{"id":"https://openalex.org/W2902792499","doi":"https://doi.org/10.1145/3274694.3274700","title":"Accurate Malware Detection by Extreme Abstraction","display_name":"Accurate Malware Detection by Extreme Abstraction","publication_year":2018,"publication_date":"2018-12-03","ids":{"openalex":"https://openalex.org/W2902792499","doi":"https://doi.org/10.1145/3274694.3274700","mag":"2902792499"},"language":"en","primary_location":{"id":"doi:10.1145/3274694.3274700","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3274694.3274700","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 34th Annual Computer Security Applications Conference","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5066374175","display_name":"Fady Copty","orcid":null},"institutions":[{"id":"https://openalex.org/I4210167297","display_name":"IBM Research - Haifa","ror":"https://ror.org/05rw9t746","country_code":"IL","type":"facility","lineage":["https://openalex.org/I1341412227","https://openalex.org/I4210114115","https://openalex.org/I4210167297"]}],"countries":["IL"],"is_corresponding":false,"raw_author_name":"Fady Copty","raw_affiliation_strings":["IBM Research - Haifa, Haifa, Israel"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"IBM Research - Haifa, Haifa, Israel","institution_ids":["https://openalex.org/I4210167297"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5037353377","display_name":"Matan Danos","orcid":null},"institutions":[{"id":"https://openalex.org/I4210167297","display_name":"IBM Research - Haifa","ror":"https://ror.org/05rw9t746","country_code":"IL","type":"facility","lineage":["https://openalex.org/I1341412227","https://openalex.org/I4210114115","https://openalex.org/I4210167297"]}],"countries":["IL"],"is_corresponding":false,"raw_author_name":"Matan Danos","raw_affiliation_strings":["IBM Research - Haifa, Haifa, Israel"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"IBM Research - Haifa, Haifa, Israel","institution_ids":["https://openalex.org/I4210167297"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5025808981","display_name":"Orit Edelstein","orcid":null},"institutions":[{"id":"https://openalex.org/I4210167297","display_name":"IBM Research - Haifa","ror":"https://ror.org/05rw9t746","country_code":"IL","type":"facility","lineage":["https://openalex.org/I1341412227","https://openalex.org/I4210114115","https://openalex.org/I4210167297"]}],"countries":["IL"],"is_corresponding":false,"raw_author_name":"Orit Edelstein","raw_affiliation_strings":["IBM Research - Haifa, Haifa, Israel"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"IBM Research - Haifa, Haifa, Israel","institution_ids":["https://openalex.org/I4210167297"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5028269639","display_name":"Cindy Eisner","orcid":null},"institutions":[{"id":"https://openalex.org/I4210167297","display_name":"IBM Research - Haifa","ror":"https://ror.org/05rw9t746","country_code":"IL","type":"facility","lineage":["https://openalex.org/I1341412227","https://openalex.org/I4210114115","https://openalex.org/I4210167297"]}],"countries":["IL"],"is_corresponding":false,"raw_author_name":"Cindy Eisner","raw_affiliation_strings":["IBM Research - Haifa, Haifa, Israel"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"IBM Research - Haifa, Haifa, Israel","institution_ids":["https://openalex.org/I4210167297"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5023713634","display_name":"Dov Murik","orcid":null},"institutions":[{"id":"https://openalex.org/I4210167297","display_name":"IBM Research - Haifa","ror":"https://ror.org/05rw9t746","country_code":"IL","type":"facility","lineage":["https://openalex.org/I1341412227","https://openalex.org/I4210114115","https://openalex.org/I4210167297"]}],"countries":["IL"],"is_corresponding":false,"raw_author_name":"Dov Murik","raw_affiliation_strings":["IBM Research - Haifa, Haifa, Israel"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"IBM Research - Haifa, Haifa, Israel","institution_ids":["https://openalex.org/I4210167297"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5006323771","display_name":"Benjamin Zeltser","orcid":null},"institutions":[{"id":"https://openalex.org/I4210167297","display_name":"IBM Research - Haifa","ror":"https://ror.org/05rw9t746","country_code":"IL","type":"facility","lineage":["https://openalex.org/I1341412227","https://openalex.org/I4210114115","https://openalex.org/I4210167297"]}],"countries":["IL"],"is_corresponding":false,"raw_author_name":"Benjamin Zeltser","raw_affiliation_strings":["IBM Research - Haifa, Haifa, Israel"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"IBM Research - Haifa, Haifa, Israel","institution_ids":["https://openalex.org/I4210167297"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I4210167297"],"apc_list":null,"apc_paid":null,"fwci":1.4959,"has_fulltext":false,"cited_by_count":14,"citation_normalized_percentile":{"value":0.84191656,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":98},"biblio":{"volume":null,"issue":null,"first_page":"101","last_page":"111"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9926999807357788,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.9782000184059143,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8602567911148071},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.8429778814315796},{"id":"https://openalex.org/keywords/abstraction","display_name":"Abstraction","score":0.6111288070678711},{"id":"https://openalex.org/keywords/system-call","display_name":"System call","score":0.6050759553909302},{"id":"https://openalex.org/keywords/static-analysis","display_name":"Static analysis","score":0.5604758262634277},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.5582079887390137},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.5523487329483032},{"id":"https://openalex.org/keywords/malware-analysis","display_name":"Malware analysis","score":0.5242448449134827},{"id":"https://openalex.org/keywords/classifier","display_name":"Classifier (UML)","score":0.5063413381576538},{"id":"https://openalex.org/keywords/evasion","display_name":"Evasion (ethics)","score":0.4323866069316864},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.4061816334724426},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.2764848470687866},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.118008553981781},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.09456884860992432}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8602567911148071},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.8429778814315796},{"id":"https://openalex.org/C124304363","wikidata":"https://www.wikidata.org/wiki/Q673661","display_name":"Abstraction","level":2,"score":0.6111288070678711},{"id":"https://openalex.org/C2778579508","wikidata":"https://www.wikidata.org/wiki/Q722192","display_name":"System call","level":2,"score":0.6050759553909302},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.5604758262634277},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5582079887390137},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5523487329483032},{"id":"https://openalex.org/C2779395397","wikidata":"https://www.wikidata.org/wiki/Q15731404","display_name":"Malware analysis","level":3,"score":0.5242448449134827},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.5063413381576538},{"id":"https://openalex.org/C2781251061","wikidata":"https://www.wikidata.org/wiki/Q5416089","display_name":"Evasion (ethics)","level":3,"score":0.4323866069316864},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4061816334724426},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.2764848470687866},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.118008553981781},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.09456884860992432},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0},{"id":"https://openalex.org/C203014093","wikidata":"https://www.wikidata.org/wiki/Q101929","display_name":"Immunology","level":1,"score":0.0},{"id":"https://openalex.org/C8891405","wikidata":"https://www.wikidata.org/wiki/Q1059","display_name":"Immune system","level":2,"score":0.0},{"id":"https://openalex.org/C111472728","wikidata":"https://www.wikidata.org/wiki/Q9471","display_name":"Epistemology","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3274694.3274700","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3274694.3274700","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 34th Annual Computer Security Applications