{"id":"https://openalex.org/W4407786363","doi":"https://doi.org/10.1109/snams64316.2024.10883810","title":"A Novel Reinforcement Learning Model for Post-Incident Malware Investigations","display_name":"A Novel Reinforcement Learning Model for Post-Incident Malware Investigations","publication_year":2024,"publication_date":"2024-12-09","ids":{"openalex":"https://openalex.org/W4407786363","doi":"https://doi.org/10.1109/snams64316.2024.10883810"},"language":"en","primary_location":{"id":"doi:10.1109/snams64316.2024.10883810","is_oa":false,"landing_page_url":"https://doi.org/10.1109/snams64316.2024.10883810","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2024 11th International Conference on Social Networks Analysis, Management and Security (SNAMS)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5025816613","display_name":"Dipo Dunsin","orcid":"https://orcid.org/0009-0009-7376-0477"},"institutions":[{"id":"https://openalex.org/I126193024","display_name":"London Metropolitan University","ror":"https://ror.org/00ae33288","country_code":"GB","type":"education","lineage":["https://openalex.org/I126193024"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Dipo Dunsin","raw_affiliation_strings":["London Metropolitan University,Cyber Security Research Centre,London,UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"London Metropolitan University,Cyber Security Research Centre,London,UK","institution_ids":["https://openalex.org/I126193024"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101549630","display_name":"Mohamed Chahine Ghanem","orcid":"https://orcid.org/0000-0002-7067-7848"},"institutions":[{"id":"https://openalex.org/I126193024","display_name":"London Metropolitan University","ror":"https://ror.org/00ae33288","country_code":"GB","type":"education","lineage":["https://openalex.org/I126193024"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Mohamed Chahine Ghanem","raw_affiliation_strings":["London Metropolitan University,Cyber Security Research Centre,London,UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"London Metropolitan University,Cyber Security Research Centre,London,UK","institution_ids":["https://openalex.org/I126193024"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5014413828","display_name":"Karim Ouazzane","orcid":"https://orcid.org/0000-0002-7129-5809"},"institutions":[{"id":"https://openalex.org/I126193024","display_name":"London Metropolitan University","ror":"https://ror.org/00ae33288","country_code":"GB","type":"education","lineage":["https://openalex.org/I126193024"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Karim Ouazzane","raw_affiliation_strings":["London Metropolitan University,Cyber Security Research Centre,London,UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"London Metropolitan University,Cyber Security Research Centre,London,UK","institution_ids":["https://openalex.org/I126193024"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5062364356","display_name":"Vassil Vassilev","orcid":"https://orcid.org/0000-0003-4361-4830"},"institutions":[{"id":"https://openalex.org/I126193024","display_name":"London Metropolitan University","ror":"https://ror.org/00ae33288","country_code":"GB","type":"education","lineage":["https://openalex.org/I126193024"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Vassil Vassilev","raw_affiliation_strings":["London Metropolitan University,Cyber Security Research Centre,London,UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"London Metropolitan University,Cyber Security Research Centre,London,UK","institution_ids":["https://openalex.org/I126193024"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I126193024"],"apc_list":null,"apc_paid":null,"fwci":0.8343,"has_fulltext":false,"cited_by_count":2,"citation_normalized_percentile":{"value":0.75475363,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":91,"max":97},"biblio":{"volume":null,"issue":null,"first_page":"33","last_page":"40"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9991999864578247,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9991999864578247,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9909999966621399,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9176999926567078,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.7671639919281006},{"id":"https://openalex.org/keywords/reinforcement-learning","display_name":"Reinforcement learning","score":0.7351725101470947},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7299890518188477},{"id":"https://openalex.org/keywords/reinforcement","display_name":"Reinforcement","score":0.44699326157569885},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.42851993441581726},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.31800925731658936},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.15373018383979797},{"id":"https://openalex.org/keywords/structural-engineering","display_name":"Structural