{"id":"https://openalex.org/W2774688517","doi":"https://doi.org/10.1145/3134600.3134604","title":"Marmite","display_name":"Marmite","publication_year":2017,"publication_date":"2017-12-04","ids":{"openalex":"https://openalex.org/W2774688517","doi":"https://doi.org/10.1145/3134600.3134604","mag":"2774688517"},"language":"en","primary_location":{"id":"doi:10.1145/3134600.3134604","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3134600.3134604","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 33rd Annual Computer Security Applications Conference","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5046881273","display_name":"Gianluca Stringhini","orcid":"https://orcid.org/0000-0002-6162-578X"},"institutions":[{"id":"https://openalex.org/I45129253","display_name":"University College London","ror":"https://ror.org/02jx3x895","country_code":"GB","type":"education","lineage":["https://openalex.org/I124357947","https://openalex.org/I45129253"]}],"countries":["GB"],"is_corresponding":true,"raw_author_name":"Gianluca Stringhini","raw_affiliation_strings":["University College London"],"affiliations":[{"raw_affiliation_string":"University College London","institution_ids":["https://openalex.org/I45129253"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5050781579","display_name":"Yun Shen","orcid":"https://orcid.org/0000-0001-7863-8475"},"institutions":[{"id":"https://openalex.org/I1308906816","display_name":"NortonLifeLock (United States)","ror":"https://ror.org/0449t3a80","country_code":"US","type":"company","lineage":["https://openalex.org/I1308906816"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yun Shen","raw_affiliation_strings":["Symantec Research Labs"],"affiliations":[{"raw_affiliation_string":"Symantec Research Labs","institution_ids":["https://openalex.org/I1308906816"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5071053999","display_name":"Yufei Han","orcid":"https://orcid.org/0000-0002-3492-328X"},"institutions":[{"id":"https://openalex.org/I1308906816","display_name":"NortonLifeLock (United States)","ror":"https://ror.org/0449t3a80","country_code":"US","type":"company","lineage":["https://openalex.org/I1308906816"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yufei Han","raw_affiliation_strings":["Symantec Research Labs"],"affiliations":[{"raw_affiliation_string":"Symantec Research Labs","institution_ids":["https://openalex.org/I1308906816"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5000755750","display_name":"Xiangliang Zhang","orcid":"https://orcid.org/0000-0002-3574-5665"},"institutions":[{"id":"https://openalex.org/I71920554","display_name":"King Abdullah University of Science and Technology","ror":"https://ror.org/01q3tbs38","country_code":"SA","type":"education","lineage":["https://openalex.org/I71920554"]}],"countries":["SA"],"is_corresponding":false,"raw_author_name":"Xiangliang Zhang","raw_affiliation_strings":["King Abdullah University of Science and Technology"],"affiliations":[{"raw_affiliation_string":"King Abdullah University of Science and Technology","institution_ids":["https://openalex.org/I71920554"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5046881273"],"corresponding_institution_ids":["https://openalex.org/I45129253"],"apc_list":null,"apc_paid":null,"fwci":2.9588,"has_fulltext":false,"cited_by_count":25,"citation_normalized_percentile":{"value":0.92430829,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"91","last_page":"102"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8003057241439819},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.7598304748535156},{"id":"https://openalex.org/keywords/download","display_name":"Download","score":0.6887076497077942},{"id":"https://openalex.org/keywords/server","display_name":"Server","score":0.6392264366149902},{"id":"https://openalex.org/keywords/reputation","display_name":"Reputation","score":0.6192981600761414},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.5233694314956665},{"id":"https://openalex.org/keywords/bayesian-probability","display_name":"Bayesian probability","score":0.4417325258255005},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.40424445271492004},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.4028802514076233},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.3839586675167084},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.21335747838020325},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.20256733894348145},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.15754640102386475}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8003057241439819},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.7598304748535156},{"id":"https://openalex.org/C2780154274","wikidata":"https://www.wikidata.org/wiki/Q7126717","display_name":"Download","level":2,"score":0.6887076497077942},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.6392264366149902},{"id":"https://openalex.org/C48798503","wikidata":"https://www.wikidata.org/wiki/Q877546","display_name":"Reputation","level":2,"score":0.6192981600761414},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.5233694314956665},{"id":"https://openalex.org/C107673813","wikidata":"https://www.wikidata.org/wiki/Q812534","display_name":"Bayesian probability","level":2,"score":0.4417325258255005},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.40424445271492004},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4028802514076233},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3839586675167084},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.21335747838020325},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.20256733894348145},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.15754640102386475},{"id":"https://openalex.org/C144024400","wikidata":"https://www.wikidata.org/wiki/Q21201","display_name":"Sociology","level":0,"score":0.0},{"id":"https://openalex.org/C36289849","wikidata":"https://www.wikidata.org/wiki/Q34749","display_name":"Social