{"id":"https://openalex.org/W4385286624","doi":"https://doi.org/10.1109/tdsc.2023.3298905","title":"MalAF : Malware Attack Foretelling From Run-Time Behavior Graph Sequence","display_name":"MalAF : Malware Attack Foretelling From Run-Time Behavior Graph Sequence","publication_year":2023,"publication_date":"2023-07-26","ids":{"openalex":"https://openalex.org/W4385286624","doi":"https://doi.org/10.1109/tdsc.2023.3298905"},"language":"en","primary_location":{"id":"doi:10.1109/tdsc.2023.3298905","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tdsc.2023.3298905","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5079131572","display_name":"Chen Liu","orcid":"https://orcid.org/0000-0002-8803-9617"},"institutions":[{"id":"https://openalex.org/I82880672","display_name":"Beihang University","ror":"https://ror.org/00wk2mp56","country_code":"CN","type":"education","lineage":["https://openalex.org/I82880672"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Chen Liu","raw_affiliation_strings":["School of Computer Science and Engineering, Beihang University, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-8803-9617","affiliations":[{"raw_affiliation_string":"School of Computer Science and Engineering, Beihang University, Beijing, China","institution_ids":["https://openalex.org/I82880672"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100688208","display_name":"Bo Li","orcid":"https://orcid.org/0000-0002-6297-712X"},"institutions":[{"id":"https://openalex.org/I82880672","display_name":"Beihang University","ror":"https://ror.org/00wk2mp56","country_code":"CN","type":"education","lineage":["https://openalex.org/I82880672"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Bo Li","raw_affiliation_strings":["School of Computer Science and Engineering, Beihang University, Beijing, China","Zhongguancun Laboratory, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-6297-712X","affiliations":[{"raw_affiliation_string":"School of Computer Science and Engineering, Beihang University, Beijing, China","institution_ids":["https://openalex.org/I82880672"]},{"raw_affiliation_string":"Zhongguancun Laboratory, Beijing, China","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5042467880","display_name":"Jun Zhao","orcid":"https://orcid.org/0000-0003-2655-3888"},"institutions":[{"id":"https://openalex.org/I28006308","display_name":"Shandong Normal University","ror":"https://ror.org/01wy3h363","country_code":"CN","type":"education","lineage":["https://openalex.org/I28006308"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jun Zhao","raw_affiliation_strings":["School of Information Science and Engineering, Shandong Normal University, Jinan, China"],"raw_orcid":"https://orcid.org/0000-0003-2655-3888","affiliations":[{"raw_affiliation_string":"School of Information Science and Engineering, Shandong Normal University, Jinan, China","institution_ids":["https://openalex.org/I28006308"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5104473141","display_name":"Xudong Liu","orcid":"https://orcid.org/0000-0001-7102-0963"},"institutions":[{"id":"https://openalex.org/I82880672","display_name":"Beihang University","ror":"https://ror.org/00wk2mp56","country_code":"CN","type":"education","lineage":["https://openalex.org/I82880672"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xudong Liu","raw_affiliation_strings":["School of Computer Science and Engineering, Beihang University, Beijing, China","Zhongguancun Laboratory, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0001-7102-0963","affiliations":[{"raw_affiliation_string":"School of Computer Science and Engineering, Beihang University, Beijing, China","institution_ids":["https://openalex.org/I82880672"]},{"raw_affiliation_string":"Zhongguancun Laboratory, Beijing, China","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5070748632","display_name":"Chunpei Li","orcid":"https://orcid.org/0000-0002-0250-5374"},"institutions":[{"id":"https://openalex.org/I29739308","display_name":"Guangxi Normal University","ror":"https://ror.org/02frt9q65","country_code":"CN","type":"education","lineage":["https://openalex.org/I29739308"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Chunpei Li","raw_affiliation_strings":["School of Computer Science and Engineering & School of Software, Guangxi Normal University, Guilin, China"],"raw_orcid":"https://orcid.org/0000-0002-0250-5374","affiliations":[{"raw_affiliation_string":"School of Computer Science and Engineering & School of Software, Guangxi Normal