{"id":"https://openalex.org/W3110824252","doi":"https://doi.org/10.1109/sp46214.2022.9833659","title":"Transcending TRANSCEND: Revisiting Malware Classification in the Presence of Concept Drift","display_name":"Transcending TRANSCEND: Revisiting Malware Classification in the Presence of Concept Drift","publication_year":2022,"publication_date":"2022-05-01","ids":{"openalex":"https://openalex.org/W3110824252","doi":"https://doi.org/10.1109/sp46214.2022.9833659","mag":"3110824252"},"language":"en","primary_location":{"id":"doi:10.1109/sp46214.2022.9833659","is_oa":false,"landing_page_url":"https://doi.org/10.1109/sp46214.2022.9833659","pdf_url":null,"source":{"id":"https://openalex.org/S4363606603","display_name":"2022 IEEE Symposium on Security and Privacy (SP)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2022 IEEE Symposium on Security and Privacy (SP)","raw_type":"proceedings-article"},"type":"preprint","indexed_in":["arxiv","crossref","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2010.03856","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5104314513","display_name":"Federico Barbero","orcid":null},"institutions":[{"id":"https://openalex.org/I183935753","display_name":"King's College London","ror":"https://ror.org/0220mzb33","country_code":"GB","type":"education","lineage":["https://openalex.org/I124357947","https://openalex.org/I183935753"]}],"countries":["GB"],"is_corresponding":true,"raw_author_name":"Federico Barbero","raw_affiliation_strings":["King’s College London"],"affiliations":[{"raw_affiliation_string":"King’s College London","institution_ids":["https://openalex.org/I183935753"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5090260871","display_name":"Feargus Pendlebury","orcid":"https://orcid.org/0000-0003-1140-322X"},"institutions":[{"id":"https://openalex.org/I183935753","display_name":"King's College London","ror":"https://ror.org/0220mzb33","country_code":"GB","type":"education","lineage":["https://openalex.org/I124357947","https://openalex.org/I183935753"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Feargus Pendlebury","raw_affiliation_strings":["King’s College London"],"affiliations":[{"raw_affiliation_string":"King’s College London","institution_ids":["https://openalex.org/I183935753"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5072597369","display_name":"Fabio Pierazzi","orcid":"https://orcid.org/0000-0002-1254-1758"},"institutions":[{"id":"https://openalex.org/I183935753","display_name":"King's College London","ror":"https://ror.org/0220mzb33","country_code":"GB","type":"education","lineage":["https://openalex.org/I124357947","https://openalex.org/I183935753"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Fabio Pierazzi","raw_affiliation_strings":["King’s College London"],"affiliations":[{"raw_affiliation_string":"King’s College London","institution_ids":["https://openalex.org/I183935753"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5036908366","display_name":"Lorenzo Cavallaro","orcid":"https://orcid.org/0000-0002-3878-2680"},"institutions":[{"id":"https://openalex.org/I45129253","display_name":"University College London","ror":"https://ror.org/02jx3x895","country_code":"GB","type":"education","lineage":["https://openalex.org/I124357947","https://openalex.org/I45129253"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Lorenzo Cavallaro","raw_affiliation_strings":["University College London"],"affiliations":[{"raw_affiliation_string":"University College London","institution_ids":["https://openalex.org/I45129253"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5104314513"],"corresponding_institution_ids":["https://openalex.org/I183935753"],"apc_list":null,"apc_paid":null,"fwci":0.4885,"has_fulltext":true,"cited_by_count":5,"citation_normalized_percentile":{"value":0.55793451,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":96},"biblio":{"volume":null,"issue":null,"first_page":"805","last_page":"823"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12761","display_name":"Data Stream Mining Techniques","score":0.9977999925613403,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9951000213623047,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.8323240280151367},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6914688348770142},{"id":"https://openalex.org/keywords/concept-drift","display_name":"Concept drift","score":0.6091954708099365},{"id":"https://openalex.org/keywords/overhead","display_name":"Overhead (engineering)","score":0.5832573771476746},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.5625989437103271},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.5333815813064575},{"id":"https://openalex.org/keywords/software-deployment","display_name":"Software deployment","score":0.4951430857181549},{"id":"https://openalex.org/keywords/conformal-map","display_name":"Conformal map","score":0.4903995990753174},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.47453272342681885},{"id":"https://openalex.org/keywords/malware-analysis","display_name":"Malware analysis","score":0.43633633852005005},{"id":"https://openalex.org/keywords/phenomenon","display_name":"Phenomenon","score":0.43178844451904297},{"id":"https://openalex.org/keywords/data-science","display_name":"Data