{"id":"https://openalex.org/W4386214400","doi":"https://doi.org/10.1109/csr57506.2023.10224946","title":"stealthML: Data-driven Malware for Stealthy Data Exfiltration","display_name":"stealthML: Data-driven Malware for Stealthy Data Exfiltration","publication_year":2023,"publication_date":"2023-07-31","ids":{"openalex":"https://openalex.org/W4386214400","doi":"https://doi.org/10.1109/csr57506.2023.10224946"},"language":"en","primary_location":{"id":"doi:10.1109/csr57506.2023.10224946","is_oa":false,"landing_page_url":"https://doi.org/10.1109/csr57506.2023.10224946","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2023 IEEE International Conference on Cyber Security and Resilience (CSR)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5047329487","display_name":"Keywhan Chung","orcid":"https://orcid.org/0000-0003-1078-8092"},"institutions":[{"id":"https://openalex.org/I157725225","display_name":"University of Illinois Urbana-Champaign","ror":"https://ror.org/047426m28","country_code":"US","type":"education","lineage":["https://openalex.org/I157725225"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Keywhan Chung","raw_affiliation_strings":["University of Illinois at Urbana-Champaign,Coordinated Science Laboratory","Coordinated Science Laboratory, University of Illinois at Urbana-Champaign"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Illinois at Urbana-Champaign,Coordinated Science Laboratory","institution_ids":["https://openalex.org/I157725225"]},{"raw_affiliation_string":"Coordinated Science Laboratory, University of Illinois at Urbana-Champaign","institution_ids":["https://openalex.org/I157725225"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5011948693","display_name":"Phuong Cao","orcid":"https://orcid.org/0000-0001-6028-0583"},"institutions":[{"id":"https://openalex.org/I157725225","display_name":"University of Illinois Urbana-Champaign","ror":"https://ror.org/047426m28","country_code":"US","type":"education","lineage":["https://openalex.org/I157725225"]},{"id":"https://openalex.org/I4210135837","display_name":"National Center for Supercomputing Applications","ror":"https://ror.org/03r10zj06","country_code":"US","type":"facility","lineage":["https://openalex.org/I157725225","https://openalex.org/I4210135837"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Phuong Cao","raw_affiliation_strings":["National Center for Supercomputing Applications, University of Illinois at Urbana-Champaign"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National Center for Supercomputing Applications, University of Illinois at Urbana-Champaign","institution_ids":["https://openalex.org/I157725225","https://openalex.org/I4210135837"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5043860236","display_name":"Zbigniew Kalbarczyk","orcid":"https://orcid.org/0009-0002-6040-6865"},"institutions":[{"id":"https://openalex.org/I157725225","display_name":"University of Illinois Urbana-Champaign","ror":"https://ror.org/047426m28","country_code":"US","type":"education","lineage":["https://openalex.org/I157725225"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Zbigniew T. Kalbarczyk","raw_affiliation_strings":["University of Illinois at Urbana-Champaign,Coordinated Science Laboratory","Coordinated Science Laboratory, University of Illinois at Urbana-Champaign"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Illinois at Urbana-Champaign,Coordinated Science Laboratory","institution_ids":["https://openalex.org/I157725225"]},{"raw_affiliation_string":"Coordinated Science Laboratory, University of Illinois at Urbana-Champaign","institution_ids":["https://openalex.org/I157725225"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5067802693","display_name":"Ravishankar K. Iyer","orcid":"https://orcid.org/0000-0003-2245-3038"},"institutions":[{"id":"https://openalex.org/I157725225","display_name":"University of Illinois Urbana-Champaign","ror":"https://ror.org/047426m28","country_code":"US","type":"education","lineage":["https://openalex.org/I157725225"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Ravishankar K. Iyer","raw_affiliation_strings":["University of Illinois at Urbana-Champaign,Coordinated Science Laboratory","Coordinated Science Laboratory, University of Illinois at Urbana-Champaign"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Illinois at Urbana-Champaign,Coordinated Science Laboratory","institution_ids":["https://openalex.org/I157725225"]},{"raw_affiliation_string":"Coordinated Science Laboratory, University of Illinois at Urbana-Champaign","institution_ids":["https://openalex.org/I157725225"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":2.166,"has_fulltext":false,"cited_by_count":6,"citation_normalized_percentile":{"value":0.8810008,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":95,"max":98},"biblio":{"volume":null,"issue":null,"first_page":"16","last_page":"21"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9991000294685364,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.9142726063728333},{"id":"https://openalex.org/keywords/payload","display_name":"Payload (computing)","score":0.8179076910018921},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7847256660461426},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.6252052783966064},{"id":"https://openalex.org/keywords/botnet","display_name":"Botnet","score":0.4797745645046234},{"id":"https://openalex.org/keywords/class","display_name":"Class (philosophy)","score":0.42355138063430786},{"id":"https://openalex.org/keywords/real-time-computing","display_name":"Real-time computing","score":0.32206982374191284},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.2162986695766449},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.13574862480163574},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.13144615292549133},{"id":"https://openalex.org/keywords/network-packet","display_name":"Network packet","score":0.06890133023262024}],"concepts":[{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.9142726063728333},{"id":"https://openalex.org/C134066672","wikidata":"https://www.wikidata.org/wiki/Q1424639","display_name":"Payload (computing)","level":3,"score":0.8179076910018921},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7847256660461426},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6252052783966064},{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.4797745645046234},{"id":"https://openalex.org/C2777212361","wikidata":"https://www.wikidata.org/wiki/Q5127848","display_name":"Class (philosophy)","level":2,"score":0.42355138063430786},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.32206982374191284},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.2162986695766449},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.13574862480163574},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.13144615292549133},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.06890133023262024}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/csr57506.2023.10224946","is_oa":false,"landing_page_url":"https://doi.org/10.1109/csr57506.2023.10224946","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2023 IEEE International Conference on Cyber Security and Resilience (CSR)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions","score":0.7900000214576721}],"awards":[{"id":"https://openalex.org/G7140776102","display_name":"PPoSS: Planning: Inflight Analytics to Control Large-Scale Heterogeneous Systems","funder_award_id":"2029049","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":12,"referenced_works":["https://openalex.org/W2064675550","https://openalex.org/W2571254578","https://openalex.org/W2765633793","https://openalex.org/W2928167276","https://openalex.org/W2971939610","https://openalex.org/W2973030849","https://openalex.org/W3004908285","https://openalex.org/W3129433613","https://openalex.org/W3200131685","https://openalex.org/W3209947356","https://openalex.org/W6767485864","https://openalex.org/W6803264350"],"related_works":["https://openalex.org/W2294483539","https://openalex.org/W2378449000","https://openalex.org/W3187581118","https://openalex.org/W2938399969","https://openalex.org/W3143747655","https://openalex.org/W2002178493","https://openalex.org/W2901835651","https://openalex.org/W2929621094","https://openalex.org/W1996006176","https://openalex.org/W4285325964"],"abstract_inverted_index":{"The":[0],"use":[1],"of":[2,16,40,79],"machine":[3,44],"learning":[4,45],"methods":[5],"have":[6],"been":[7],"actively":[8],"studied":[9],"to":[10,46,52,57,88,97,110],"detect":[11],"and":[12,50,67,91,101],"mitigate":[13],"the":[14,31,74,80,84,93,107,116],"consequences":[15],"malicious":[17],"attacks.":[18],"However,":[19],"this":[20],"sophisticated":[21],"technology":[22],"can":[23],"become":[24],"a":[25,37,69],"threat":[26],"when":[27,49],"it":[28],"falls":[29],"into":[30],"wrong":[32],"hands.":[33],"This":[34],"paper":[35],"describes":[36],"new":[38],"class":[39],"malware":[41,71],"that":[42,72,113],"employs":[43],"autonomously":[47],"infer":[48],"how":[51],"trigger":[53,98],"an":[54],"attack":[55,62],"payload":[56],"maximize":[58],"impact":[59],"while":[60],"minimizing":[61],"traces.":[63],"We":[64],"designed,":[65],"implemented,":[66],"demonstrated":[68],"smart":[70],"monitors":[73],"realtime":[75],"network":[76],"traffic":[77,86,90],"flow":[78],"victim":[81],"system,":[82],"analyzes":[83],"collected":[85],"data":[87,99,108],"forecast":[89],"identify":[92],"most":[94],"opportune":[95],"time":[96],"extraction,":[100],"optimizes":[102],"its":[103],"strategy":[104],"in":[105],"planning":[106],"exfiltration":[109],"minimize":[111],"traces":[112],"might":[114],"reveal":[115],"malware's":[117],"presence.":[118]},"counts_by_year":[{"year":2025,"cited_by_count":2},{"year":2024,"cited_by_count":4}],"updated_date":"2026-08-06T08:24:18.245995","created_date":"2025-10-10T00:00:00"}