{"id":"https://openalex.org/W4407247921","doi":"https://doi.org/10.1109/tifs.2025.3539937","title":"Graph Learning on Instruction Stream-Augmented CFG for Malware Variant Detection","display_name":"Graph Learning on Instruction Stream-Augmented CFG for Malware Variant Detection","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W4407247921","doi":"https://doi.org/10.1109/tifs.2025.3539937"},"language":"en","primary_location":{"id":"doi:10.1109/tifs.2025.3539937","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2025.3539937","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5101778895","display_name":"Jiaxin Mi","orcid":"https://orcid.org/0000-0002-6924-0366"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jiaxin Mi","raw_affiliation_strings":["School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-6924-0366","affiliations":[{"raw_affiliation_string":"School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5092069033","display_name":"Qi Li","orcid":"https://orcid.org/0000-0001-9855-6119"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Qi Li","raw_affiliation_strings":["School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0001-9855-6119","affiliations":[{"raw_affiliation_string":"School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Zewei Han","orcid":"https://orcid.org/0009-0003-1196-5350"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zewei Han","raw_affiliation_strings":["School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":"https://orcid.org/0009-0003-1196-5350","affiliations":[{"raw_affiliation_string":"School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5113391490","display_name":"Weilue Liao","orcid":null},"institutions":[{"id":"https://openalex.org/I4210160629","display_name":"China Information Technology Security Evaluation Center","ror":"https://ror.org/053cexp66","country_code":"CN","type":"government","lineage":["https://openalex.org/I4210160629"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Weilue Liao","raw_affiliation_strings":["China Information Technology Security Evaluation Center, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"China Information Technology Security Evaluation Center, Beijing, China","institution_ids":["https://openalex.org/I4210160629"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5011916209","display_name":"Junsong Fu","orcid":"https://orcid.org/0000-0002-2445-1987"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Junsong Fu","raw_affiliation_strings":["School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-2445-1987","affiliations":[{"raw_affiliation_string":"School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":5.4146,"has_fulltext":false,"cited_by_count":6,"citation_normalized_percentile":{"value":0.95607068,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":96,"max":99},"biblio":{"volume":"20","issue":null,"first_page":"3015","last_page":"3030"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9961000084877014,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12519","display_name":"Cybercrime and Law Enforcement Studies","score":0.9632999897003174,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8667299747467041},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.810366690158844},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.538870632648468},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.3399714231491089},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.33852994441986084},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.1983984112739563}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8667299747467041},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.810366690158844},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.538870632648468},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3399714231491089},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.33852994441986084},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.1983984112739563}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tifs.2025.3539937","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2025.3539937","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G2660308747","display_name":null,"funder_award_id":"2022AAC03620","funder_id":"https://openalex.org/F4320322877","funder_display_name":"Natural Science Foundation of Ningxia Province"},{"id":"https://openalex.org/G4139883311","display_name":null,"funder_award_id":"62172055","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G595233080","display_name":null,"funder_award_id":"61972039","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G7311934457","display_name":null,"funder_award_id":"U20b1845","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G8003444953","display_name":null,"funder_award_id":"U20B2045","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320322877","display_name":"Natural Science Foundation of Ningxia