engineering","score":0.0635107159614563}],"concepts":[{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.7671639919281006},{"id":"https://openalex.org/C97541855","wikidata":"https://www.wikidata.org/wiki/Q830687","display_name":"Reinforcement learning","level":2,"score":0.7351725101470947},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7299890518188477},{"id":"https://openalex.org/C67203356","wikidata":"https://www.wikidata.org/wiki/Q1321905","display_name":"Reinforcement","level":2,"score":0.44699326157569885},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.42851993441581726},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.31800925731658936},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.15373018383979797},{"id":"https://openalex.org/C66938386","wikidata":"https://www.wikidata.org/wiki/Q633538","display_name":"Structural engineering","level":1,"score":0.0635107159614563}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/snams64316.2024.10883810","is_oa":false,"landing_page_url":"https://doi.org/10.1109/snams64316.2024.10883810","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2024 11th International Conference on Social Networks Analysis, Management and Security (SNAMS)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16","score":0.4399999976158142}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":17,"referenced_works":["https://openalex.org/W2062324702","https://openalex.org/W2258555245","https://openalex.org/W2765921396","https://openalex.org/W2903774075","https://openalex.org/W2952298682","https://openalex.org/W2963777745","https://openalex.org/W3033021283","https://openalex.org/W3096737948","https://openalex.org/W4290996178","https://openalex.org/W4291474832","https://openalex.org/W4319586093","https://openalex.org/W4375853921","https://openalex.org/W4377969881","https://openalex.org/W4380761547","https://openalex.org/W4388676551","https://openalex.org/W4388722750","https://openalex.org/W4391241488"],"related_works":["https://openalex.org/W2097492617","https://openalex.org/W2753240997","https://openalex.org/W1764168690","https://openalex.org/W2537959205","https://openalex.org/W2740895074","https://openalex.org/W2772446090","https://openalex.org/W4284893819","https://openalex.org/W4310083477","https://openalex.org/W2328553770","https://openalex.org/W3152891574"],"abstract_inverted_index":{"This":[0],"Research":[1],"proposes":[2],"a":[3,74],"Novel":[4],"Reinforcement":[5],"Learning":[6],"(RL)":[7],"model":[8,70],"to":[9,20,33,52,56,100,130,145],"optimise":[10],"malware":[11,35,58,76,84,132,141],"forensics":[12],"investigation":[13,23],"during":[14],"cyber":[15],"incident":[16],"response.":[17],"It":[18],"aims":[19],"improve":[21],"forensic":[22,66,113],"efficiency":[24],"by":[25,108],"reducing":[26],"false":[27],"negatives":[28],"and":[29,46,88,118,158],"adapting":[30],"current":[31],"practices":[32],"evolving":[34],"signatures.":[36],"The":[37,68,134],"proposed":[38],"RL":[39,69,139,150],"System":[40],"leverages":[41],"techniques":[42,90],"such":[43],"as":[44,91,93],"Q-learning":[45],"the":[47,54,81,104,110,149,156,162],"Markov":[48],"Decision":[49],"Process":[50],"(MDP)":[51],"train":[53],"system":[55,107],"identify":[57],"patterns":[59],"in":[60,103,120],"live":[61],"memory":[62],"dumps,":[63],"thereby":[64],"automating":[65],"tasks.":[67],"is":[71],"based":[72],"on":[73,155],"detailed":[75],"workflow":[77],"diagram":[78],"that":[79,138],"guides":[80],"analysis":[82],"of":[83,112,161],"artefacts":[85],"using":[86,123],"static":[87],"behavioural":[89],"well":[92],"machine":[94],"learning":[95,159],"algorithms.":[96],"Furthermore,":[97],"it":[98],"seeks":[99],"address":[101],"challenges":[102],"UK":[105],"justice":[106],"ensuring":[109],"accuracy":[111],"evidence.":[114],"We":[115],"conduct":[116],"testing":[117],"evaluation":[119],"controlled":[121],"environments,":[122],"datasets":[124],"created":[125],"with":[126,148],"Windows":[127],"operating":[128],"systems":[129],"simulate":[131],"infections.":[133],"experimental":[135],"results":[136],"demonstrate":[137],"improves":[140],"detection":[142],"rates":[143],"compared":[144],"conventional":[146],"methods,":[147],"model's":[151],"performance":[152],"varying":[153],"depending":[154],"complexity":[157],"rate":[160],"environment.":[163]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":1}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}