{"id":"https://openalex.org/W4321089593","doi":"https://doi.org/10.1145/3567432","title":"Beyond the Hype: An Evaluation of Commercially Available Machine Learning\u2013based Malware Detectors","display_name":"Beyond the Hype: An Evaluation of Commercially Available Machine Learning\u2013based Malware Detectors","publication_year":2023,"publication_date":"2023-02-16","ids":{"openalex":"https://openalex.org/W4321089593","doi":"https://doi.org/10.1145/3567432"},"language":"en","primary_location":{"id":"doi:10.1145/3567432","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3567432","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3567432","source":{"id":"https://openalex.org/S4210235901","display_name":"Digital Threats Research and Practice","issn_l":"2576-5337","issn":["2576-5337","2692-1626"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Digital Threats: Research and Practice","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3567432","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5012446017","display_name":"Robert A. Bridges","orcid":"https://orcid.org/0000-0001-7962-6329"},"institutions":[{"id":"https://openalex.org/I1289243028","display_name":"Oak Ridge National Laboratory","ror":"https://ror.org/01qz5mb56","country_code":"US","type":"facility","lineage":["https://openalex.org/I1289243028","https://openalex.org/I1330989302","https://openalex.org/I39565521","https://openalex.org/I4210159294"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Robert A. Bridges","raw_affiliation_strings":["Oak Ridge National Laboratory, USA","Oak Ridge National Laboratory ,"],"raw_orcid":"https://orcid.org/0000-0001-7962-6329","affiliations":[{"raw_affiliation_string":"Oak Ridge National Laboratory, USA","institution_ids":["https://openalex.org/I1289243028"]},{"raw_affiliation_string":"Oak Ridge National Laboratory ,","institution_ids":["https://openalex.org/I1289243028"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5049863244","display_name":"Sean Oesch","orcid":"https://orcid.org/0000-0002-6909-1022"},"institutions":[{"id":"https://openalex.org/I1289243028","display_name":"Oak Ridge National Laboratory","ror":"https://ror.org/01qz5mb56","country_code":"US","type":"facility","lineage":["https://openalex.org/I1289243028","https://openalex.org/I1330989302","https://openalex.org/I39565521","https://openalex.org/I4210159294"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Sean Oesch","raw_affiliation_strings":["Oak Ridge National Laboratory, USA","Oak Ridge National Laboratory ,"],"raw_orcid":"https://orcid.org/0000-0002-6909-1022","affiliations":[{"raw_affiliation_string":"Oak Ridge National Laboratory, USA","institution_ids":["https://openalex.org/I1289243028"]},{"raw_affiliation_string":"Oak Ridge National Laboratory ,","institution_ids":["https://openalex.org/I1289243028"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5023093422","display_name":"Michael D. Iannacone","orcid":"https://orcid.org/0000-0003-3081-4761"},"institutions":[{"id":"https://openalex.org/I1289243028","display_name":"Oak Ridge National Laboratory","ror":"https://ror.org/01qz5mb56","country_code":"US","type":"facility","lineage":["https://openalex.org/I1289243028","https://openalex.org/I1330989302","https://openalex.org/I39565521","https://openalex.org/I4210159294"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Michael D. Iannacone","raw_affiliation_strings":["Oak Ridge National Laboratory, USA"],"raw_orcid":"https://orcid.org/0000-0003-3081-4761","affiliations":[{"raw_affiliation_string":"Oak Ridge National Laboratory, USA","institution_ids":["https://openalex.org/I1289243028"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5034986549","display_name":"Kelly M. T. Huffer","orcid":"https://orcid.org/0000-0002-1785-9108"},"institutions":[{"id":"https://openalex.org/I1289243028","display_name":"Oak Ridge National Laboratory","ror":"https://ror.org/01qz5mb56","country_code":"US","type":"facility","lineage":["https://openalex.org/I1289243028","https://openalex.org/I1330989302","https://openalex.org/I39565521","https://openalex.org/I4210159294"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Kelly M. T. Huffer","raw_affiliation_strings":["Oak Ridge National Laboratory, USA","Oak Ridge National Laboratory ,"],"raw_orcid":"https://orcid.org/0000-0002-1785-9108","affiliations":[{"raw_affiliation_string":"Oak Ridge National Laboratory, USA","institution_ids":["https://openalex.org/I1289243028"]},{"raw_affiliation_string":"Oak Ridge National Laboratory ,","institution_ids":["https://openalex.org/I1289243028"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5061489870","display_name":"Brian Jewell","orcid":"https://orcid.org/0000-0003-3712-6523"},"institutions":[{"id":"https://openalex.org/I1289243028","display_name":"Oak Ridge National Laboratory","ror":"https://ror.org/01qz5mb56","country_code":"US","type":"facility","lineage":["https://openalex.org/I1289243028","https://openalex.org/I1330989302","https://openalex.org/I39565521","https://openalex.org/I4210159294"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Brian Jewell","raw_affiliation_strings":["Oak Ridge National Laboratory, USA","Oak Ridge National Laboratory ,"],"raw_orcid":"https://orcid.org/0000-0003-3712-6523","affiliations":[{"raw_affiliation_string":"Oak Ridge National Laboratory, USA","institution_ids":["https://openalex.org/I1289243028"]},{"raw_affiliation_string":"Oak Ridge National Laboratory ,","institution_ids":["https://openalex.org/I1289243028"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5103178409","display_name":"Jeff A. Nichols","orcid":null},"institutions":[{"id":"https://openalex.org/I1289243028","display_name":"Oak Ridge National Laboratory","ror":"https://ror.org/01qz5mb56","country_code":"US","type":"facility","lineage":["https://openalex.org/I1289243028","https://openalex.org/I1330989302","https://openalex.org/I39565521","https://openalex.org/I4210159294"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jeff A. Nichols","raw_affiliation_strings":["Oak Ridge National Laboratory, USA","Oak Ridge National Laboratory ,"],"raw_orcid":"https://orcid.org/0000-0002-6127-3542","affiliations":[{"raw_affiliation_string":"Oak Ridge National Laboratory, USA","institution_ids":["https://openalex.org/I1289243028"]},{"raw_affiliation_string":"Oak Ridge National Laboratory ,","institution_ids":["https://openalex.org/I1289243028"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5021166489","display_name":"Brian Weber","orcid":"https://orcid.org/0000-0002-3261-5152"},"institutions":[{"id":"https://openalex.org/I1289243028","display_name":"Oak Ridge National Laboratory","ror":"https://ror.org/01qz5mb56","country_code":"US","type":"facility","lineage":["https://openalex.org/I1289243028","https://openalex.org/I1330989302","https://openalex.org/I39565521","https://openalex.org/I4210159294"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Brian Weber","raw_affiliation_strings":["Oak Ridge National Laboratory, USA"],"raw_orcid":"https://orcid.org/0000-0002-3261-5152","affiliations":[{"raw_affiliation_string":"Oak Ridge National Laboratory, USA","institution_ids":["https://openalex.org/I1289243028"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5027313610","display_name":"Miki E. Verma","orcid":null},"institutions":[{"id":"https://openalex.org/I97018004","display_name":"Stanford University","ror":"https://ror.org/00f54p054","country_code":"US","type":"education","lineage":["https://openalex.org/I97018004"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Miki E. Verma","raw_affiliation_strings":["Stanford University, USA"],"raw_orcid":"https://orcid.org/0000-0001-7793-4942","affiliations":[{"raw_affiliation_string":"Stanford University, USA","institution_ids":["https://openalex.org/I97018004"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5088063494","display_name":"Daniel Scofield","orcid":"https://orcid.org/0000-0003-3440-7610"},"institutions":[{"id":"https://openalex.org/I1289243028","display_name":"Oak Ridge National Laboratory","ror":"https://ror.org/01qz5mb56","country_code":"US","type":"facility","lineage":["https://openalex.org/I1289243028","https://openalex.org/I1330989302","https://openalex.org/I39565521","https://openalex.org/I4210159294"]},{"id":"https://openalex.org/I1311688040","display_name":"Amazon (United States)","ror":"https://ror.org/04mv4n011","country_code":"US","type":"company","lineage":["https://openalex.org/I1311688040"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Daniel Scofield","raw_affiliation_strings":["Amazon Inc., USA","Oak Ridge National Laboratory ,"],"raw_orcid":"https://orcid.org/0000-0003-3440-7610","affiliations":[{"raw_affiliation_string":"Amazon Inc., USA","institution_ids":["https://openalex.org/I1311688040"]},{"raw_affiliation_string":"Oak Ridge National Laboratory ,","institution_ids":["https://openalex.org/I1289243028"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5077379438","display_name":"Craig Miles","orcid":"https://orcid.org/0000-0002-8648-803X"},"institutions":[{"id":"https://openalex.org/I1311688040","display_name":"Amazon (United States)","ror":"https://ror.org/04mv4n011","country_code":"US","type":"company","lineage":["https://openalex.org/I1311688040"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Craig Miles","raw_affiliation_strings":["Amazon Inc., USA"],"raw_orcid":"https://orcid.org/0000-0002-8648-803X","affiliations":[{"raw_affiliation_string":"Amazon Inc., USA","institution_ids":["https://openalex.org/I1311688040"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5061767128","display_name":"Thomas Plummer","orcid":"https://orcid.org/0000-0002-4900-0330"},"institutions":[{"id":"https://openalex.org/I1287521167","display_name":"Lockheed Martin (United States)","ror":"https://ror.org/026er9r08","country_code":"US","type":"company","lineage":["https://openalex.org/I1287521167"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Thomas Plummer","raw_affiliation_strings":["Lockheed Martin, USA"],"raw_orcid":"https://orcid.org/0000-0002-4900-0330","affiliations":[{"raw_affiliation_string":"Lockheed Martin, USA","institution_ids":["https://openalex.org/I1287521167"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5102788069","display_name":"Mark Daniell","orcid":"https://orcid.org/0000-0002-3058-2641"},"institutions":[{"id":"https://openalex.org/I1287521167","display_name":"Lockheed Martin (United States)","ror":"https://ror.org/026er9r08","country_code":"US","type":"company","lineage":["https://openalex.org/I1287521167"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Mark Daniell","raw_affiliation_strings":["Lockheed Martin, USA"],"raw_orcid":"https://orcid.org/0000-0002-3058-2641","affiliations":[{"raw_affiliation_string":"Lockheed Martin, USA","institution_ids":["https://openalex.org/I1287521167"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5067786685","display_name":"Anne M. Tall","orcid":"https://orcid.org/0000-0001-5173-8484"},"institutions":[{"id":"https://openalex.org/I44896327","display_name":"Mitre (United States)","ror":"https://ror.org/03ks2a131","country_code":"US","type":"company","lineage":["https://openalex.org/I44896327"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Anne M. Tall","raw_affiliation_strings":["MITRE Corporation, USA"],"raw_orcid":"https://orcid.org/0000-0001-5173-8484","affiliations":[{"raw_affiliation_string":"MITRE Corporation, USA","institution_ids":["https://openalex.org/I44896327"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5066770245","display_name":"Justin M. Beaver","orcid":"https://orcid.org/0000-0002-0281-6017"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Justin M. Beaver","raw_affiliation_strings":["Lirio LLC, USA"],"raw_orcid":"https://orcid.org/0000-0002-0281-6017","affiliations":[{"raw_affiliation_string":"Lirio LLC, USA","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5012619069","display_name":"Jared M. Smith","orcid":"https://orcid.org/0000-0002-3240-2405"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jared M. Smith","raw_affiliation_strings":["Security Scorecard, USA"],"raw_orcid":"https://orcid.org/0000-0002-3240-2405","affiliations":[{"raw_affiliation_string":"Security Scorecard, USA","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":5,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.6953,"has_fulltext":true,"cited_by_count":4,"citation_normalized_percentile":{"value":0.6568306,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":97},"biblio":{"volume":"4","issue":"2","first_page":"1","last_page":"22"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9973000288009644,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9944999814033508,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.9146186113357544},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7491422295570374},{"id":"https://openalex.org/keywords/executable","display_name":"Executable","score":0.7