{"id":"https://openalex.org/W2916667465","doi":"https://doi.org/10.1109/glocom.2018.8648070","title":"Malware Detection Based on Dynamic Multi-Feature Using Ensemble Learning at Hypervisor","display_name":"Malware Detection Based on Dynamic Multi-Feature Using Ensemble Learning at Hypervisor","publication_year":2018,"publication_date":"2018-12-01","ids":{"openalex":"https://openalex.org/W2916667465","doi":"https://doi.org/10.1109/glocom.2018.8648070","mag":"2916667465"},"language":"en","primary_location":{"id":"doi:10.1109/glocom.2018.8648070","is_oa":false,"landing_page_url":"https://doi.org/10.1109/glocom.2018.8648070","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2018 IEEE Global Communications Conference (GLOBECOM)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100409970","display_name":"Jian Zhang","orcid":"https://orcid.org/0000-0002-5163-5458"},"institutions":[{"id":"https://openalex.org/I136765683","display_name":"Tianjin University of Technology","ror":"https://ror.org/00zbe0w13","country_code":"CN","type":"education","lineage":["https://openalex.org/I136765683"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jian Zhang","raw_affiliation_strings":["School of Computer Science and Engineering, Tianjin University of Technology, Tianjin, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computer Science and Engineering, Tianjin University of Technology, Tianjin, China","institution_ids":["https://openalex.org/I136765683"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5024768001","display_name":"Cheng Gao","orcid":"https://orcid.org/0000-0003-2233-2914"},"institutions":[{"id":"https://openalex.org/I136765683","display_name":"Tianjin University of Technology","ror":"https://ror.org/00zbe0w13","country_code":"CN","type":"education","lineage":["https://openalex.org/I136765683"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Cheng Gao","raw_affiliation_strings":["School of Computer Science and Engineering, Tianjin University of Technology, Tianjin, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computer Science and Engineering, Tianjin University of Technology, Tianjin, China","institution_ids":["https://openalex.org/I136765683"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5076665590","display_name":"Liangyi Gong","orcid":"https://orcid.org/0000-0002-9067-8733"},"institutions":[{"id":"https://openalex.org/I136765683","display_name":"Tianjin University of Technology","ror":"https://ror.org/00zbe0w13","country_code":"CN","type":"education","lineage":["https://openalex.org/I136765683"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Liangyi Gong","raw_affiliation_strings":["School of Computer Science and Engineering, Tianjin University of Technology, Tianjin, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computer Science and Engineering, Tianjin University of Technology, Tianjin, China","institution_ids":["https://openalex.org/I136765683"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5040254783","display_name":"Zhaojun Gu","orcid":"https://orcid.org/0000-0002-1972-0951"},"institutions":[{"id":"https://openalex.org/I28813325","display_name":"Civil Aviation University of China","ror":"https://ror.org/03je71k37","country_code":"CN","type":"education","lineage":["https://openalex.org/I28813325"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhaojun Gu","raw_affiliation_strings":["Information Security Evaluation Center of Civil Aviation, Civil Aviation University of China, Tianjin, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Information Security Evaluation Center of Civil Aviation, Civil Aviation University of China, Tianjin, China","institution_ids":["https://openalex.org/I28813325"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5103128952","display_name":"Dapeng Man","orcid":null},"institutions":[{"id":"https://openalex.org/I151727225","display_name":"Harbin Engineering University","ror":"https://ror.org/03x80pn82","country_code":"CN","type":"education","lineage":["https://openalex.org/I151727225"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Dapeng Man","raw_affiliation_strings":["Information Security Research Center, Harbin Engineering University, Heilongjiang Province, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Information Security Research Center, Harbin Engineering University, Heilongjiang Province, China","institution_ids":["https://openalex.org/I151727225"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5067423683","display_name":"Wu Yang","orcid":"https://orcid.org/0000-0001-5985-7648"},"institutions":[{"id":"https://openalex.org/I151727225","display_name":"Harbin