidata":"https://www.wikidata.org/wiki/Q3506050","display_name":"Cryptovirology","level":3,"score":0.4540170431137085},{"id":"https://openalex.org/C2778579508","wikidata":"https://www.wikidata.org/wiki/Q722192","display_name":"System call","level":2,"score":0.4126623570919037},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.38363927602767944},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.34643787145614624},{"id":"https://openalex.org/C115537543","wikidata":"https://www.wikidata.org/wiki/Q165596","display_name":"Cache","level":2,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/ccnc49033.2022.9700530","is_oa":false,"landing_page_url":"https://doi.org/10.1109/ccnc49033.2022.9700530","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2022 IEEE 19th Annual Consumer Communications & Networking Conference (CCNC)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.6700000166893005,"display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":27,"referenced_works":["https://openalex.org/W1545528966","https://openalex.org/W1985328160","https://openalex.org/W2226549142","https://openalex.org/W2292109572","https://openalex.org/W2527619560","https://openalex.org/W2600031682","https://openalex.org/W2621204675","https://openalex.org/W2732916693","https://openalex.org/W2751661638","https://openalex.org/W2766465617","https://openalex.org/W2790484531","https://openalex.org/W2792991556","https://openalex.org/W2900633536","https://openalex.org/W2944079373","https://openalex.org/W2963563709","https://openalex.org/W2963961561","https://openalex.org/W2964636835","https://openalex.org/W2990954041","https://openalex.org/W2996791554","https://openalex.org/W3008603700","https://openalex.org/W3015481738","https://openalex.org/W3193668405","https://openalex.org/W6689349070","https://openalex.org/W6740449585","https://openalex.org/W6745676123","https://openalex.org/W6749652745","https://openalex.org/W6753153400"],"related_works":["https://openalex.org/W2469507153","https://openalex.org/W1977330409","https://openalex.org/W2965893286","https://openalex.org/W2982096504","https://openalex.org/W2991580804","https://openalex.org/W2548537835","https://openalex.org/W2810666735","https://openalex.org/W3211525895","https://openalex.org/W2469346691","https://openalex.org/W2183680341"],"abstract_inverted_index":{"Automated":[0],"malware":[1,5,12,22,26,50,63,80],"classification":[2,13,64,112],"assigns":[3],"unknown":[4],"to":[6,20,78],"known":[7],"families.":[8],"Most":[9],"research":[10],"in":[11,51],"assumes":[14],"that":[15,97,111],"the":[16,21,55,68],"defender":[17],"has":[18],"access":[19],"for":[23,131],"analysis.":[24,133],"Unfortunately,":[25],"can":[27],"delete":[28],"itself":[29],"after":[30],"execution.":[31],"As":[32],"a":[33,61,82,93,128],"result,":[34],"analysts":[35,77,127],"are":[36],"only":[37],"left":[38],"with":[39,116],"digital":[40],"residue,":[41],"such":[42,102],"as":[43,103],"network":[44],"logs":[45],"or":[46,53],"remnant":[47],"artifacts":[48],"of":[49],"memory":[52],"on":[54,67],"file":[56,94],"system.":[57],"In":[58],"this":[59],"paper,":[60],"novel":[62],"method":[65],"based":[66],"Windows":[69,90],"prefetch":[70,91],"mechanism":[71],"is":[72],"presented":[73],"and":[74,106,124],"evaluated,":[75],"enabling":[76],"classify":[79],"without":[81],"corresponding":[83],"executable.":[84],"The":[85],"approach":[86],"extracts":[87],"features":[88,115],"from":[89],"files,":[92],"system":[95],"artifact":[96],"contains":[98],"historical":[99],"process":[100,107],"information":[101],"loaded":[104],"libraries":[105],"dependencies.":[108],"Results":[109],"show":[110],"using":[113],"these":[114],"two":[117],"different":[118],"algorithms":[119],"garnered":[120],"F-Scores":[121],"between":[122],"0.80":[123],"0.82,":[125],"offering":[126],"viable":[129],"option":[130],"forensic":[132]},"counts_by_year":[{"year":2025,"cited_by_count":1},{"year":2024,"cited_by_count":1},{"year":2023,"cited_by_count":3},{"year":2022,"cited_by_count":3}],"updated_date":"2026-07-15T18:14:33.161393","created_date":"2025-10-10T00:00:00"}