{"id":"https://openalex.org/W4288057801","doi":"https://doi.org/10.1109/sp46214.2022.9833765","title":"SYMBEXCEL: Automated Analysis and Understanding of Malicious Excel 4.0 Macros","display_name":"SYMBEXCEL: Automated Analysis and Understanding of Malicious Excel 4.0 Macros","publication_year":2022,"publication_date":"2022-05-01","ids":{"openalex":"https://openalex.org/W4288057801","doi":"https://doi.org/10.1109/sp46214.2022.9833765"},"language":"en","primary_location":{"id":"doi:10.1109/sp46214.2022.9833765","is_oa":false,"landing_page_url":"https://doi.org/10.1109/sp46214.2022.9833765","pdf_url":null,"source":{"id":"https://openalex.org/S4363606603","display_name":"2022 IEEE Symposium on Security and Privacy (SP)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2022 IEEE Symposium on Security and Privacy (SP)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5013830566","display_name":"Nicola Ruaro","orcid":"https://orcid.org/0000-0003-4275-0224"},"institutions":[{"id":"https://openalex.org/I154570441","display_name":"University of California, Santa Barbara","ror":"https://ror.org/02t274463","country_code":"US","type":"education","lineage":["https://openalex.org/I154570441"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Nicola Ruaro","raw_affiliation_strings":["University of California,Santa Barbara","University of California, Santa Barbara"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of California,Santa Barbara","institution_ids":["https://openalex.org/I154570441"]},{"raw_affiliation_string":"University of California, Santa Barbara","institution_ids":["https://openalex.org/I154570441"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5058787341","display_name":"Fabio Pagani","orcid":"https://orcid.org/0000-0002-4357-9804"},"institutions":[{"id":"https://openalex.org/I154570441","display_name":"University of California, Santa Barbara","ror":"https://ror.org/02t274463","country_code":"US","type":"education","lineage":["https://openalex.org/I154570441"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Fabio Pagani","raw_affiliation_strings":["University of California,Santa Barbara","University of California, Santa Barbara"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of California,Santa Barbara","institution_ids":["https://openalex.org/I154570441"]},{"raw_affiliation_string":"University of California, Santa Barbara","institution_ids":["https://openalex.org/I154570441"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5045644624","display_name":"Stefano Ortolani","orcid":"https://orcid.org/0009-0003-5857-5755"},"institutions":[{"id":"https://openalex.org/I74786994","display_name":"Kitware (United States)","ror":"https://ror.org/02s2acn37","country_code":"US","type":"company","lineage":["https://openalex.org/I74786994"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Stefano Ortolani","raw_affiliation_strings":["VMware"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"VMware","institution_ids":["https://openalex.org/I74786994"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5022177364","display_name":"Christopher Kruegel","orcid":"https://orcid.org/0000-0001-5140-3414"},"institutions":[{"id":"https://openalex.org/I154570441","display_name":"University of California, Santa Barbara","ror":"https://ror.org/02t274463","country_code":"US","type":"education","lineage":["https://openalex.org/I154570441"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Christopher Kruegel","raw_affiliation_strings":["University of California,Santa Barbara","University of California, Santa Barbara"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of California,Santa Barbara","institution_ids":["https://openalex.org/I154570441"]},{"raw_affiliation_string":"University of California, Santa Barbara","institution_ids":["https://openalex.org/I154570441"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5075685499","display_name":"Giovanni Vigna","orcid":"https://orcid.org/0000-0002-3422-5369"},"institutions":[{"id":"https://openalex.org/I154570441","display_name":"University of California, Santa Barbara","ror":"https://ror.org/02t274463","country_code":"US","type":"education","lineage":["https://openalex.org/I154570441"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Giovanni Vigna","raw_affiliation_strings":["University of California,Santa Barbara","University of California, Santa Barbara"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of California,Santa Barbara","institution_ids":["https://openalex.org/I154570441"]},{"raw_affiliation_string":"University of California, Santa