science","score":0.35232454538345337},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.20515045523643494},{"id":"https://openalex.org/keywords/epistemology","display_name":"Epistemology","score":0.19171693921089172},{"id":"https://openalex.org/keywords/software-engineering","display_name":"Software engineering","score":0.17358872294425964},{"id":"https://openalex.org/keywords/mathematics","display_name":"Mathematics","score":0.11701488494873047}],"concepts":[{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.8323240280151367},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6914688348770142},{"id":"https://openalex.org/C60777511","wikidata":"https://www.wikidata.org/wiki/Q3045002","display_name":"Concept drift","level":3,"score":0.6091954708099365},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.5832573771476746},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.5625989437103271},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5333815813064575},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.4951430857181549},{"id":"https://openalex.org/C98214594","wikidata":"https://www.wikidata.org/wiki/Q850275","display_name":"Conformal map","level":2,"score":0.4903995990753174},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.47453272342681885},{"id":"https://openalex.org/C2779395397","wikidata":"https://www.wikidata.org/wiki/Q15731404","display_name":"Malware analysis","level":3,"score":0.43633633852005005},{"id":"https://openalex.org/C50335755","wikidata":"https://www.wikidata.org/wiki/Q483247","display_name":"Phenomenon","level":2,"score":0.43178844451904297},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.35232454538345337},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.20515045523643494},{"id":"https://openalex.org/C111472728","wikidata":"https://www.wikidata.org/wiki/Q9471","display_name":"Epistemology","level":1,"score":0.19171693921089172},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.17358872294425964},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.11701488494873047},{"id":"https://openalex.org/C134306372","wikidata":"https://www.wikidata.org/wiki/Q7754","display_name":"Mathematical analysis","level":1,"score":0.0},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C89198739","wikidata":"https://www.wikidata.org/wiki/Q3079880","display_name":"Data stream mining","level":2,"score":0.0}],"mesh":[],"locations_count":5,"locations":[{"id":"doi:10.1109/sp46214.2022.9833659","is_oa":false,"landing_page_url":"https://doi.org/10.1109/sp46214.2022.9833659","pdf_url":null,"source":{"id":"https://openalex.org/S4363606603","display_name":"2022 IEEE Symposium on Security and Privacy (SP)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2022 IEEE Symposium on Security and Privacy (SP)","raw_type":"proceedings-article"},{"id":"pmh:oai:arXiv.org:2010.03856","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2010.03856","pdf_url":"https://arxiv.org/pdf/2010.03856","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"mag:3110824252","is_oa":true,"landing_page_url":"http://export.arxiv.org/pdf/2010.03856","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"arXiv (Cornell University)","raw_type":null},{"id":"pmh:oai:eprints.ucl.ac.uk.OAI2:10142926","is_oa":false,"landing_page_url":"https://discovery.ucl.ac.uk/id/eprint/10142926/","pdf_url":null,"source":{"id":"https://openalex.org/S4306400024","display_name":"UCL Discovery (University College London)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I45129253","host_organization_name":"University College London","host_organization_lineage":["https://openalex.org/I45129253"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"     In:  2022 IEEE Symposium on Security and Privacy (SP).    IEEE: San Francisco, CA, USA. (2022)     ","raw_type":"Proceedings paper"},{"id":"doi:10.48550/arxiv.2010.03856","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2010.03856","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"article"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2010.03856","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2010.03856","pdf_url":"https://arxiv.org/pdf/2010.03856","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G8111947878","display_name":null,"funder_award_id":"1811441","funder_id":"https://openalex.org/F4320334627","funder_display_name":"Engineering and Physical Sciences Research Council"}],"funders":[{"id":"https://openalex.org/F4320334627","display_name":"Engineering and Physical Sciences Research Council","ror":"https://ror.org/0439y7842"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W3110824252.pdf","grobid_xml":"https://content.openalex.org/works/W3110824252.grobid-xml"},"referenced_works_count":63,"referenced_works":["https://openalex.org/W58852127","https://openalex.org/W258019806","https://openalex.org/W1521746852","https://openalex.org/W1553101044","https://openalex.org/W1647869403","https://openalex.org/W1663973292","https://openalex.org/W1678356000","https://openalex.org/W1965555277","https://openalex.org/W1982773740","https://openalex.org/W2000159976","https://openalex.org/W2028138594","https://openalex.org/W2090212887","https://openalex.org/W2097998348","https://openalex.org/W2101234009","https://openalex.org/W2110048843","https://openalex.org/W2122672392","https://openalex.org/W2123519624","https://openalex.org/W2161813894","https://openalex.org/W2166693382","https://openalex.org/W2168508162","https://openalex.org/W2171585602","