{"id":"https://openalex.org/W3081186231","doi":"https://doi.org/10.1145/3379505","title":"Automated Model Learning for Accurate Detection of Malicious Digital Documents","display_name":"Automated Model Learning for Accurate Detection of Malicious Digital Documents","publication_year":2020,"publication_date":"2020-07-07","ids":{"openalex":"https://openalex.org/W3081186231","doi":"https://doi.org/10.1145/3379505","mag":"3081186231"},"language":"en","primary_location":{"id":"doi:10.1145/3379505","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3379505","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3379505","source":{"id":"https://openalex.org/S4210235901","display_name":"Digital Threats Research and Practice","issn_l":"2576-5337","issn":["2576-5337","2692-1626"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Digital Threats: Research and Practice","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3379505","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5088063494","display_name":"Daniel Scofield","orcid":"https://orcid.org/0000-0003-3440-7610"},"institutions":[{"id":"https://openalex.org/I4210097321","display_name":"Assured Information Security (United States)","ror":"https://ror.org/00w5xhg82","country_code":"US","type":"company","lineage":["https://openalex.org/I4210097321"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Daniel Scofield","raw_affiliation_strings":["Assured Information Security, Suite, Portland, OR"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Assured Information Security, Suite, Portland, OR","institution_ids":["https://openalex.org/I4210097321"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5077379438","display_name":"Craig Miles","orcid":"https://orcid.org/0000-0002-8648-803X"},"institutions":[{"id":"https://openalex.org/I4210097321","display_name":"Assured Information Security (United States)","ror":"https://ror.org/00w5xhg82","country_code":"US","type":"company","lineage":["https://openalex.org/I4210097321"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Craig Miles","raw_affiliation_strings":["Assured Information Security, Suite, Portland, OR"],"raw_orcid":"https://orcid.org/0000-0002-8648-803X","affiliations":[{"raw_affiliation_string":"Assured Information Security, Suite, Portland, OR","institution_ids":["https://openalex.org/I4210097321"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5081897895","display_name":"Stephen Kuhn","orcid":"https://orcid.org/0000-0002-0742-9681"},"institutions":[{"id":"https://openalex.org/I1280414376","display_name":"United States Air Force Research Laboratory","ror":"https://ror.org/02e2egq70","country_code":"US","type":"facility","lineage":["https://openalex.org/I1280414376","https://openalex.org/I1330347796","https://openalex.org/I4210102105","https://openalex.org/I4389425425"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Stephen Kuhn","raw_affiliation_strings":["Air Force Research Laboratory, Rome, NY"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Air Force Research Laboratory, Rome, NY","institution_ids":["https://openalex.org/I1280414376"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.1485,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":{"value":0.42692619,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":93},"biblio":{"volume":"1","issue":"3","first_page":"1","last_page":"21"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12357","display_name":"Digital Media Forensic Detection","score":0.9958999752998352,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9958000183105469,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8606167435646057},{"id":"https://openalex.org/keywords/scalability","display_name":"Scalability","score":0.6149191856384277},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.6106258034706116},{"id":"https://openalex.org/keywords/classifier","display_name":"Classifier (UML)","score":0.6034116148948669},{"id":"https://openalex.org/keywords/document-classification","display_name":"Document classification","score":0.5401351451873779},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.4629451036453247},{"id":"https://openalex.org/keywords/randomness","display_name":"Randomness","score":0.4444117248058319},{"id":"https://openalex.org/keywords/information-retrieval","display_name":"Information retrieval","score":0.42234665155410767},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.4153631031513214},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.40462416410446167},{"id":"https://openalex.org/keywords/database","display_name":"Database","score":0.19132176041603088}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8606167435646057},{"id":"https://openalex.org/C48044578","wikidata":"https://www.wikidata.org/wiki/Q727490","display_name":"Scalability","level":2,"score":0.6149191856384277},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.6106258034706116},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.6034116148948669},{"id":"https://openalex.org/C2780479914","wikidata":"https://www.wikidata.org/wiki/Q302088","display_name":"Document