science","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1145/3134600.3134604","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3134600.3134604","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 33rd Annual Computer Security Applications Conference","raw_type":"proceedings-article"},{"id":"pmh:oai:repository.kaust.edu.sa:10754/626759","is_oa":false,"landing_page_url":"http://hdl.handle.net/10754/626759","pdf_url":null,"source":{"id":"https://openalex.org/S4306401596","display_name":"King Abdullah University of Science and Technology Repository (King Abdullah University of Science and Technology)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I71920554","host_organization_name":"King Abdullah University of Science and Technology","host_organization_lineage":["https://openalex.org/I71920554"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"Conference Paper"}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.8299999833106995,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[{"id":"https://openalex.org/G4568559407","display_name":null,"funder_award_id":"EP/N008448/1","funder_id":"https://openalex.org/F4320334627","funder_display_name":"Engineering and Physical Sciences Research Council"}],"funders":[{"id":"https://openalex.org/F4320334627","display_name":"Engineering and Physical Sciences Research Council","ror":"https://ror.org/0439y7842"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":43,"referenced_works":["https://openalex.org/W80155331","https://openalex.org/W152196245","https://openalex.org/W162156064","https://openalex.org/W1519699895","https://openalex.org/W1561983441","https://openalex.org/W1564075167","https://openalex.org/W1650881334","https://openalex.org/W1680392829","https://openalex.org/W1983776999","https://openalex.org/W1993370323","https://openalex.org/W2040424958","https://openalex.org/W2049092543","https://openalex.org/W2066220442","https://openalex.org/W2082180526","https://openalex.org/W2083391339","https://openalex.org/W2087027764","https://openalex.org/W2097998348","https://openalex.org/W2100307718","https://openalex.org/W2102475112","https://openalex.org/W2111038628","https://openalex.org/W2114356569","https://openalex.org/W2117202485","https://openalex.org/W2119251836","https://openalex.org/W2119359024","https://openalex.org/W2121320294","https://openalex.org/W2130745297","https://openalex.org/W2134385885","https://openalex.org/W2139823104","https://openalex.org/W2158698691","https://openalex.org/W2166128942","https://openalex.org/W2176830056","https://openalex.org/W2182421051","https://openalex.org/W2211880739","https://openalex.org/W2228075399","https://openalex.org/W2350778671","https://openalex.org/W2396034850","https://openalex.org/W2400462880","https://openalex.org/W2402589876","https://openalex.org/W2460170719","https://openalex.org/W2482374127","https://openalex.org/W4299301436","https://openalex.org/W6674385629","https://openalex.org/W7073767927"],"related_works":["https://openalex.org/W2097492617","https://openalex.org/W2753240997","https://openalex.org/W1764168690","https://openalex.org/W2537959205","https://openalex.org/W2740895074","https://openalex.org/W2772446090","https://openalex.org/W4284893819","https://openalex.org/W3152891574","https://openalex.org/W2249809453","https://openalex.org/W4316881845"],"abstract_inverted_index":{"Effective":[0],"malware":[1],"detection":[2,125],"approaches":[3],"need":[4,11],"not":[5,128],"only":[6],"high":[7,105],"accuracy,":[8],"but":[9],"also":[10,121],"to":[12,15,42,103],"be":[13],"robust":[14],"changes":[16],"in":[17],"the":[18,46,88,150],"modus":[19],"operandi":[20],"of":[21,39,48,64,82,115,141,165],"criminals.":[22],"In":[23],"this":[24,53,163],"paper,":[25],"we":[26],"propose":[27],"Marmite,":[28],"a":[29,57,61,77,112,138,159],"feature-agnostic":[30],"system":[31,136,151],"that":[32,59,99,123],"aims":[33],"at":[34,56],"propagating":[35],"known":[36],"malicious":[37],"reputation":[38,81],"certain":[40],"files":[41,66,83],"unknown":[43],"ones":[44],"with":[45,94],"goal":[47],"detecting":[49],"malware.":[50],"Marmite":[51,100,156],"does":[52],"by":[54,133],"looking":[55],"graph":[58,89],"encapsulates":[60],"comprehensive":[62],"view":[63],"how":[65],"are":[67],"downloaded":[68],"(by":[69],"which":[70,74],"hosts":[71],"and":[72,154],"from":[73],"servers)":[75],"on":[76,109,137],"global":[78],"scale.":[79],"The":[80],"is":[84,101],"then":[85],"propagated":[86],"across":[87],"using":[90],"semi-supervised":[91],"label":[92],"propagation":[93],"Bayesian":[95],"confidence.":[96],"We":[97,120],"show":[98],"able":[102],"reach":[104],"accuracy":[106,161],"(0.94":[107],"G-mean":[108],"average)":[110],"over":[111,131],"10-day":[113],"dataset":[114,140],"200":[116],"million":[117,143],"download":[118,144],"events.":[119],"demonstrate":[122],"Marmite's":[124],"capabilities":[126],"do":[127],"significantly":[129],"degrade":[130],"time,":[132],"testing":[134],"our":[135],"30-day":[139],"660":[142],"events":[145],"collected":[146],"six":[147],"months":[148],"after":[149,162],"was":[152],"tuned":[153],"validated.":[155],"still":[157],"maintains":[158],"similar":[160],"period":[164],"time.":[166]},"counts_by_year":[{"year":2025,"cited_by_count":1},{"year":2024,"cited_by_count":2},{"year":2023,"cited_by_count":1},{"year":2022,"cited_by_count":1},{"year":2021,"cited_by_count":4},{"year":2020,"cited_by_count":7},{"year":2019,"cited_by_count":4},{"year":2018,"cited_by_count":5}],"updated_date":"2025-11-06T03:46:38.306776","created_date":"2017-12-22T00:00:00"}