{"id":"https://openalex.org/W2900984776","doi":"https://doi.org/10.1109/iscc.2018.8538691","title":"PSDEM: A Feasible De-Obfuscation Method for Malicious PowerShell Detection","display_name":"PSDEM: A Feasible De-Obfuscation Method for Malicious PowerShell Detection","publication_year":2018,"publication_date":"2018-06-01","ids":{"openalex":"https://openalex.org/W2900984776","doi":"https://doi.org/10.1109/iscc.2018.8538691","mag":"2900984776"},"language":"en","primary_location":{"id":"doi:10.1109/iscc.2018.8538691","is_oa":false,"landing_page_url":"https://doi.org/10.1109/iscc.2018.8538691","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2018 IEEE Symposium on Computers and Communications (ISCC)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5013632030","display_name":"Chao Liu","orcid":"https://orcid.org/0000-0001-6473-2292"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Chao Liu","raw_affiliation_strings":["Chinese Academy of Sciences, Institute of Information Engineering, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Chinese Academy of Sciences, Institute of Information Engineering, Beijing, China","institution_ids":["https://openalex.org/I4210156404","https://openalex.org/I19820366"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5057056828","display_name":"Bin Xia","orcid":"https://orcid.org/0000-0001-9519-6517"},"institutions":[{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Bin Xia","raw_affiliation_strings":["School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210165038"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5081445180","display_name":"Min Yu","orcid":"https://orcid.org/0000-0003-4371-7864"},"institutions":[{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Min Yu","raw_affiliation_strings":["School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210165038"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5071363229","display_name":"Yunzheng Liu","orcid":null},"institutions":[{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yunzheng Liu","raw_affiliation_strings":["School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210165038"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":17,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"00825","last_page":"00831"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11800","display_name":"User Authentication and Security Systems","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/obfuscation","display_name":"Obfuscation","score":0.9314874410629272},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8518329858779907},{"id":"https://openalex.org/keywords/scripting-language","display_name":"Scripting language","score":0.8024665117263794},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.7623268365859985},{"id":"https://openalex.org/keywords/word","display_name":"Word (group theory)","score":0.4569029211997986},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.4253324866294861},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.36355510354042053},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.29908061027526855}],"concepts":[{"id":"https://openalex.org/C40305131","wikidata":"https://www.wikidata.org/wiki/Q2616305","display_name":"Obfuscation","level":2,"score":0.9314874410629272},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8518329858779907},{"id":"https://openalex.org/C61423126","wikidata":"https://www.wikidata.org/wiki/Q187432","display_name":"Scripting language","level":2,"score":0.8024665117263794},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.7623268365859985},{"id":"https://openalex.org/C90805587","wikidata":"https://www.wikidata.org/wiki/Q10944557","display_name":"Word (group theory)","level":2,"score":0.4569029211997986},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.4253324866294861},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.36355510354042053},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.29908061027526855},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.0},{"id":"https://openalex.org/C41895202","wikidata":"https://www.wikidata.org/wiki/Q8162","display_name":"Linguistics","level":1,"score":0.0},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/iscc.2018.8538691","is_oa":false,"landing_page_url":"https://doi.org/10.1109/iscc.2018.8538691","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2018 IEEE Symposium on Computers and Communications (ISCC)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.800000011920929,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":9,"referenced_works":["https://openalex.org/W102746433","https://openalex.org/W1972531058","https://openalex.org/W2035294644","https://openalex.org/W2081293472","https://openalex.org/W2082190528","https://openalex.org/W2557716486","https://openalex.org/W2743459917","https://openalex.org/W2755537837","https://openalex.org/W6604159213"],"related_works":["https://openalex.org/W2620652965","https://openalex.org/W2024170198","https://openalex.org/W4296272594","https://openalex.org/W2900526031","https://openalex.org/W2128507946","https://openalex.org/W2728713145","https://openalex.org/W2131332603","https://openalex.org/W2470502009","https://openalex.org/W2072617132","https://openalex.org/W4360993664"],"abstract_inverted_index":{"PowerShell":[0,14,23,49,87,98,103,134,179],"is":[1,70,101,112],"so":[2,71],"extremely":[3],"powerful":[4],"that":[5,9,73,163],"we":[6,81,124],"have":[7],"seen":[8],"attackers":[10],"are":[11,50],"increasingly":[12],"using":[13,29],"in":[15,136,181,190],"their":[16],"attack":[17],"methods":[18,66],"lately.":[19],"In":[20,78],"most":[21],"cases,":[22],"malware":[24],"arrives":[25],"via":[26],"spam":[27],"email,":[28],"a":[30,83,166,188],"combination":[31],"of":[32,48,61,86,146,152,157],"Microsoft":[33],"Word":[34,137,182],"documents":[35,138],"to":[36,95,197],"infect":[37],"victims":[38],"with":[39],"its":[40],"deadly":[41],"payload.":[42],"Nowadays,":[43],"the":[44,54,59,76,144,147,150,155,171],"de-obfuscation":[45,84,94,128,153],"and":[46,64,119,129,154,159,173],"analysis":[47,130,193],"still":[51],"based":[52,139],"on":[53,140],"manual":[55],"analysis.":[56],"However,":[57],"as":[58,184,186],"number":[60],"malicious":[62,133,178],"samples":[63],"obfuscation":[65],"growing":[67],"quickly,":[68],"it":[69,164],"slow":[72],"can't":[74],"satisfy":[75],"demand.":[77],"this":[79],"paper,":[80],"propose":[82],"method":[85],"called":[88],"PSDEM":[89,169],"which":[90,191],"has":[91,165],"two":[92],"layers":[93],"get":[96,198],"original":[97],"scripts.":[99],"One":[100],"extracting":[102],"scripts":[104,114,135],"from":[105,149],"much":[106],"obfuscated":[107],"document":[108],"code.":[109],"The":[110],"other":[111],"de-obfuscating":[113],"including":[115],"encoding,":[116],"strings":[117],"manipulation":[118],"code":[120],"logic":[121],"obfuscation.":[122],"Meanwhile,":[123],"design":[125],"an":[126],"automatic":[127],"tool":[131,148],"for":[132,176,194],"PSDEM.":[141],"We":[142],"test":[143],"performance":[145],"accuracy":[151,174],"efficiency":[156,172],"time,":[158],"evaluation":[160],"results":[161],"show":[162],"satisfactory":[167],"performance.":[168],"improves":[170],"rate":[175],"analyzing":[177],"Scripts":[180],"documents,":[183],"well":[185],"provides":[187],"path":[189],"further":[192],"security":[195],"experts":[196],"more":[199],"information":[200],"about":[201],"attacks.":[202]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2024,"cited_by_count":2},{"year":2023,"cited_by_count":5},{"year":2022,"cited_by_count":6},{"year":2021,"cited_by_count":1},{"year":2020,"cited_by_count":2}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}