classification","level":2,"score":0.5401351451873779},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4629451036453247},{"id":"https://openalex.org/C125112378","wikidata":"https://www.wikidata.org/wiki/Q176640","display_name":"Randomness","level":2,"score":0.4444117248058319},{"id":"https://openalex.org/C23123220","wikidata":"https://www.wikidata.org/wiki/Q816826","display_name":"Information retrieval","level":1,"score":0.42234665155410767},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4153631031513214},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.40462416410446167},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.19132176041603088},{"id":"https://openalex.org/C105795698","wikidata":"https://www.wikidata.org/wiki/Q12483","display_name":"Statistics","level":1,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3379505","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3379505","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3379505","source":{"id":"https://openalex.org/S4210235901","display_name":"Digital Threats Research and Practice","issn_l":"2576-5337","issn":["2576-5337","2692-1626"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Digital Threats: Research and Practice","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1145/3379505","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3379505","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3379505","source":{"id":"https://openalex.org/S4210235901","display_name":"Digital Threats Research and Practice","issn_l":"2576-5337","issn":["2576-5337","2692-1626"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Digital Threats: Research and Practice","raw_type":"journal-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.6000000238418579,"display_name":"Peace, Justice and strong institutions"}],"awards":[{"id":"https://openalex.org/G1743975850","display_name":null,"funder_award_id":"FA8750-15-C-0017, FA8750-18-C-0140","funder_id":"https://openalex.org/F4320338294","funder_display_name":"Air Force Research Laboratory"}],"funders":[{"id":"https://openalex.org/F4320338294","display_name":"Air Force Research Laboratory","ror":"https://ror.org/02e2egq70"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":16,"referenced_works":["https://openalex.org/W649034908","https://openalex.org/W1647671624","https://openalex.org/W1988146703","https://openalex.org/W1991603936","https://openalex.org/W2018175892","https://openalex.org/W2082190528","https://openalex.org/W2091795142","https://openalex.org/W2128859735","https://openalex.org/W2140455318","https://openalex.org/W2140807364","https://openalex.org/W2150990339","https://openalex.org/W2275155238","https://openalex.org/W2486441280","https://openalex.org/W2779064420","https://openalex.org/W2971760890","https://openalex.org/W3125965191"],"related_works":["https://openalex.org/W3034924094","https://openalex.org/W1488708774","https://openalex.org/W3094954546","https://openalex.org/W2981906196","https://openalex.org/W4391100477","https://openalex.org/W4327779705","https://openalex.org/W2097492617","https://openalex.org/W1513698804","https://openalex.org/W4310560702","https://openalex.org/W2900292107"],"abstract_inverted_index":{"Modern":[0],"cyber":[1],"attacks":[2],"are":[3,90],"often":[4],"conducted":[5],"by":[6],"distributing":[7],"digital":[8,47],"documents":[9,48],"that":[10,22,84,89,147],"contain":[11],"malware.":[12],"The":[13],"approach":[14,141],"detailed":[15],"herein,":[16],"which":[17],"consists":[18],"of":[19,29,42,46,64,106,110],"a":[20,30,107,136,144],"classifier":[21],"uses":[23],"features":[24,88],"derived":[25],"from":[26],"dynamic":[27],"analysis":[28],"document":[31,37,139,151],"viewer":[32],"as":[33],"it":[34],"renders":[35],"the":[36,44,68,119],"in":[38],"question,":[39],"is":[40,58],"capable":[41],"classifying":[43],"disposition":[45],"with":[49,125],"greater":[50],"than":[51],"98%":[52],"accuracy":[53],"even":[54],"when":[55],"its":[56],"model":[57,70,109,120,146],"trained":[59],"on":[60],"just":[61],"small":[62,72],"amounts":[63],"data.":[65,128],"To":[66],"keep":[67],"classification":[69,145],"itself":[71],"and":[73,118,133],"thereby":[74],"to":[75,92,99],"provide":[76],"scalability,":[77],"we":[78,131],"employ":[79],"an":[80],"entity":[81],"resolution":[82,103],"strategy":[83],"merges":[85],"syntactically":[86],"disparate":[87],"thought":[91],"be":[93],"semantically":[94],"equivalent":[95],"but":[96],"vary":[97],"due":[98],"programmatic":[100],"randomness.":[101],"Entity":[102],"enables":[104],"construction":[105],"comprehensive":[108],"benign":[111],"functionality":[112],"using":[113],"relatively":[114],"few":[115],"training":[116,127],"documents,":[117],"does":[121],"not":[122],"improve":[123],"significantly":[124],"additional":[126],"In":[129],"particular,":[130],"describe":[132],"quantitatively":[134],"evaluate":[135],"fully":[137],"automated,":[138],"format--agnostic":[140],"for":[142],"learning":[143],"provides":[148],"efficacious":[149],"malicious":[150],"detection.":[152]},"counts_by_year":[{"year":2021,"cited_by_count":1}],"updated_date":"2026-05-21T06:26:12.895304","created_date":"2025-10-10T00:00:00"}