Barbara","institution_ids":["https://openalex.org/I154570441"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":3.3222,"has_fulltext":false,"cited_by_count":18,"citation_normalized_percentile":{"value":0.94292394,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"1066","last_page":"1081"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9969000220298767,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9901999831199646,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.8942594528198242},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8672393560409546},{"id":"https://openalex.org/keywords/macro","display_name":"Macro","score":0.8632826805114746},{"id":"https://openalex.org/keywords/obfuscation","display_name":"Obfuscation","score":0.7549008131027222},{"id":"https://openalex.org/keywords/static-analysis","display_name":"Static analysis","score":0.62282794713974},{"id":"https://openalex.org/keywords/sandbox","display_name":"Sandbox (software development)","score":0.5927835702896118},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.504808783531189},{"id":"https://openalex.org/keywords/parsing","display_name":"Parsing","score":0.45483890175819397},{"id":"https://openalex.org/keywords/malware-analysis","display_name":"Malware analysis","score":0.4468810558319092},{"id":"https://openalex.org/keywords/symbolic-execution","display_name":"Symbolic execution","score":0.42960605025291443},{"id":"https://openalex.org/keywords/range","display_name":"Range (aeronautics)","score":0.4172777533531189},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.36748552322387695},{"id":"https://openalex.org/keywords/software-engineering","display_name":"Software engineering","score":0.30015328526496887},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.26590001583099365}],"concepts":[{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.8942594528198242},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8672393560409546},{"id":"https://openalex.org/C166955791","wikidata":"https://www.wikidata.org/wiki/Q629579","display_name":"Macro","level":2,"score":0.8632826805114746},{"id":"https://openalex.org/C40305131","wikidata":"https://www.wikidata.org/wiki/Q2616305","display_name":"Obfuscation","level":2,"score":0.7549008131027222},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.62282794713974},{"id":"https://openalex.org/C167981075","wikidata":"https://www.wikidata.org/wiki/Q2667186","display_name":"Sandbox (software development)","level":2,"score":0.5927835702896118},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.504808783531189},{"id":"https://openalex.org/C186644900","wikidata":"https://www.wikidata.org/wiki/Q194152","display_name":"Parsing","level":2,"score":0.45483890175819397},{"id":"https://openalex.org/C2779395397","wikidata":"https://www.wikidata.org/wiki/Q15731404","display_name":"Malware analysis","level":3,"score":0.4468810558319092},{"id":"https://openalex.org/C2779639559","wikidata":"https://www.wikidata.org/wiki/Q7661178","display_name":"Symbolic execution","level":3,"score":0.42960605025291443},{"id":"https://openalex.org/C204323151","wikidata":"https://www.wikidata.org/wiki/Q905424","display_name":"Range (aeronautics)","level":2,"score":0.4172777533531189},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.36748552322387695},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.30015328526496887},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.26590001583099365},{"id":"https://openalex.org/C192562407","wikidata":"https://www.wikidata.org/wiki/Q228736","display_name":"Materials science","level":0,"score":0.0},{"id":"https://openalex.org/C159985019","wikidata":"https://www.wikidata.org/wiki/Q181790","display_name":"Composite material","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/sp46214.2022.9833765","is_oa":false,"landing_page_url":"https://doi.org/10.1109/sp46214.2022.9833765","pdf_url":null,"source":{"id":"https://openalex.org/S4363606603","display_name":"2022 IEEE Symposium on Security and Privacy (SP)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2022 IEEE Symposium on Security and Privacy (SP)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Life in