{"id":"https://openalex.org/W4383753794","doi":"https://doi.org/10.1109/tifs.2023.3294059","title":"YAMME: a YAra-byte-signatures Metamorphic Mutation Engine","display_name":"YAMME: a YAra-byte-signatures Metamorphic Mutation Engine","publication_year":2023,"publication_date":"2023-01-01","ids":{"openalex":"https://openalex.org/W4383753794","doi":"https://doi.org/10.1109/tifs.2023.3294059"},"language":"en","primary_location":{"id":"doi:10.1109/tifs.2023.3294059","is_oa":true,"landing_page_url":"https://doi.org/10.1109/tifs.2023.3294059","pdf_url":"https://ieeexplore.ieee.org/ielx7/10206/4358835/10177752.pdf","source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"bronze","oa_url":"https://ieeexplore.ieee.org/ielx7/10206/4358835/10177752.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5092128323","display_name":"Antonio Coscia","orcid":"https://orcid.org/0000-0002-7263-4999"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Antonio Coscia","raw_affiliation_strings":["Cybersecurity Laboratory, BV TECH S.p.A., Milano, Italy"],"raw_orcid":"https://orcid.org/0000-0002-7263-4999","affiliations":[{"raw_affiliation_string":"Cybersecurity Laboratory, BV TECH S.p.A., Milano, Italy","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5062626549","display_name":"Vincenzo Dentamaro","orcid":"https://orcid.org/0000-0003-1148-332X"},"institutions":[{"id":"https://openalex.org/I5561750","display_name":"University of Bari Aldo Moro","ror":"https://ror.org/027ynra39","country_code":"IT","type":"education","lineage":["https://openalex.org/I5561750"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Vincenzo Dentamaro","raw_affiliation_strings":["Department of Computer Science, University of Bari Aldo Moro, Bari, Italy"],"raw_orcid":"https://orcid.org/0000-0003-1148-332X","affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of Bari Aldo Moro, Bari, Italy","institution_ids":["https://openalex.org/I5561750"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5085849149","display_name":"Stefano Galantucci","orcid":"https://orcid.org/0000-0002-3955-0478"},"institutions":[{"id":"https://openalex.org/I5561750","display_name":"University of Bari Aldo Moro","ror":"https://ror.org/027ynra39","country_code":"IT","type":"education","lineage":["https://openalex.org/I5561750"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Stefano Galantucci","raw_affiliation_strings":["Department of Computer Science, University of Bari Aldo Moro, Bari, Italy"],"raw_orcid":"https://orcid.org/0000-0002-3955-0478","affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of Bari Aldo Moro, Bari, Italy","institution_ids":["https://openalex.org/I5561750"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5092128322","display_name":"Antonio Maci","orcid":"https://orcid.org/0000-0002-6526-554X"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Antonio Maci","raw_affiliation_strings":["Cybersecurity Laboratory, BV TECH S.p.A., Milano, Italy"],"raw_orcid":"https://orcid.org/0000-0002-6526-554X","affiliations":[{"raw_affiliation_string":"Cybersecurity Laboratory, BV TECH S.p.A., Milano, Italy","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5038436210","display_name":"Giuseppe Pirlo","orcid":"https://orcid.org/0000-0002-7305-2210"},"institutions":[{"id":"https://openalex.org/I5561750","display_name":"University of Bari Aldo Moro","ror":"https://ror.org/027ynra39","country_code":"IT","type":"education","lineage":["https://openalex.org/I5561750"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Giuseppe Pirlo","raw_affiliation_strings":["Department of Computer Science, University of Bari Aldo Moro, Bari, Italy"],"raw_orcid":"https://orcid.org/0000-0002-7305-2210","affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of Bari Aldo Moro, Bari, Italy","institution_ids":["https://openalex.org/I5561750"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":2345,"currency":"USD","value_usd":2345},"apc_paid":null,"fwci":2.5842,"has_fulltext":true,"cited_by_count":20,"citation_normalized_percentile":{"value":0.90628008,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":99},"biblio":{"volume":"18","issue":null,"first_page":"4530","last_page":"4545"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.9970999956130981,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9955000281333923,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8517715930938721},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.7976291179656982},{"id":"https://openalex.org/keywords/obfuscation","display_name":"Obfuscation","score":0.7356832027435303},{"id":"https://openalex.org/keywords/byte","display_name":"Byte","score":0.7044828534126282},{"id":"https://openalex.org/keywords/signature","display_name":"Signature (topology)","score":0.6121115684509277},{"id":"https://openalex.org/keywords/overhead","display_name":"Overhead (engineering)","score":0.515586793422699},{"id":"https://openalex.org/keywords/mutation","display_name":"Mutation","score":0.43903157114982605},{"id":"https://openalex.org/keywords/rewriting","display_name":"Rewriting","score":0.41330695152282715},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.3710651993751526},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.33217501640319824},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.3264337182044983},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.25679904222488403},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.1549873650074005}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8517715930938721},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.7976291179656982},{"id":"https://openalex.org/C40305131","wikidata":"https://www.wikidata.org/wiki/Q2616305","display_name":"Obfuscation","level":2,"score":0.7356832027435303},{"id":"https://openalex.org/C43364308","wikidata":"https://www.wikidata.org/wiki/Q8799","display_name":"Byte","level":2,"score":0.7044828534126282},{"id":"https://openalex.org/C2779696439","wikidata":"https://www.wikidata.org/wiki/Q7512811","display_name":"Signature (topology)","level":2,"score":0.6121115684509277},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.515586793422699},{"id":"https://openalex.org/C501734568","wikidata":"https://www.wikidata.org/wiki/Q42918","display_name":"Mutation","level":3,"score":0.43903157114982605},{"id":"https://openalex.org/C154690210","wikidata":"https://www.wikidata.org/wiki/Q1668499","display_name":"Rewriting","level":2,"score":0.41330695152282715},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3710651993751526},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.33217501640319824},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3264337182044983},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.25679904222488403},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.1549873650074005},{"id":"https://openalex.org/C55493867","wikidata":"https://www.wikidata.org/wiki/Q7094","display_name":"Biochemistry","level":1,"score":0.0},{"id":"https://openalex.org/C2524010","wikidata":"https://www.wikidata.org/wiki/Q8087","display_name":"Geometry","level":1,"score":0.0},{"id":"https://openalex.org/C104317684","wikidata":"https://www.wikidata.org/wiki/Q7187","display_name":"Gene","level":2,"score":0.0},{"id":"https://openalex.org/C185592680","wikidata":"https://www.wikidata.org/wiki/Q2329","display_name":"Chemistry","level":0,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/tifs.2023.3294059","is_oa":true,"landing_page_url":"https://doi.org/10.1109/tifs.2023.3294059","pdf_url":"https://ieeexplore.ieee.org/ielx7/10206/4358835/10177752.pdf","source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},{"id":"pmh:oai:ricerca.uniba.it:11586/444960","is_oa":true,"landing_page_url":"https://hdl.handle.net/11586/444960","pdf_url":"https://ricerca.uniba.it/bitstream/11586/444960/1/YAMME%20a%20YAra-byte-signatures%20Metamorphic%20Mutation%20Engine.pdf","source":{"id":"https://openalex.org/S4377196296","display_name":"CINECA IRIS Institutional Research Information System (University of Bari Aldo Moro)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I5561750","host_organization_name":"University of Bari Aldo Moro","host_organization_lineage":["https://openalex.org/I5561750"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"info:eu-repo/semantics/article"}],"best_oa_location":{"id":"doi:10.1109/tifs.2023.3294059","is_oa":true,"landing_page_url":"https://doi.org/10.1109/tifs.2023.3294059","pdf_url":"https://ieeexplore.ieee.org/ielx7/10206/4358835/10177752.pdf","source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.5199999809265137,"display_name":"Peace, Justice and strong institutions"}],"awards":[{"id":"https://openalex.org/G1888088267","display_name":null,"funder_award_id":"2014-2020\u2019","funder_id":"https://openalex.org/F4320335322","funder_display_name":"European Regional Development Fund"}],"funders":[{"id":"https://openalex.org/F4320335322","display_name":"European Regional Development Fund","ror":"https://ror.org/00k4n6c32"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4383753794.pdf","grobid_xml":"https://content.openalex.org/works/W4383753794.grobid-xml"},"referenced_works_count":81,"referenced_works":["https://openalex.org/W1552056088","https://openalex.org/W1975966552","https://openalex.org/W1996646428","https://openalex.org/W2007647094","https://openalex.org/W2016000144","https://openalex.org/W2023764457","https://openalex.org/W2024170198","https://openalex.org/W2033368661","https://openalex.org/W2044751544","https://openalex.org/W2045756085","https://openalex.org/W2051223603","https://openalex.org/W2092375860","https://openalex.org/W2092446507","https://openalex.org/W2104495462","https://openalex.org/W2108104525","https://openalex.org/W2109227373","https://openalex.org/W2111574103","https://openalex.org/W2115771393","https://openalex.org/W2115912164","https://openalex.org/W2124151159","https://openalex.org/W2132874238","https://openalex.org/W2145056020","https://openalex.org/W2154555738","https://openalex.org/W2186280426","https://openalex.org/W2205761907","https://openalex.org/W2293458749","https://openalex.org/W2748076757","https://openalex.org/W2770089821","https