{"id":"https://openalex.org/W4402402642","doi":"https://doi.org/10.1109/mapr63514.2024.10660853","title":"A multimodal Windows malware detection method based on hybrid analysis and graph representations","display_name":"A multimodal Windows malware detection method based on hybrid analysis and graph representations","publication_year":2024,"publication_date":"2024-08-15","ids":{"openalex":"https://openalex.org/W4402402642","doi":"https://doi.org/10.1109/mapr63514.2024.10660853"},"language":"en","primary_location":{"id":"doi:10.1109/mapr63514.2024.10660853","is_oa":false,"landing_page_url":"https://doi.org/10.1109/mapr63514.2024.10660853","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2024 International Conference on Multimedia Analysis and Pattern Recognition (MAPR)","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5109533254","display_name":"Panfeng Bao","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Pham Thai Bao","raw_affiliation_strings":["University of Information Technology,Information Security Laboratory,Ho Chi Minh City,Vietnam"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Information Technology,Information Security Laboratory,Ho Chi Minh City,Vietnam","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5051168927","display_name":"Do Thi Thu Hien","orcid":"https://orcid.org/0000-0001-9387-7909"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Do Thi Thu Hien","raw_affiliation_strings":["University of Information Technology,Information Security Laboratory,Ho Chi Minh City,Vietnam"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Information Technology,Information Security Laboratory,Ho Chi Minh City,Vietnam","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5028377642","display_name":"Nguyen Tan Cam","orcid":"https://orcid.org/0000-0002-3909-7650"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Nguyen Tan Cam","raw_affiliation_strings":["University of Information Technology,Information Security Laboratory,Ho Chi Minh City,Vietnam"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Information Technology,Information Security Laboratory,Ho Chi Minh City,Vietnam","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5045030863","display_name":"Van-Hau Pham","orcid":"https://orcid.org/0000-0003-3147-3356"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Van-Hau Pham","raw_affiliation_strings":["University of Information Technology,Information Security Laboratory,Ho Chi Minh City,Vietnam"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Information Technology,Information Security Laboratory,Ho Chi Minh City,Vietnam","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.6114,"has_fulltext":false,"cited_by_count":2,"citation_normalized_percentile":{"value":0.65493667,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":95,"max":96},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"6"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9994000196456909,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9922999739646912,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.7642903327941895},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7372528910636902},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.4499628245830536},{"id":"https://openalex.org/keywords/malware-analysis","display_name":"Malware analysis","score":0.44409477710723877},{"id":"https://openalex.org/keywords/graph-theory","display_name":"Graph theory","score":0.4322052299976349},{"id":"https://openalex.org/keywords/power-graph-analysis","display_name":"Power graph analysis","score":0.41910943388938904},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.39488235116004944},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.3824179768562317},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.23561349511146545},{"id":"https://openalex.org/keywords/mathematics","display_name":"Mathematics","score":0.1362522840499878},{"id":"https://openalex.org/keywords/combinatorics","display_name":"Combinatorics","score":0.08545103669166565}],"concepts":[{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.7642903327941895},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7372528910636902},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.4499628245830536},{"id":"https://openalex.org/C2779395397","wikidata":"https://www.wikidata.org/wiki/Q15731404","display_name":"Malware analysis","level":3,"score":0.44409477710723877},{"id":"https://openalex.org/C88230418","wikidata":"https://www.wikidata.org/wiki/Q131476","display_name":"Graph theory","level":2,"score":0.4322052299976349},{"id":"https://openalex.org/C106937863","wikidata":"https://www.wikidata.org/wiki/Q7236518","display_name":"Power