Land","id":"https://metadata.un.org/sdg/15","score":0.550000011920929}],"awards":[],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":61,"referenced_works":["https://openalex.org/W143519483","https://openalex.org/W1515180657","https://openalex.org/W1559833478","https://openalex.org/W1581009051","https://openalex.org/W1694077306","https://openalex.org/W1993370323","https://openalex.org/W2010417554","https://openalex.org/W2046185165","https://openalex.org/W2065339563","https://openalex.org/W2110143557","https://openalex.org/W2117030266","https://openalex.org/W2120215974","https://openalex.org/W2131523719","https://openalex.org/W2135814109","https://openalex.org/W2136245903","https://openalex.org/W2137365926","https://openalex.org/W2141491681","https://openalex.org/W2145083214","https://openalex.org/W2151458388","https://openalex.org/W2160637255","https://openalex.org/W2433584005","https://openalex.org/W2514974017","https://openalex.org/W2621276321","https://openalex.org/W2751057302","https://openalex.org/W2753873057","https://openalex.org/W2794801050","https://openalex.org/W2884157903","https://openalex.org/W2890434219","https://openalex.org/W2890859663","https://openalex.org/W2891782005","https://openalex.org/W2900275727","https://openalex.org/W2965263711","https://openalex.org/W2969244304","https://openalex.org/W2972512996","https://openalex.org/W3007070494","https://openalex.org/W3008443984","https://openalex.org/W3008890513","https://openalex.org/W3017821103","https://openalex.org/W3048309924","https://openalex.org/W3083162932","https://openalex.org/W3098647255","https://openalex.org/W3103269073","https://openalex.org/W3111533025","https://openalex.org/W3113371616","https://openalex.org/W3134731862","https://openalex.org/W3136957390","https://openalex.org/W3138173041","https://openalex.org/W3196182990","https://openalex.org/W3205566425","https://openalex.org/W3211835121","https://openalex.org/W4254268612","https://openalex.org/W6605901207","https://openalex.org/W6633282783","https://openalex.org/W6637594488","https://openalex.org/W6666744930","https://openalex.org/W6681374200","https://openalex.org/W6782414423","https://openalex.org/W6785143213","https://openalex.org/W6800645602","https://openalex.org/W6803490195","https://openalex.org/W6888875766"],"related_works":["https://openalex.org/W4213243744","https://openalex.org/W2995488812","https://openalex.org/W4387947354","https://openalex.org/W2354385412","https://openalex.org/W3128730542","https://openalex.org/W2765820957","https://openalex.org/W2295023886","https://openalex.org/W4285586714","https://openalex.org/W3200050756","https://openalex.org/W4388951020"],"abstract_inverted_index":{"Malicious":[0],"software":[1],"(malware)":[2],"poses":[3],"a":[4,62,91,152],"significant":[5],"threat":[6],"to":[7,52,85,98,167],"the":[8,16,59,71,128,141,146,182],"security":[9],"of":[10,45,148,155,171,184,197],"our":[11,185],"networks":[12],"and":[13,41,100,118,131,174,200],"users.":[14],"In":[15],"ever-evolving":[17],"malware":[18],"landscape,":[19],"Excel":[20,102],"4.0":[21,103],"Office":[22],"macros":[23,33,72,104],"(XL4)":[24],"have":[25],"recently":[26],"become":[27],"an":[28],"important":[29],"attack":[30],"vector.":[31],"These":[32],"are":[34,50,81,201],"often":[35,202],"hidden":[36],"within":[37],"apparently":[38],"legitimate":[39],"documents":[40,192],"under":[42,76,151],"several":[43],"layers":[44],"obfuscation.":[46],"As":[47],"such,":[48],"they":[49],"difficult":[51],"analyze":[53,101],"using":[54],"static":[55],"analysis":[56,60,64],"techniques.":[57],"Moreover,":[58],"in":[61,109,120,188],"dynamic":[63],"environment":[65,157,198],"(a":[66],"sandbox)":[67],"is":[68,116],"challenging":[69],"because":[70],"execute":[73],"correctly":[74],"only":[75],"specific":[77],"environmental":[78],"conditions":[79],"that":[80,94,193],"not":[82,203],"always":[83],"easy":[84],"create.":[86],"This":[87],"paper":[88],"presents":[89],"SYMBEXCEL,":[90],"novel":[92,190],"solution":[93],"leverages":[95],"symbolic":[96,124,137,142],"execution":[97,125,147],"deobfuscate":[99],"automatically.":[105],"Our":[106,123,133,179],"approach":[107],"proceeds":[108],"three":[110],"stages:":[111],"(1)":[112],"The":[113],"malicious":[114,191],"document":[115],"parsed":[117],"loaded":[119],"memory;":[121],"(2)":[122],"engine":[126],"executes":[127],"XL4":[129],"formulas;":[130],"(3)":[132],"Engine":[134],"concretizes":[135],"any":[136],"values":[138],"encountered":[139],"during":[140],"exploration,":[143],"therefore":[144],"evaluating":[145],"each":[149],"macro":[150],"broad":[153],"range":[154],"(meaningful)":[156],"configurations.":[158],"SYMBEXCEL":[159],"significantly":[160],"outperforms":[161],"existing":[162],"deobfuscation":[163],"tools,":[164],"allowing":[165],"us":[166],"reliably":[168],"extract":[169],"Indicators":[170],"Compromise":[172],"(IoCs)":[173],"other":[175],"critical":[176],"forensics":[177],"information.":[178],"experiments":[180],"demonstrate":[181],"effectiveness":[183],"approach,":[186],"especially":[187],"deobfuscating":[189],"make":[194],"heavy":[195],"use":[196],"variables":[199],"identified":[204],"by":[205],"commercial":[206],"anti-virus":[207],"software.":[208]},"counts_by_year":[{"year":2025,"cited_by_count":2},{"year":2024,"cited_by_count":8},{"year":2023,"cited_by_count":7},{"year":2022,"cited_by_count":1}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}