://openalex.org/W2884256006","https://openalex.org/W2898664598","https://openalex.org/W2900690086","https://openalex.org/W2902867165","https://openalex.org/W2915893383","https://openalex.org/W2941306455","https://openalex.org/W2963384204","https://openalex.org/W2969656743","https://openalex.org/W2972552958","https://openalex.org/W2982994925","https://openalex.org/W2990166555","https://openalex.org/W2999469480","https://openalex.org/W3000731494","https://openalex.org/W3008617927","https://openalex.org/W3015605314","https://openalex.org/W3081886688","https://openalex.org/W3082126477","https://openalex.org/W3084078945","https://openalex.org/W3086404086","https://openalex.org/W3090219579","https://openalex.org/W3091453511","https://openalex.org/W3105646798","https://openalex.org/W3107757457","https://openalex.org/W3117809002","https://openalex.org/W3119689710","https://openalex.org/W3120554811","https://openalex.org/W3132588576","https://openalex.org/W3157781335","https://openalex.org/W3162825625","https://openalex.org/W3164220323","https://openalex.org/W3178528869","https://openalex.org/W3186795874","https://openalex.org/W3199416276","https://openalex.org/W3203410921","https://openalex.org/W3206660056","https://openalex.org/W3209499614","https://openalex.org/W4214829033","https://openalex.org/W4221154652","https://openalex.org/W4281706496","https://openalex.org/W4293106276","https://openalex.org/W4300687693","https://openalex.org/W4312503753","https://openalex.org/W4313020371","https://openalex.org/W4360993664","https://openalex.org/W4361794978","https://openalex.org/W4366000548","https://openalex.org/W4386387815","https://openalex.org/W6686924642","https://openalex.org/W6750318962","https://openalex.org/W6790535149","https://openalex.org/W6809591491","https://openalex.org/W6888051994","https://openalex.org/W6910384731"],"related_works":["https://openalex.org/W2620652965","https://openalex.org/W2024170198","https://openalex.org/W4296272594","https://openalex.org/W2900526031","https://openalex.org/W2128507946","https://openalex.org/W2728713145","https://openalex.org/W2131332603","https://openalex.org/W2470502009","https://openalex.org/W2072617132","https://openalex.org/W4360993664"],"abstract_inverted_index":{"Recognition":[0],"of":[1,82,88,199],"known":[2,15,28],"malicious":[3,29,62],"patterns":[4],"through":[5,194],"signature-based":[6],"systems":[7],"is":[8,46,77],"unsuccessful":[9],"against":[10,123],"malware":[11,49,98,125],"for":[12,165],"which":[13,57],"no":[14],"signature":[16],"exists":[17],"to":[18,32,60,120,157],"identify":[19],"them.":[20],"These":[21],"include":[22],"not":[23],"only":[24],"zero-day":[25],"but":[26],"also":[27],"software":[30],"able":[31],"self-replicate":[33],"rewriting":[34,105],"its":[35,40],"own":[36],"code":[37],"leaving":[38],"unaffected":[39],"execution,":[41],"namely":[42],"metamorphic":[43,130,143],"malware.":[44],"YARA":[45],"a":[47,83,86,115,142,184],"popular":[48],"analysis":[50,198],"tool":[51],"that":[52,189],"uses":[53],"the":[54,80,153,209,214,218],"so-called":[55],"YARA-rules,":[56],"are":[58],"built":[59],"match":[61],"contents":[63],"within":[64],"files":[65],"or":[66],"network":[67],"packets":[68],"analyzed":[69],"by":[70,191,203,213],"an":[71,149,197],"Anti-Virus":[72],"engine.":[73],"Sometimes":[74],"such":[75],"content":[76],"expressed":[78],"in":[79,107,129,137,183],"form":[81],"byte-signature,":[84],"i.e.,":[85],"sequence":[87],"operational":[89],"machine-level":[90],"code.":[91],"However,":[92],"these":[93,103],"can":[94,101],"be":[95],"bypassed":[96],"since":[97],"obfuscation":[99,126],"techniques":[100,127],"change":[102],"sequences,":[104],"them":[106,163],"several":[108,138,159],"equivalent":[109,139],"forms.":[110],"This":[111],"paper":[112],"presents":[113],"YAMME,":[114],"YARA-byte-signatures":[116],"Metamorphic":[117],"Mutation":[118],"Engine":[119],"strengthen":[121],"rules":[122,160,171,206],"some":[124],"deployed":[128],"mutation":[131,144,215],"engines.":[132],"First,":[133],"it":[134],"rewrites":[135],"YARA-bye-signatures":[136],"ways,":[140],"as":[141],"engine":[145,216],"would":[146],"do.":[147],"Second,":[148],"optimization":[150],"phase":[151],"exploits":[152],"YARA-rules":[154,192,219],"syntax":[155],"constructs":[156],"provide":[158],"formats,":[161],"making":[162],"suitable":[164],"different":[166,204],"real-world":[167],"application":[168],"requirements.":[169],"YAMME":[170,205],"have":[172],"been":[173],"evaluated":[174],"on":[175],"MWOR,":[176],"G2,":[177],"NGVCK,":[178],"and":[179],"MetaNG":[180],"datasets,":[181],"resulting":[182],"better":[185],"detection":[186],"rate":[187],"than":[188],"achieved":[190],"generated":[193],"AutoYara.":[195],"Furthermore,":[196],"computational":[200],"overhead":[201],"required":[202],"formats":[207],"validates":[208],"low":[210],"impact":[211],"introduced":[212],"at":[217],"level.":[220]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":7},{"year":2024,"cited_by_count":10},{"year":2023,"cited_by_count":1}],"updated_date":"2026-08-28T12:50:07.497085","created_date":"2025-10-10T00:00:00"}