https://openalex.org/W2401293755","https://openalex.org/W2407313496","https://openalex.org/W2464629196","https://openalex.org/W2487124337","https://openalex.org/W2603160474","https://openalex.org/W2618530766","https://openalex.org/W2621187857","https://openalex.org/W2753594008","https://openalex.org/W2773446523","https://openalex.org/W2784452215","https://openalex.org/W2809565305","https://openalex.org/W2889326796","https://openalex.org/W2963208797","https://openalex.org/W2964153729","https://openalex.org/W2964294337","https://openalex.org/W2964636835","https://openalex.org/W2965657710","https://openalex.org/W2969244304","https://openalex.org/W2984951742","https://openalex.org/W3015481738","https://openalex.org/W3022151098","https://openalex.org/W3092978542","https://openalex.org/W3097730806","https://openalex.org/W3204639595","https://openalex.org/W3208097639","https://openalex.org/W4242210993","https://openalex.org/W4247200422","https://openalex.org/W6602413418","https://openalex.org/W6637162671","https://openalex.org/W6674385629","https://openalex.org/W6684105480","https://openalex.org/W6684716366","https://openalex.org/W6685112792","https://openalex.org/W6713000815","https://openalex.org/W6727763167","https://openalex.org/W6743618022","https://openalex.org/W6748325151","https://openalex.org/W6750318962","https://openalex.org/W6753153400","https://openalex.org/W6754106995","https://openalex.org/W6760203611","https://openalex.org/W6794006112"],"related_works":["https://openalex.org/W3091821686","https://openalex.org/W1522400049","https://openalex.org/W3169100231","https://openalex.org/W2186018900","https://openalex.org/W3035584216","https://openalex.org/W2990296674","https://openalex.org/W33980390","https://openalex.org/W278246337","https://openalex.org/W3121294630","https://openalex.org/W1968607146","https://openalex.org/W2105283111","https://openalex.org/W2965913262","https://openalex.org/W2981672041","https://openalex.org/W2905311601","https://openalex.org/W2993208870","https://openalex.org/W3039230418","https://openalex.org/W3102497351","https://openalex.org/W2187909223","https://openalex.org/W3120684388","https://openalex.org/W3204728906"],"abstract_inverted_index":{"Machine":[0],"learning":[1,202],"for":[2,120,188,220],"malware":[3,16,33,152,176],"classification":[4,55],"shows":[5],"encouraging":[6],"results,":[7],"but":[8],"real":[9],"deployments":[10],"suffer":[11],"from":[12],"performance":[13,137],"degradation":[14],"as":[15,27,31,230],"authors":[17],"adapt":[18],"their":[19],"techniques":[20],"to":[21,49,64,104,199,233],"evade":[22],"detection.":[23],"This":[24],"phenomenon,":[25],"known":[26],"concept":[28,52],"drift,":[29],"occurs":[30],"new":[32,210],"examples":[34,60],"evolve":[35],"and":[36,39,178,192,209,217],"become":[37],"less":[38,40],"like":[41],"the":[42,117,124,136,139,144,165,221,235,241],"original":[43,140,166],"training":[44],"examples.":[45],"One":[46],"promising":[47],"method":[48],"cope":[50],"with":[51,56],"drift":[53],"is":[54],"rejection":[57,79,238],"in":[58,164],"which":[59],"that":[61,132,157],"are":[62,67],"likely":[63],"be":[65,73,197],"misclassified":[66],"instead":[68],"quarantined":[69],"until":[70],"they":[71],"can":[72,196],"expertly":[74],"analyzed.We":[75],"propose":[76],"TRANSCENDENT,":[77],"a":[78,84,97,113,151,189,215],"framework":[80],"built":[81],"on":[82,89,150],"Transcend,":[83,101],"recently":[85],"proposed":[86],"strategy":[87],"based":[88],"conformal":[90,106,130],"prediction":[91],"theory.":[92],"In":[93,123],"particular,":[94],"we":[95,126,183,227],"provide":[96],"formal":[98],"treatment":[99],"of":[100,116,138,160,237],"enabling":[102],"us":[103],"refine":[105],"evaluation":[107],"theory\u2014its":[108],"underlying":[109],"statistical":[110],"engine\u2014and":[111],"gain":[112],"better":[114],"understanding":[115],"theoretical":[118],"reasons":[119],"its":[121],"effectiveness.":[122],"process,":[125],"develop":[127],"two":[128],"additional":[129],"evaluators":[131],"match":[133],"or":[134],"surpass":[135],"while":[141,172],"significantly":[142],"decreasing":[143],"computational":[145],"overhead.":[146],"We":[147],"evaluate":[148],"TRANSCENDENT":[149,168,190,229],"dataset":[153],"spanning":[154],"5":[155],"years":[156],"removes":[158],"sources":[159],"experimental":[161],"bias":[162],"present":[163],"evaluation.":[167],"outperforms":[169],"state-of-the-art":[170],"approaches":[171],"generalizing":[173],"across":[174],"different":[175],"domains":[177],"classifiers.To":[179],"further":[180],"assist":[181],"practitioners,":[182],"showcase":[184],"optimal":[185],"operational":[186],"settings":[187],"deployment":[191],"show":[193],"how":[194],"it":[195],"applied":[198],"many":[200],"popular":[201],"algorithms.":[203],"These":[204],"insights":[205],"support":[206],"both":[207],"old":[208],"empirical":[211],"findings,":[212],"making":[213],"Transcend":[214],"sound":[216],"practical":[218],"solution":[219],"first":[222],"time.":[223],"To":[224],"this":[225],"end,":[226],"release":[228],"open":[231],"source,":[232],"aid":[234],"adoption":[236],"strategies":[239],"by":[240],"security":[242],"community.":[243]},"counts_by_year":[{"year":2025,"cited_by_count":2},{"year":2024,"cited_by_count":1},{"year":2023,"cited_by_count":1},{"year":2021,"cited_by_count":1}],"updated_date":"2026-03-20T23:20:44.827607","created_date":"2025-10-10T00:00:00"}