University, Guilin, China","institution_ids":["https://openalex.org/I29739308"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.4657,"has_fulltext":false,"cited_by_count":11,"citation_normalized_percentile":{"value":0.81375077,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":99},"biblio":{"volume":"21","issue":"4","first_page":"1951","last_page":"1966"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9986000061035156,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9986000061035156,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9977999925613403,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9707000255584717,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7621183395385742},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.7415932416915894},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.45523881912231445},{"id":"https://openalex.org/keywords/path","display_name":"Path (computing)","score":0.4226042330265045},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.33000797033309937},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.23812326788902283},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.1955888271331787}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7621183395385742},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.7415932416915894},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.45523881912231445},{"id":"https://openalex.org/C2777735758","wikidata":"https://www.wikidata.org/wiki/Q817765","display_name":"Path (computing)","level":2,"score":0.4226042330265045},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.33000797033309937},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.23812326788902283},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.1955888271331787}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tdsc.2023.3298905","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tdsc.2023.3298905","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320321125","display_name":"Beihang University","ror":"https://ror.org/00wk2mp56"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W2748952813","https://openalex.org/W2097492617","https://openalex.org/W2753240997","https://openalex.org/W1764168690","https://openalex.org/W2537959205","https://openalex.org/W2740895074","https://openalex.org/W2772446090","https://openalex.org/W3152891574","https://openalex.org/W2249809453","https://openalex.org/W4284893819"],"abstract_inverted_index":{"Foretelling":[0],"ongoing":[1],"malware":[2,40,99],"attacks":[3,174],"in":[4,102,200],"real":[5,103],"time":[6,73,96],"is":[7],"challenging":[8],"due":[9],"to":[10,41,88,117,149,175],"the":[11,43,58,61,77,119,131,139,151,155,161,172,189,194],"stealthy":[12],"and":[13,67,170],"polymorphic":[14],"nature":[15],"of":[16,36,39,60,63,121,141,154,198,202],"their":[17],"executive":[18],"behavior":[19,33],"patterns.":[20],"In":[21],"this":[22],"paper,":[23],"we":[24],"present":[25],"MalAF,":[26],"a":[27,108,166],"novelMalwareAttackForetelling":[28],"framework":[29],"that":[30,45,184],"utilizes":[31],"run-time":[32],"(i.e.,":[34],"sequences":[35,87,101],"API":[37,54,65],"events)":[38],"foretell":[42,150],"attack":[44,72,95,124,143],"has":[46],"not":[47],"yet":[48],"executed.":[49],"MalAF":[50,82,106,145,159,187],"first":[51],"samples":[52],"suspicious":[53],"events":[55],"by":[56,75,196],"assessing":[57],"sensitivity":[59],"parameters":[62],"each":[64,94],"event":[66],"dividing":[68],"them":[69],"into":[70],"multiple":[71],"slots":[74],"calculating":[76],"strong":[78],"correlation.":[79],"Following":[80],"that,":[81],"employs":[83],"dynamic":[84],"heterogeneous":[85],"graph":[86],"incrementally":[89],"model":[90],"contextual":[91],"semantics":[92],"for":[93],"slot,":[97],"generating":[98],"state":[100],"time.":[104],"Moreover,":[105],"proposes":[107],"greedy":[109],"adaptive":[110],"dictionary":[111],"(GAD)-optimized":[112],"IRL":[113],"preference":[114],"learning":[115,135],"method":[116],"automate":[118],"capture":[120],"families'":[122,142],"intrinsic":[123],"preferences,":[125,144],"which":[126,192],"achieves":[127],"higher":[128],"performance":[129],"than":[130],"existing":[132],"inverse":[133],"reinforcement":[134],"(IRL).":[136],"Additionally,":[137],"with":[138,165],"guidance":[140],"trains":[146],"an":[147,176],"LSTM":[148],"future":[152],"path":[153,203],"target":[156],"malware.":[157],"Finally,":[158],"matches":[160],"identified":[162],"APIs'":[163],"paths":[164],"malicious":[167],"capability":[168],"base":[169],"reports":[171],"comprehensible":[173],"analyst.":[177],"The":[178],"experiments":[179],"on":[180],"real-world":[181],"datasets":[182],"demonstrate":[183],"our":[185],"proposed":[186],"outperforms":[188],"state-of-the-art":[190],"methods,":[191],"improves":[193],"baseline":[195],"3.01%$\\sim$4.73%":[197],"accuracy":[199],"terms":[201],"foretell.":[204]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":7},{"year":2024,"cited_by_count":3}],"updated_date":"2026-07-29T09:40:50.615796","created_date":"2025-10-10T00:00:00"}