{"id":"https://openalex.org/W1974189812","doi":"https://doi.org/10.1109/cns.2014.6997496","title":"Chatter: Classifying malware families using system event ordering","display_name":"Chatter: Classifying malware families using system event ordering","publication_year":2014,"publication_date":"2014-10-01","ids":{"openalex":"https://openalex.org/W1974189812","doi":"https://doi.org/10.1109/cns.2014.6997496","mag":"1974189812"},"language":"en","primary_location":{"id":"doi:10.1109/cns.2014.6997496","is_oa":false,"landing_page_url":"https://doi.org/10.1109/cns.2014.6997496","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2014 IEEE Conference on Communications and Network Security","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5077402873","display_name":"Aziz Mohaisen","orcid":"https://orcid.org/0000-0003-3227-2505"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Aziz Mohaisen","raw_affiliation_strings":["Verisign Labs, VA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Verisign Labs, VA, USA","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5015211298","display_name":"Andrew G. West","orcid":"https://orcid.org/0000-0001-5840-1032"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Andrew G. West","raw_affiliation_strings":["Verisign Labs, VA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Verisign Labs, VA, USA","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5051741835","display_name":"Allison Mankin","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Allison Mankin","raw_affiliation_strings":["Verisign Labs, VA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Verisign Labs, VA, USA","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5088269951","display_name":"Omar Alrawi","orcid":"https://orcid.org/0000-0002-4374-737X"},"institutions":[{"id":"https://openalex.org/I92528248","display_name":"Qatar Foundation","ror":"https://ror.org/01cawbq05","country_code":"QA","type":"funder","lineage":["https://openalex.org/I92528248"]}],"countries":["QA"],"is_corresponding":false,"raw_author_name":"Omar Alrawi","raw_affiliation_strings":["Qatar Foundation, Doha, Qatar"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Qatar Foundation, Doha, Qatar","institution_ids":["https://openalex.org/I92528248"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":2.733,"has_fulltext":false,"cited_by_count":33,"citation_normalized_percentile":{"value":0.91925638,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":98},"biblio":{"volume":null,"issue":null,"first_page":"283","last_page":"291"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9965999722480774,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.822275698184967},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6751363277435303},{"id":"https://openalex.org/keywords/event","display_name":"Event (particle physics)","score":0.5424739122390747},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.39672261476516724},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.33031338453292847},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.3115721046924591},{"id":"https://openalex.org/keywords/physics","display_name":"Physics","score":0.060988932847976685}],"concepts":[{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.822275698184967},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6751363277435303},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.5424739122390747},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.39672261476516724},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.33031338453292847},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3115721046924591},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.060988932847976685},{"id":"https://openalex.org/C62520636","wikidata":"https://www.wikidata.org/wiki/Q944","display_name":"Quantum mechanics","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/cns.2014.6997496","is_oa":false,"landing_page_url":"https://doi.org/10.1109/cns.2014.6997496","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2014 IEEE Conference on Communications and Network Security","raw_type":"proceedings-article"},{"id":"pmh:oai:CiteSeerX.psu:10.1.1.982.7040","is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.982.7040","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"https://works.bepress.com/andrew_g_west/34/download/","raw_type":"text"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":70,"referenced_works":["https://openalex.org/W37020084","https://openalex.org/W80155331","https://openalex.org/W134490355","https://openalex.org/W143519483","https://openalex.org/W155384935","https://openalex.org/W191098608","https://openalex.org/W250426404","https://openalex.org/W1237542396","https://openalex.org/W1491237615","https://openalex.org/W1531782611","https://openalex.org/W1553801604","https://openalex.org/W1581009051","https://openalex.org/W1583098994","https://openalex.org/W1587106557","https://