{"id":"https://openalex.org/W2085562432","doi":"https://doi.org/10.1145/2388576.2388594","title":"Mining control flow graph as <i>API call-grams</i> to detect portable executable malware","display_name":"Mining control flow graph as <i>API call-grams</i> to detect portable executable malware","publication_year":2012,"publication_date":"2012-10-25","ids":{"openalex":"https://openalex.org/W2085562432","doi":"https://doi.org/10.1145/2388576.2388594","mag":"2085562432"},"language":"en","primary_location":{"id":"doi:10.1145/2388576.2388594","is_oa":false,"landing_page_url":"https://doi.org/10.1145/2388576.2388594","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the Fifth International Conference on Security of Information and Networks","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5028236345","display_name":"Parvez Faruki","orcid":null},"institutions":[{"id":"https://openalex.org/I4210165136","display_name":"Govt. Dental College & Hospital","ror":"https://ror.org/05xanxb38","country_code":"IN","type":"education","lineage":["https://openalex.org/I4210165136"]}],"countries":["IN"],"is_corresponding":false,"raw_author_name":"Parvez Faruki","raw_affiliation_strings":["Govt. Polytechnic, Ahmedabad, India"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Govt. Polytechnic, Ahmedabad, India","institution_ids":["https://openalex.org/I4210165136"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5087820056","display_name":"Vijay Laxmi","orcid":"https://orcid.org/0000-0002-3662-8487"},"institutions":[{"id":"https://openalex.org/I83205935","display_name":"Malaviya National Institute of Technology Jaipur","ror":"https://ror.org/0077k1j32","country_code":"IN","type":"education","lineage":["https://openalex.org/I83205935"]}],"countries":["IN"],"is_corresponding":false,"raw_author_name":"Vijay Laxmi","raw_affiliation_strings":["Malaviya National Institute of Technology, Jaipur, India"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Malaviya National Institute of Technology, Jaipur, India","institution_ids":["https://openalex.org/I83205935"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5028420263","display_name":"Manoj Singh Gaur","orcid":"https://orcid.org/0000-0002-0497-721X"},"institutions":[{"id":"https://openalex.org/I83205935","display_name":"Malaviya National Institute of Technology Jaipur","ror":"https://ror.org/0077k1j32","country_code":"IN","type":"education","lineage":["https://openalex.org/I83205935"]}],"countries":["IN"],"is_corresponding":false,"raw_author_name":"M. S. Gaur","raw_affiliation_strings":["Malaviya National Institute of Technology, Jaipur, India"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Malaviya National Institute of Technology, Jaipur, India","institution_ids":["https://openalex.org/I83205935"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5103016944","display_name":"P. Vinod","orcid":"https://orcid.org/0000-0001-6078-2014"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"P. Vinod","raw_affiliation_strings":["SCMS School of Engineering, Kerala, India"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"SCMS School of Engineering, Kerala, India","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":40,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"130","last_page":"137"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9987999796867371,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9919000267982483,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.9039766788482666},{"id":"https://openalex.org/keywords/executable","display_name":"Executable","score":0.8830009698867798},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8427717685699463},{"id":"https://openalex.org/keywords/obfuscation","display_name":"Obfuscation","score":0.7313071489334106},{"id":"https://openalex.org/keywords/call-graph","display_name":"Call graph","score":0.7255261540412903},{"id":"https://openalex.org/keywords/control-flow","display_name":"Control flow","score":0.7239943146705627},{"id":"https://openalex.org/keywords/control-flow-graph","display_name":"Control flow graph","score":0.7135891318321228},{"id":"https://openalex.org/keywords/static-analysis","display_name":"Static analysis","score":0.6089661121368408},{"id":"https://openalex.org/keywords/system-call","display_name":"System call","score":0.5981854200363159},{"id":"https://openalex.org/keywords/encryption","display_name":"Encryption","score":0.5112650394439697},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.43844330310821533},{"id":"https://openalex.org/keywords/cryptovirology","display_name":"Cryptovirology","score":0.43514540791511536},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.411730021238327},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.39050421118736267},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.3294757902622223},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.32273542881011963},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.32230955362319946}],"concepts":[{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.9039766788482666},{"id":"https://openalex.org/C160145156","wikidata":"https://www.wikidata.org/wiki/Q778586","display_name":"Executable","level":2,"score":0.8830009698867798},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8427717685699463},{"id":"https://openalex.org/C40305131","wikidata":"https://www.wikidata.org/wiki/Q2616305","display_name":"Obfuscation","level":2,"score":0.7313071489334106},{"id":"https://openalex.org/C102379954","wikidata":"https://www.wikidata.org/wiki/Q2589940","display_name":"Call