{"id":"https://openalex.org/W4416233759","doi":"https://doi.org/10.1109/issre66568.2025.00052","title":"MALPRE: Malware Protocol Reverse Engineering through Code Slicing and Agentic Workflow","display_name":"MALPRE: Malware Protocol Reverse Engineering through Code Slicing and Agentic Workflow","publication_year":2025,"publication_date":"2025-10-21","ids":{"openalex":"https://openalex.org/W4416233759","doi":"https://doi.org/10.1109/issre66568.2025.00052"},"language":null,"primary_location":{"id":"doi:10.1109/issre66568.2025.00052","is_oa":false,"landing_page_url":"https://doi.org/10.1109/issre66568.2025.00052","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE 36th International Symposium on Software Reliability Engineering (ISSRE)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5008998621","display_name":"Yuyao Huang","orcid":"https://orcid.org/0000-0002-1574-6644"},"institutions":[{"id":"https://openalex.org/I4210123940","display_name":"Ministry of Education","ror":"https://ror.org/02xv42m49","country_code":"PT","type":"government","lineage":["https://openalex.org/I4210117458","https://openalex.org/I4210123940"]}],"countries":["PT"],"is_corresponding":false,"raw_author_name":"Yuyao Huang","raw_affiliation_strings":["Key Laboratory of Cyberspace Security Ministry of Education,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Key Laboratory of Cyberspace Security Ministry of Education,China","institution_ids":["https://openalex.org/I4210123940"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5103088653","display_name":"Fei Kang","orcid":"https://orcid.org/0000-0003-2545-4079"},"institutions":[{"id":"https://openalex.org/I4210123940","display_name":"Ministry of Education","ror":"https://ror.org/02xv42m49","country_code":"PT","type":"government","lineage":["https://openalex.org/I4210117458","https://openalex.org/I4210123940"]}],"countries":["PT"],"is_corresponding":false,"raw_author_name":"Fei Kang","raw_affiliation_strings":["Key Laboratory of Cyberspace Security Ministry of Education,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Key Laboratory of Cyberspace Security Ministry of Education,China","institution_ids":["https://openalex.org/I4210123940"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5032332424","display_name":"Hui\u2010Kuo G. Shu","orcid":"https://orcid.org/0000-0002-4060-0874"},"institutions":[{"id":"https://openalex.org/I4210123940","display_name":"Ministry of Education","ror":"https://ror.org/02xv42m49","country_code":"PT","type":"government","lineage":["https://openalex.org/I4210117458","https://openalex.org/I4210123940"]}],"countries":["PT"],"is_corresponding":false,"raw_author_name":"Hui Shu","raw_affiliation_strings":["Key Laboratory of Cyberspace Security Ministry of Education,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Key Laboratory of Cyberspace Security Ministry of Education,China","institution_ids":["https://openalex.org/I4210123940"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5120700852","display_name":"Guoyu Huo","orcid":null},"institutions":[{"id":"https://openalex.org/I4210123940","display_name":"Ministry of Education","ror":"https://ror.org/02xv42m49","country_code":"PT","type":"government","lineage":["https://openalex.org/I4210117458","https://openalex.org/I4210123940"]}],"countries":["PT"],"is_corresponding":false,"raw_author_name":"Guoyu Huo","raw_affiliation_strings":["Key Laboratory of Cyberspace Security Ministry of Education,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Key Laboratory of Cyberspace Security Ministry of Education,China","institution_ids":["https://openalex.org/I4210123940"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I4210123940"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.41608209,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"452","last_page":"465"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9430999755859375,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9430999755859375,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.023800000548362732,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.012199999764561653,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/reverse-engineering","display_name":"Reverse engineering","score":0.7926999926567078},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.757099986076355},{"id":"https://openalex.org/keywords/protocol","display_name":"Protocol (science)","score":0.6621000170707703},{"id":"https://openalex.org/keywords/workflow","display_name":"Workflow","score":0.6503000259399414},{"id":"https://openalex.org/keywords/backdoor","display_name":"Backdoor","score":0.6136999726295471},{"id":"https://openalex.org/keywords/field","display_name":"Field (mathematics)","score":0.5266000032424927},{"id":"https://openalex.org/keywords/malware-analysis","display_name":"Malware analysis","score":0.5263000130653381},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.44110000133514404}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8471999764442444},{"id":"https://openalex.org/C207850805","wikidata":"https://www.wikidata.org/wiki/Q269608","display_name":"Reverse engineering","level":2,"score":0.7926999926567078},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.757099986076355},{"id":"https://openalex.org/C2780385302","wikidata":"https://www.wikidata.org/wiki/Q367158","display_name":"Protocol (science)","level":3,"score":0.6621000170707703},{"id":"https://openalex.org/C177212765","wikidata":"https://www.wikidata.org/wiki/Q627335","display_name":"Workflow","level":2,"score":0.6503000259399414},{"id":"https://openalex.org/C2781045450","wikidata":"https://www.wikidata.org/wiki/Q254569","display_name":"Backdoor","level":2,"score":0.6136999726295471},{"id":"https://openalex.org/C9652623","wikidata":"https://www.wikidata.org/wiki/Q190109","display_name":"Field (mathematics)","level":2,"score":0.5266000032424927},{"id":"https://openalex.org/C2779395397","wikidata":"https://www.wikidata.org/wiki/Q15731404","display_name":"Malware analysis","level":3,"score":0.5263000130653381},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.44110000133514404},{"id":"https://openalex.org/C12269588","wikidata":"https://www.wikidata.org/wiki/Q132364","display_name":"Communications protocol","level":2,"score":0.41440001130104065},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.37880000472068787},{"id":"https://openalex.org/C33884865","wikidata":"https://www.wikidata.org/wiki/Q1254335","display_name":"Cryptographic protocol","level":3,"score":0.37770000100135803},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.34769999980926514},{"id":"https://openalex.org/C40305131","wikidata":"https://www.wikidata.org/wiki/Q2616305","display_name":"Obfuscation","level":2,"score":0.3458999991416931},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.33959999680519104},{"id":"https://openalex.org/C84525096","wikidata":"https://www.wikidata.org/wiki/Q3506050","display_name":"Cryptovirology","level":3,"score":0.3375000059604645},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.2989000082015991},{"id":"https://openalex.org/C2776190703","wikidata":"https://www.wikidata.org/wiki/Q488148","display_name":"Slicing","level":2,"score":0.2953999936580658},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.26759999990463257},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.2662999927997589},{"id":"https://openalex.org/C91071405","wikidata":"https://www.wikidata.org/wiki/Q1413145","display_name":"Program slicing","level":3,"score":0.2531999945640564}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/issre66568.2025.00052","is_oa":false,"landing_page_url":"https://doi.org/10.1109/issre66568.2025.00052","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE 36th International Symposium on Software Reliability Engineering (ISSRE)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":20,"referenced_works":["https://openalex.org/W1553308705","https://openalex.org/W1778520842","https://openalex.org/W2049867480","https://openalex.org/W2140839850","https://openalex.org/W2156453323","https://openalex.org/W2901689459","https://openalex.org/W2926178846","https://openalex.org/W3133719257","https://openalex.org/W3217122106","https://openalex.org/W4236544382","https://openalex.org/W4284674325","https://openalex.org/W4324007064","https://openalex.org/W4388857869","https://openalex.org/W4391725269","https://openalex.org/W4391725314","https://openalex.org/W4400583100","https://openalex.org/W4402264058","https://openalex.org/W4402670856","https://openalex.org/W4405183032","https://openalex.org/W4405183127"],"related_works":[],"abstract_inverted_index":{"Clarifying":[0],"malware":[1,53,79,97],"communication":[2],"protocols":[3],"is":[4],"critical":[5],"for":[6,51],"enhancing":[7],"system":[8],"security.":[9],"Existing":[10],"protocol":[11,22,54,82],"reverse":[12],"engineering":[13],"(PRE)":[14],"methods":[15],"lack":[16],"effective":[17],"strategies,":[18],"failing":[19],"to":[20,66,85],"recover":[21],"structures":[23],"or":[24],"infer":[25,87],"precise":[26,43],"field":[27,88,120],"semantics.":[28,89],"To":[29],"address":[30],"these":[31],"challenges,":[32],"we":[33],"propose":[34],"MALPRE,":[35],"an":[36],"execution":[37],"trace-based":[38],"PRE":[39],"framework":[40],"that":[41,100],"integrates":[42],"program":[44],"analysis":[45],"with":[46,139],"large":[47],"language":[48],"models":[49],"(LLMs)":[50],"automated":[52],"format":[55],"recovery.":[56],"MALPRE":[57,101,129],"first":[58],"embeds":[59],"and":[60,81,111,123,136],"hierarchically":[61],"clusters":[62],"the":[63,92,103],"code":[64,77],"slices":[65],"restore":[67],"message":[68],"formats.":[69],"It":[70],"then":[71],"introduces":[72],"a":[73],"multi-agentic":[74],"workflow":[75],"comprising":[76],"analyst,":[78],"expert,":[80],"puzzler":[83],"roles":[84],"collaboratively":[86],"Evaluations":[90],"on":[91],"dataset":[93],"containing":[94],"six":[95],"popular":[96],"frameworks":[98],"demonstrate":[99],"outperforms":[102],"state-of-the-art":[104],"methods\u2014including":[105],"four":[106],"conventional":[107],"tools":[108],"(e.g.,":[109,115],"BINPRE)":[110],"three":[112],"LLM-based":[113],"approaches":[114],"DEGPT)\u2014by":[116],"23.8%":[117],"(F1)":[118],"in":[119,126],"structure":[121],"recovery":[122],"4.8%":[124],"(FSS-score)":[125],"semantic":[127],"inference.":[128],"has":[130],"successfully":[131],"analyzed":[132],"APT":[133],"backdoor":[134],"communications":[135],"emerging":[137],"botnets,":[138],"two":[140],"extracted":[141],"traffic":[142],"rules":[143],"assigned":[144],"by":[145],"Open":[146],"ET":[147],"Ruleset.":[148]},"counts_by_year":[],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-11-13T00:00:00"}