openalex.org/W1775772884","https://openalex.org/W1827212170","https://openalex.org/W1851403712","https://openalex.org/W1909494783","https://openalex.org/W1910686388","https://openalex.org/W1954903228","https://openalex.org/W1968061803","https://openalex.org/W1973685381","https://openalex.org/W1977415353","https://openalex.org/W1985987493","https://openalex.org/W2010439280","https://openalex.org/W2051498836","https://openalex.org/W2063898900","https://openalex.org/W2064274762","https://openalex.org/W2066220442","https://openalex.org/W2082550445","https://openalex.org/W2083183119","https://openalex.org/W2084979543","https://openalex.org/W2103593753","https://openalex.org/W2105631555","https://openalex.org/W2114996745","https://openalex.org/W2119521622","https://openalex.org/W2121749752","https://openalex.org/W2126401948","https://openalex.org/W2128389850","https://openalex.org/W2137314966","https://openalex.org/W2137964233","https://openalex.org/W2138644293","https://openalex.org/W2141577524","https://openalex.org/W2142881470","https://openalex.org/W2144112223","https://openalex.org/W2149701633","https://openalex.org/W2151135920","https://openalex.org/W2165357553","https://openalex.org/W2401054255","https://openalex.org/W2751318774","https://openalex.org/W2762258958","https://openalex.org/W3136767761","https://openalex.org/W6603260413","https://openalex.org/W6605901207","https://openalex.org/W6606342502","https://openalex.org/W6607784307","https://openalex.org/W6627871285","https://openalex.org/W6629287744","https://openalex.org/W6631877889","https://openalex.org/W6634779276","https://openalex.org/W6638021444","https://openalex.org/W6638623425","https://openalex.org/W6639864006","https://openalex.org/W6640663528","https://openalex.org/W6667106371","https://openalex.org/W6678051712","https://openalex.org/W6680604901","https://openalex.org/W6713023146","https://openalex.org/W6745097691","https://openalex.org/W6922295283"],"related_works":["https://openalex.org/W2097492617","https://openalex.org/W2753240997","https://openalex.org/W1764168690","https://openalex.org/W2537959205","https://openalex.org/W2740895074","https://openalex.org/W2772446090","https://openalex.org/W4284893819","https://openalex.org/W2249809453","https://openalex.org/W3152891574","https://openalex.org/W4316881845"],"abstract_inverted_index":{"Using":[0],"runtime":[1],"execution":[2,94],"artifacts":[3],"to":[4,118],"identify":[5],"malware":[6,62,123,145],"and":[7,52,93,130,143,159],"its":[8,131,135],"associated":[9],"\u201cfamily\u201d":[10],"is":[11,73],"an":[12,91,106,174],"established":[13],"technique":[14,129,152],"in":[15,21,79,157],"the":[16,22,50,77,151],"security":[17],"domain.":[18],"Many":[19],"papers":[20],"literature":[23],"rely":[24],"on":[25],"explicit":[26],"features":[27,172],"derived":[28],"from":[29],"network,":[30],"file":[31],"system,":[32],"or":[33],"registry":[34],"interaction.":[35],"While":[36],"effective,":[37],"use":[38],"of":[39,101,110,170,176],"these":[40,45],"fine-granularity":[41],"data":[42],"points":[43],"makes":[44,160],"techniquse":[46],"computationally":[47],"expensive.":[48],"Moreover,":[49],"signatures":[51],"heuristics":[53],"this":[54,65],"analysis":[55],"produces":[56],"are":[57,88,96,116,141,147],"often":[58],"circumvented":[59],"by":[60],"subsequent":[61],"authors.":[63],"To":[64],"end":[66],"we":[67],"propose":[68],"CHATTER,":[69],"a":[70,120,167],"system":[71,82],"that":[72,128],"concerned":[74],"only":[75,138],"with":[76,166],"order":[78],"which":[80],"high-level":[81],"events":[83,87,140],"take":[84],"place.":[85],"Individual":[86],"mapped":[89],"onto":[90],"alphabet":[92],"traces":[95],"captured":[97],"via":[98],"terse":[99],"concatenations":[100],"those":[102],"letters.":[103],"Then,":[104],"leveraging":[105],"analyst":[107],"labeled":[108],"corpus":[109],"malware,":[111],"n-gram":[112],"document":[113],"classification":[114],"techniques":[115],"applied":[117],"produce":[119],"classifier":[121,169],"predicting":[122],"family.":[124],"This":[125],"paper":[126],"describes":[127],"proof-of-concept":[132],"evaluation.":[133],"In":[134],"prototype":[136],"form":[137],"network":[139],"considered":[142],"three":[144],"families":[146],"highlighted.":[148],"We":[149],"show":[150],"achieves":[153],"roughly":[154,177],"80%":[155],"accuracy":[156,175],"isolation":[158],"non-trivial":[161],"performance":[162],"improvements":[163],"when":[164],"integrated":[165],"baseline":[168],"non-ordered":[171],"(with":[173],"95%).":[178]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":2},{"year":2023,"cited_by_count":2},{"year":2022,"cited_by_count":5},{"year":2021,"cited_by_count":2},{"year":2020,"cited_by_count":2},{"year":2019,"cited_by_count":4},{"year":2018,"cited_by_count":4},{"year":2017,"cited_by_count":3},{"year":2016,"cited_by_count":5},{"year":2015,"cited_by_count":2},{"year":2014,"cited_by_count":1}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}