graph","level":2,"score":0.7255261540412903},{"id":"https://openalex.org/C160191386","wikidata":"https://www.wikidata.org/wiki/Q868299","display_name":"Control flow","level":2,"score":0.7239943146705627},{"id":"https://openalex.org/C27458966","wikidata":"https://www.wikidata.org/wiki/Q1187693","display_name":"Control flow graph","level":2,"score":0.7135891318321228},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.6089661121368408},{"id":"https://openalex.org/C2778579508","wikidata":"https://www.wikidata.org/wiki/Q722192","display_name":"System call","level":2,"score":0.5981854200363159},{"id":"https://openalex.org/C148730421","wikidata":"https://www.wikidata.org/wiki/Q141090","display_name":"Encryption","level":2,"score":0.5112650394439697},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.43844330310821533},{"id":"https://openalex.org/C84525096","wikidata":"https://www.wikidata.org/wiki/Q3506050","display_name":"Cryptovirology","level":3,"score":0.43514540791511536},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.411730021238327},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.39050421118736267},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.3294757902622223},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.32273542881011963},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.32230955362319946},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/2388576.2388594","is_oa":false,"landing_page_url":"https://doi.org/10.1145/2388576.2388594","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the Fifth International Conference on Security of Information and Networks","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.8199999928474426,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":33,"referenced_works":["https://openalex.org/W157706324","https://openalex.org/W1504694836","https://openalex.org/W1512098439","https://openalex.org/W1529311848","https://openalex.org/W1553801604","https://openalex.org/W1565377632","https://openalex.org/W1580559113","https://openalex.org/W1598779648","https://openalex.org/W1604938182","https://openalex.org/W1680392829","https://openalex.org/W1916732574","https://openalex.org/W1938740620","https://openalex.org/W1973861505","https://openalex.org/W1979711143","https://openalex.org/W1989255635","https://openalex.org/W1990698892","https://openalex.org/W2011009207","https://openalex.org/W2036575863","https://openalex.org/W2041130390","https://openalex.org/W2051223603","https://openalex.org/W2066220442","https://openalex.org/W2104495462","https://openalex.org/W2110978214","https://openalex.org/W2122471594","https://openalex.org/W2145056020","https://openalex.org/W2163931946","https://openalex.org/W2164463255","https://openalex.org/W2531563875","https://openalex.org/W2911964244","https://openalex.org/W3012889073","https://openalex.org/W4247037964","https://openalex.org/W4249572517","https://openalex.org/W6633894697"],"related_works":["https://openalex.org/W2900526031","https://openalex.org/W4296272594","https://openalex.org/W2789247308","https://openalex.org/W109909280","https://openalex.org/W4388157251","https://openalex.org/W2085562432","https://openalex.org/W2092942461","https://openalex.org/W2743799202","https://openalex.org/W2097474888","https://openalex.org/W2887046487"],"abstract_inverted_index":{"Present":[0],"day":[1],"malware":[2],"shows":[3],"stealthy":[4],"and":[5,8,117,120],"dynamic":[6,96],"capability":[7],"avails":[9],"administrative":[10],"rights":[11],"to":[12,31,44,63,164],"control":[13,151],"the":[14,74,80,87,104,122,158],"victim":[15],"computers.":[16],"Malware":[17],"writers":[18],"depend":[19],"on":[20,53],"evasion":[21],"techniques":[22],"like":[23],"code":[24,71,90,137],"obfuscation,":[25],"packing,":[26],"compression,":[27],"encryption":[28],"or":[29],"polymorphism":[30],"avoid":[32],"detection":[33],"by":[34,79,136,144],"Anti-Virus":[35],"(AV)":[36],"scanners":[37],"as":[38,99,129,161],"AV":[39],"primarily":[40],"use":[41],"syntactic":[42],"signature":[43,130],"detect":[45,64,114,165],"a":[46],"known":[47,132],"malware.":[48],"Our":[49],"approach":[50,126],"is":[51,72,76,92,127,142],"based":[52],"semantic":[54],"aspect":[55],"of":[56,89,106,131,153],"PE":[57],"exectable":[58],"that":[59],"analyses":[60],"API":[61,147,162],"Call-grams":[62],"unknown":[65],"malicious":[66,111,166],"code.":[67],"As":[68],"in--exact":[69],"source":[70],"analysed,":[73],"machine":[75],"not":[77,93,102],"infected":[78],"executable.":[81],"Moreover,":[82],"static":[83],"analysis":[84,141],"covers":[85],"all":[86],"paths":[88],"which":[91],"possible":[94],"with":[95],"behavioural":[97],"methods":[98],"latter":[100],"does":[101],"gurantee":[103],"execution":[105],"sample":[107],"being":[108],"analysed.":[109],"Modern":[110],"samples":[112,133],"also":[113],"controlled":[115],"virtual":[116],"emulated":[118],"environments":[119],"stop":[121],"functioning.":[123],"Semantic":[124],"invariant":[125],"important":[128],"are":[134],"changed":[135],"obfuscation":[138],"tools.":[139],"Static":[140],"performed":[143],"generating":[145],"an":[146,154],"Call":[148,159],"graph":[149,160],"from":[150],"flow":[152],"executable,":[155],"then":[156],"mining":[157],"Call-gram":[163],"files.":[167]},"counts_by_year":[{"year":2025,"cited_by_count":3},{"year":2024,"cited_by_count":1},{"year":2023,"cited_by_count":5},{"year":2021,"cited_by_count":4},{"year":2020,"cited_by_count":4},{"year":2019,"cited_by_count":4},{"year":2018,"cited_by_count":5},{"year":2017,"cited_by_count":1},{"year":2016,"cited_by_count":2},{"year":2015,"cited_by_count":4},{"year":2014,"cited_by_count":5},{"year":2013,"cited_by_count":2}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}