graph analysis","level":3,"score":0.41910943388938904},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.39488235116004944},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3824179768562317},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.23561349511146545},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.1362522840499878},{"id":"https://openalex.org/C114614502","wikidata":"https://www.wikidata.org/wiki/Q76592","display_name":"Combinatorics","level":1,"score":0.08545103669166565}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/mapr63514.2024.10660853","is_oa":false,"landing_page_url":"https://doi.org/10.1109/mapr63514.2024.10660853","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2024 International Conference on Multimedia Analysis and Pattern Recognition (MAPR)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":20,"referenced_works":["https://openalex.org/W2534043454","https://openalex.org/W2788864200","https://openalex.org/W2922344003","https://openalex.org/W2969904462","https://openalex.org/W2970641574","https://openalex.org/W2981292756","https://openalex.org/W3010506371","https://openalex.org/W3025067198","https://openalex.org/W3097208766","https://openalex.org/W3201570226","https://openalex.org/W4205554970","https://openalex.org/W4226427748","https://openalex.org/W4235796753","https://openalex.org/W4292230971","https://openalex.org/W4300687693","https://openalex.org/W4398183551","https://openalex.org/W6748641434","https://openalex.org/W6750318962","https://openalex.org/W6786854854","https://openalex.org/W6797869118"],"related_works":["https://openalex.org/W2469507153","https://openalex.org/W2008790809","https://openalex.org/W2768892939","https://openalex.org/W3164408430","https://openalex.org/W4285507391","https://openalex.org/W2397240470","https://openalex.org/W2602767565","https://openalex.org/W170652726","https://openalex.org/W2883822334","https://openalex.org/W2134874482"],"abstract_inverted_index":{"When":[0],"Windows":[1,61,128],"becomes":[2],"the":[3,33,39,51,105,108,144,149,166,174,179,207],"most":[4,34],"widely":[5],"used":[6],"operating":[7],"system":[8],"compared":[9],"to":[10,46,54,58,99,156,170,187],"its":[11],"counterparts,":[12],"there":[13],"is":[14,30,44],"a":[15,94,124,139,158],"rising":[16],"number":[17],"of":[18,32,41,96,107,135,151,209,215],"attacks":[19],"targeting":[20],"this":[21,120],"system,":[22,52],"in":[23,77,119,203,217],"which":[24],"malicious":[25],"executable":[26,42],"files":[27,43,202],"or":[28,69,91],"malware":[29,62,113,129,189,219],"one":[31],"prevalent":[35],"threats.":[36],"Hence,":[37],"verifying":[38],"maliciousness":[40],"essential":[45],"prevent":[47],"harmful":[48],"impacts":[49],"on":[50,132,198],"leading":[53],"numerous":[55],"research":[56],"efforts":[57],"propose":[59],"novel":[60],"detection":[63,130],"methods.":[64],"Although":[65],"machine":[66],"learning":[67,71],"(ML)":[68],"deep":[70],"(DL)":[72],"has":[73],"offered":[74],"promising":[75],"results":[76],"detecting":[78],"malware,":[79],"existing":[80],"works":[81],"still":[82],"have":[83],"limitations,":[84],"such":[85],"as":[86],"using":[87],"static":[88,152],"analysis":[89,141,168],"methods":[90],"only":[92],"leveraging":[93],"piece":[95],"specific":[97],"information":[98,136,147],"recognize":[100],"maliciousness.":[101],"This":[102],"may":[103,192],"reduce":[104],"effectiveness":[106,208],"detector":[109],"while":[110],"dealing":[111],"with":[112,178,212],"that":[114,181,191],"uses":[115],"evasion":[116],"techniques.":[117],"Therefore,":[118],"paper,":[121],"we":[122,154],"present":[123],"multimodal":[125],"approach":[126],"for":[127],"based":[131],"various":[133],"pieces":[134],"extracted":[137],"by":[138],"hybrid":[140],"process.":[142],"While":[143],"PE":[145,201],"header":[146],"plays":[148],"role":[150],"features,":[153],"aim":[155],"extract":[157],"dynamic":[159,167],"control":[160],"flow":[161],"graph":[162],"(CFG).":[163],"We":[164],"utilize":[165],"method":[169],"create":[171],"CFG,":[172],"through":[173],"symbolic":[175],"execution":[176],"approach,":[177],"intent":[180],"our":[182,210],"work":[183],"can":[184],"be":[185],"applied":[186],"certain":[188],"environments":[190],"undergo":[193],"code":[194],"obfuscation.":[195],"The":[196],"experiments":[197],"approximately":[199],"24,000":[200],"multiple":[204],"datasets":[205],"prove":[206],"work,":[211],"an":[213],"accuracy":[214],"99.25%":[216],"distinguishing":[218],"and":[220],"benign":[221],"files.":[222]},"counts_by_year":[{"year":2025,"cited_by_count":2}],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2025-10-10T00:00:00"}