Conference","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.7799999713897705,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":31,"referenced_works":["https://openalex.org/W172558989","https://openalex.org/W1481397690","https://openalex.org/W1482612322","https://openalex.org/W1545528966","https://openalex.org/W1561877636","https://openalex.org/W1570974058","https://openalex.org/W1666731339","https://openalex.org/W1893133781","https://openalex.org/W1966917005","https://openalex.org/W1966948031","https://openalex.org/W1984233424","https://openalex.org/W2010417554","https://openalex.org/W2051725773","https://openalex.org/W2062897452","https://openalex.org/W2070996757","https://openalex.org/W2087740020","https://openalex.org/W2095450067","https://openalex.org/W2101077503","https://openalex.org/W2101234009","https://openalex.org/W2101512909","https://openalex.org/W2117030266","https://openalex.org/W2132874238","https://openalex.org/W2138788987","https://openalex.org/W2557513839","https://openalex.org/W2560252021","https://openalex.org/W2613827243","https://openalex.org/W2766343248","https://openalex.org/W2911964244","https://openalex.org/W2997591727","https://openalex.org/W3085162807","https://openalex.org/W4206807714"],"related_works":["https://openalex.org/W4285507391","https://openalex.org/W2610659201","https://openalex.org/W3107556205","https://openalex.org/W2783112941","https://openalex.org/W65788704","https://openalex.org/W4368275542","https://openalex.org/W4387065217","https://openalex.org/W1998188341","https://openalex.org/W2507496997","https://openalex.org/W2765174411"],"abstract_inverted_index":{"Modern":[0],"malware":[1,50],"applies":[2],"a":[3,41,46,101,112,120,143,159,181,194,214],"rich":[4],"arsenal":[5],"of":[6,40,63,80,86,104,119,146,158,191,199],"evasion":[7],"techniques":[8],"to":[9,22,31,37,49,132,150,216],"render":[10],"dynamic":[11,16],"analysis":[12,17,51],"ineffective.":[13],"In":[14],"turn,":[15],"tools":[18],"take":[19],"great":[20],"pains":[21],"hide":[23],"themselves":[24],"from":[25,70,138],"malware;":[26],"typically":[27],"this":[28,54],"entails":[29],"trying":[30],"be":[32,130,206],"as":[33,35],"faithful":[34],"possible":[36],"the":[38,64,78,91,105,117],"behavior":[39,82,118,126],"real":[42,71,102,121],"run.":[43],"We":[44,135,162],"present":[45,176],"novel":[47],"approach":[48],"that":[52,67,77,97,114,127,202,212],"turns":[53],"idea":[55],"on":[56],"its":[57],"head,":[58],"using":[59,180],"an":[60,186],"extreme":[61,203],"abstraction":[62,204],"operating":[65],"system":[66,113],"intentionally":[68],"strays":[69],"behavior.":[72],"The":[73],"key":[74],"insight":[75],"is":[76,83,94],"presence":[79],"malicious":[81,87],"sufficient":[84],"evidence":[85],"intent,":[88],"even":[89],"if":[90],"path":[92],"taken":[93],"not":[95],"one":[96],"could":[98],"occur":[99],"during":[100],"run":[103],"sample.":[106],"By":[107],"exploring":[108],"multiple":[109,139],"paths":[110,140],"in":[111,173,209],"only":[115],"approximates":[116],"system,":[122,165],"we":[123],"can":[124,205],"discover":[125],"would":[128],"often":[129],"hard":[131],"elicit":[133],"otherwise.":[134],"aggregate":[136],"features":[137],"and":[141,175],"use":[142],"funnel-like":[144],"configuration":[145],"machine":[147,177],"learning":[148,178],"classifiers":[149],"achieve":[151],"high":[152],"accuracy":[153],"without":[154],"incurring":[155],"too":[156],"much":[157],"performance":[160],"penalty.":[161],"describe":[163],"our":[164],"TAMALES":[166],"(The":[167],"Abstract":[168],"Malware":[169],"Analysis":[170],"LEarning":[171],"System),":[172],"detail":[174],"results":[179],"330K":[182],"sample":[183],"set":[184],"showing":[185],"FPR":[187],"(False":[188],"Positive":[189,197],"Rate)":[190,198],"0.10%":[192],"with":[193],"TPR":[195],"(True":[196],"99.11%,":[200],"demonstrating":[201],"extraordinarily":[207],"effective":[208],"providing":[210],"data":[211],"allows":[213],"classifier":[215],"accurately":[217],"detect":[218],"malware.":[219]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2024,"cited_by_count":3},{"year":2023,"cited_by_count":1},{"year":2021,"cited_by_count":1},{"year":2020,"cited_by_count":5},{"year":2019,"cited_by_count":3}],"updated_date":"2026-06-26T08:34:08.712188","created_date":"2025-10-10T00:00:00"}