Engineering University","ror":"https://ror.org/03x80pn82","country_code":"CN","type":"education","lineage":["https://openalex.org/I151727225"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Wu Yang","raw_affiliation_strings":["Information Security Research Center, Harbin Engineering University, Heilongjiang Province, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Information Security Research Center, Harbin Engineering University, Heilongjiang Province, China","institution_ids":["https://openalex.org/I151727225"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5060514022","display_name":"Xiaojiang Du","orcid":"https://orcid.org/0000-0003-4235-9671"},"institutions":[{"id":"https://openalex.org/I84392919","display_name":"Temple University","ror":"https://ror.org/00kx1jb78","country_code":"US","type":"education","lineage":["https://openalex.org/I84392919"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Xiaojiang Du","raw_affiliation_strings":["Temple University, Philadelphia, PA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Temple University, Philadelphia, PA, USA","institution_ids":["https://openalex.org/I84392919"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":6,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"6"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9957000017166138,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9957000017166138,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8635848760604858},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.8206430077552795},{"id":"https://openalex.org/keywords/hypervisor","display_name":"Hypervisor","score":0.6783296465873718},{"id":"https://openalex.org/keywords/virtual-machine","display_name":"Virtual machine","score":0.6693623065948486},{"id":"https://openalex.org/keywords/cloud-computing","display_name":"Cloud computing","score":0.6161221265792847},{"id":"https://openalex.org/keywords/adaboost","display_name":"AdaBoost","score":0.5615172386169434},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.4837043881416321},{"id":"https://openalex.org/keywords/virtualization","display_name":"Virtualization","score":0.4784924387931824},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.47559842467308044},{"id":"https://openalex.org/keywords/ensemble-learning","display_name":"Ensemble learning","score":0.46456706523895264},{"id":"https://openalex.org/keywords/feature-extraction","display_name":"Feature extraction","score":0.45624297857284546},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.4516621232032776},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.44952666759490967},{"id":"https://openalex.org/keywords/overhead","display_name":"Overhead (engineering)","score":0.43844565749168396},{"id":"https://openalex.org/keywords/scheme","display_name":"Scheme (mathematics)","score":0.43406063318252563},{"id":"https://openalex.org/keywords/classifier","display_name":"Classifier (UML)","score":0.4190219044685364},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.1948157548904419}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8635848760604858},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.8206430077552795},{"id":"https://openalex.org/C112904061","wikidata":"https://www.wikidata.org/wiki/Q1077480","display_name":"Hypervisor","level":4,"score":0.6783296465873718},{"id":"https://openalex.org/C25344961","wikidata":"https://www.wikidata.org/wiki/Q192726","display_name":"Virtual machine","level":2,"score":0.6693623065948486},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.6161221265792847},{"id":"https://openalex.org/C141404830","wikidata":"https://www.wikidata.org/wiki/Q2823869","display_name":"AdaBoost","level":3,"score":0.5615172386169434},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4837043881416321},{"id":"https://openalex.org/C513985346","wikidata":"https://www.wikidata.org/wiki/Q270471","display_name":"Virtualization","level":3,"score":0.4784924387931824},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.47559842467308044},{"id":"https://openalex.org/C45942800","wikidata":"https://www.wikidata.org/wiki/Q245652","display_name":"Ensemble learning","level":2,"score":0.46456706523895264},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.45624297857284546},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.4516621232032776},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.44952666759490967},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.43844565749168396},{"id":"https://openalex.org/C77618280","wikidata":"https://www.wikidata.org/wiki/Q1155772","display_name":"Scheme (mathematics)","level":2,"score":0.43406063318252563},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.4190219044685364},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.1948157548904419},{"id":"https://openalex.org/C41895202","wikidata":"https://www.wikidata.org/wiki/Q8162","display_name":"Linguistics","level":1,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0},{"id":"https://openalex.org/C134306372","wikidata":"https://www.wikidata.org/wiki/Q7754","display_name":"Mathematical analysis","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/glocom.2018.8648070","is_oa":false,"landing_page_url":"https://doi.org/10.1109/glocom.2018.8648070","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2018 IEEE Global Communications Conference (GLOBECOM)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":32,"referenced_works":["https://openalex.org/W140819463","https://openalex.org/W1510770928","https://openalex.org/W1641762327","https://openalex.org/W1752315353","https://openalex.org/W1831271947","https://openalex.org/W1966973702","https://openalex.org/W1982626035","https://openalex.org/W2010065958","https://openalex.org/W2019731328","https://openalex.org/W2048997531","https://openalex.org/W2065566278","https://openalex.org/W2080765376","https://openalex.org/W2087740020","https://openalex.org/W2135162105","https://openalex.org/W2138580357","https://openalex.org/W2140696652","https://openalex.org/W2162572433","https://openalex.org/W2170018742","https://openalex.org/W2216435223","https://openalex.org/W2267635142","https://openalex.org/W2401656370","https://openalex.org/W2508644642","https://openalex.org/W2521705161","https://openalex.org/W2521856610","https://openalex.org/W2586571469","https://openalex.org/W2623682848","https://openalex.org/W2792599578","https://openalex.org/W3170957724","https://openalex.org/W6605720282","https://openalex.org/W6637110787","https://openalex.org/W6637804175","https://openalex.org/W6680672307"],"related_works":["https://openalex.org/W2148749405","https://openalex.org/W2104105430","https://openalex.org/W1515917392","https://openalex.org/W2743348030","https://openalex.org/W2613320081","https://openalex.org/W1973516247","https://openalex.org/W2179519055","https://openalex.org/W1991063492","https://openalex.org/W2413559826","https://openalex.org/W4387237709"],"abstract_inverted_index":{"More":[0],"data":[1,91,106],"and":[2,36,114,129,138,173],"applications":[3],"are":[4],"moving":[5],"to":[6,23,31,41,71,134],"the":[7,19,77,82,90,117,136,142,177],"cloud,":[8],"which":[9],"presents":[10],"many":[11],"new":[12],"security":[13,178],"risks.":[14],"Malware":[15],"is":[16],"one":[17],"of":[18,119,132,141,152,164,179],"most":[20],"significant":[21],"threats":[22],"cloud":[24,180],"computing.":[25],"In":[26],"this":[27,65],"paper,":[28],"we":[29],"explore":[30],"employ":[32],"virtual":[33,47,79,170],"machine":[34,80],"introspection(VMI)":[35],"memory":[37],"forensics":[38],"analysis(MFA)":[39],"techniques":[40],"detect":[42],"malware":[43,54,121,154],"running":[44],"in":[45,61,76],"guest":[46,78],"machines.":[48],"Our":[49,85,166],"scheme":[50,86,158],"differs":[51],"from":[52],"existing":[53],"detection":[55,103,162],"methods":[56],"based":[57,148],"on":[58,149],"virtualization":[59],"technology":[60],"three":[62],"aspects.":[63],"First,":[64],"paper":[66],"combines":[67],"VMI":[68],"with":[69,95],"MFA":[70],"extract":[72],"multiple":[73,100,111],"type":[74,112],"features":[75],"at":[81],"same":[83],"time.":[84],"can":[87,159,168],"effectively":[88,115,175],"minimize":[89],"acquisition":[92,107],"overhead.":[93],"Second,compared":[94],"single":[96],"dynamic":[97,110],"feature":[98,102],"or":[99],"static":[101],"methods,":[104],"our":[105,157],"method":[108,128],"employs":[109],"features,":[113],"promotes":[116],"ability":[118,140],"sophisticated":[120],"detection.":[122],"Finally,we":[123],"use":[124],"AdaBoost":[125],"ensemble":[126],"learning":[127],"combination":[130],"strategy":[131],"voting":[133],"improve":[135,169],"accuracy":[137,163],"generalization":[139],"overall":[143],"classifier.":[144],"The":[145],"experimental":[146],"results":[147],"a":[150,161],"lot":[151],"real-world":[153],"show":[155],"that":[156],"achieve":[160],"0.9975.":[165],"approach":[167],"machines":[171],"security,":[172],"further":[174],"enhance":[176],"computing":[181],"environment.":[182]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2022,"cited_by_count":2},{"year":2021,"cited_by_count":1},{"year":2020,"cited_by_count":1},{"year":2019,"cited_by_count":1}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}