Province","ror":null}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":58,"referenced_works":["https://openalex.org/W60817130","https://openalex.org/W1544837488","https://openalex.org/W1565441035","https://openalex.org/W1827256152","https://openalex.org/W1916732574","https://openalex.org/W1967185446","https://openalex.org/W2026973889","https://openalex.org/W2042058229","https://openalex.org/W2056127986","https://openalex.org/W2122492127","https://openalex.org/W2171035369","https://openalex.org/W2293143881","https://openalex.org/W2462192250","https://openalex.org/W2531260576","https://openalex.org/W2557513839","https://openalex.org/W2765653036","https://openalex.org/W2773683702","https://openalex.org/W2774999725","https://openalex.org/W2792672492","https://openalex.org/W2907492528","https://openalex.org/W2912636151","https://openalex.org/W2938709190","https://openalex.org/W2963562762","https://openalex.org/W2964015378","https://openalex.org/W2966905730","https://openalex.org/W2969904462","https://openalex.org/W2998010923","https://openalex.org/W3006140559","https://openalex.org/W3086651087","https://openalex.org/W3088054835","https://openalex.org/W3098605233","https://openalex.org/W3161004246","https://openalex.org/W3172909833","https://openalex.org/W3186739895","https://openalex.org/W3196064684","https://openalex.org/W3202468500","https://openalex.org/W3206188534","https://openalex.org/W4205554970","https://openalex.org/W4206078793","https://openalex.org/W4214483364","https://openalex.org/W4214850595","https://openalex.org/W4224286995","https://openalex.org/W4255756278","https://openalex.org/W4280590592","https://openalex.org/W4283214123","https://openalex.org/W4287849792","https://openalex.org/W4292230971","https://openalex.org/W4293451275","https://openalex.org/W4311493459","https://openalex.org/W4311609954","https://openalex.org/W4372342980","https://openalex.org/W4387870485","https://openalex.org/W6720006811","https://openalex.org/W6754929296","https://openalex.org/W6755207826","https://openalex.org/W6794146050","https://openalex.org/W6796534871","https://openalex.org/W6850925396"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W2097492617","https://openalex.org/W2753240997","https://openalex.org/W1764168690","https://openalex.org/W2537959205","https://openalex.org/W2740895074","https://openalex.org/W2772446090","https://openalex.org/W4284893819"],"abstract_inverted_index":{"As":[0],"malware":[1,15],"as":[2],"a":[3,12,89,100,199],"service":[4],"(MaaS)":[5],"and":[6,10,27,96,109,139,166,172,183,187,211,214],"organized":[7],"attacks":[8],"develop":[9],"drive":[11],"shift":[13],"in":[14,32,37,56,181,185,191,201],"variant":[16,20,221],"generation":[17,222],"mechanism,":[18,223],"current":[19,220],"detection,":[21],"designed":[22],"to":[23,87,106,209],"counter":[24],"conventional":[25],"obfuscation":[26],"anti-detection":[28],"strategies,":[29],"falls":[30],"short":[31],"facing":[33],"new":[34],"challenges,":[35],"particularly":[36],"identifying":[38,130],"variants":[39,125,131,207],"that":[40],"maintain":[41],"core":[42],"functionalities":[43],"while":[44],"altering":[45],"local":[46,108],"behaviors,":[47],"or":[48],"those":[49],"sharing":[50],"similar":[51],"code":[52,135],"logic":[53,154],"but":[54],"diverge":[55],"actual":[57],"functionalities.":[58],"To":[59],"tackle":[60],"the":[61,116,127,158,170,219],"problems,":[62],"we":[63,113,148,197],"present":[64],"ISCMVD,":[65],"an":[66,177],"Instruction":[67],"Stream-augmented":[68],"CFG-based":[69],"Malware":[70],"Variant":[71],"Detection":[72],"scheme,":[73],"melding":[74],"control":[75],"flow":[76],"structures":[77],"with":[78,176],"machine":[79],"semantic":[80],"information":[81],"from":[82,124,157],"instruction":[83],"streams":[84],"within":[85,126],"blocks":[86],"build":[88],"comprehensive":[90],"functional":[91,111],"representation":[92],"for":[93,227],"variants\u2019":[94,153],"basic":[95],"detailed":[97],"behaviors.":[98],"Leveraging":[99],"global-enhanced":[101],"attentive":[102],"graph":[103],"neural":[104],"network":[105],"integrate":[107],"global":[110],"features,":[112],"significantly":[114],"boost":[115],"capture":[117],"of":[118,152,174,179],"representative":[119],"stable":[120],"primary":[121],"behaviors\u2019":[122],"similarity":[123],"same":[128,159],"family":[129],"generated":[132],"under":[133,218],"attackers\u2019":[134],"rewriting,":[136],"module":[137],"modification,":[138],"other":[140],"transformation":[141],"means.":[142],"Additionally,":[143],"through":[144],"cross-family":[145],"associative":[146],"analysis,":[147],"eliminate":[149],"classification":[150],"interference":[151],"similarities":[155],"stemming":[156],"organization":[160],"generating.":[161],"Evaluation":[162],"results":[163],"on":[164],"public":[165],"real-world":[167],"datasets":[168],"demonstrate":[169],"superiority":[171],"robustness":[173],"ISCMVD":[175],"average":[178],"99.29%":[180],"AC":[182],"99.25%":[184],"F1":[186],"perform":[188],"well":[189],"even":[190],"few-shot":[192],"cases.":[193],"What\u2019s":[194],"more":[195],"important,":[196],"achieve":[198],"breakthrough":[200],"two":[202],"special":[203],"sample":[204],"sets":[205],"including":[206],"related":[208],"MaaS":[210],"APT":[212],"group,":[213],"outperform":[215],"state-of-the-art":[216],"methods":[217],"proving":[224],"its":[225],"suitability":[226],"future":[228],"trends.":[229]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":3}],"updated_date":"2025-12-27T23:08:20.325037","created_date":"2025-10-10T00:00:00"}