476595044136047},{"id":"https://openalex.org/keywords/flagging","display_name":"Flagging","score":0.6001713871955872},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.5405688285827637},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.4688034653663635},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.3232768177986145},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.2814202606678009},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.27690207958221436}],"concepts":[{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.9146186113357544},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7491422295570374},{"id":"https://openalex.org/C160145156","wikidata":"https://www.wikidata.org/wiki/Q778586","display_name":"Executable","level":2,"score":0.7476595044136047},{"id":"https://openalex.org/C2777548347","wikidata":"https://www.wikidata.org/wiki/Q5456937","display_name":"Flagging","level":2,"score":0.6001713871955872},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5405688285827637},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4688034653663635},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3232768177986145},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.2814202606678009},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.27690207958221436},{"id":"https://openalex.org/C95457728","wikidata":"https://www.wikidata.org/wiki/Q309","display_name":"History","level":0,"score":0.0},{"id":"https://openalex.org/C166957645","wikidata":"https://www.wikidata.org/wiki/Q23498","display_name":"Archaeology","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1145/3567432","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3567432","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3567432","source":{"id":"https://openalex.org/S4210235901","display_name":"Digital Threats Research and Practice","issn_l":"2576-5337","issn":["2576-5337","2692-1626"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Digital Threats: Research and Practice","raw_type":"journal-article"},{"id":"pmh:oai:osti.gov:1965262","is_oa":true,"landing_page_url":"https://www.osti.gov/biblio/1965262","pdf_url":"https://www.osti.gov/servlets/purl/1965262","source":{"id":"https://openalex.org/S4306402487","display_name":"OSTI OAI (U.S. Department of Energy Office of Scientific and Technical Information)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I139351228","host_organization_name":"Office of Scientific and Technical Information","host_organization_lineage":["https://openalex.org/I139351228"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":null}],"best_oa_location":{"id":"doi:10.1145/3567432","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3567432","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3567432","source":{"id":"https://openalex.org/S4210235901","display_name":"Digital Threats Research and Practice","issn_l":"2576-5337","issn":["2576-5337","2692-1626"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Digital Threats: Research and Practice","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1645119126","display_name":null,"funder_award_id":"AC05-00OR22725","funder_id":"https://openalex.org/F4320306084","funder_display_name":"U.S. Department of Energy"},{"id":"https://openalex.org/G7995982022","display_name":null,"funder_award_id":"DE-AC05","funder_id":"https://openalex.org/F4320306084","funder_display_name":"U.S. Department of Energy"},{"id":"https://openalex.org/G834413596","display_name":null,"funder_award_id":"DE-AC05-00OR22725","funder_id":"https://openalex.org/F4320306078","funder_display_name":"U.S. Department of Defense"},{"id":"https://openalex.org/G8906985441","display_name":null,"funder_award_id":"00OR22725","funder_id":"https://openalex.org/F4320306084","funder_display_name":"U.S. Department of Energy"}],"funders":[{"id":"https://openalex.org/F4320306078","display_name":"U.S. Department of Defense","ror":"https://ror.org/0447fe631"},{"id":"https://openalex.org/F4320306084","display_name":"U.S. Department of Energy","ror":"https://ror.org/01bj3aw27"},{"id":"https://openalex.org/F4320337834","display_name":"Naval Information Warfare Systems Command","ror":null}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4321089593.pdf","grobid_xml":"https://content.openalex.org/works/W4321089593.grobid-xml"},"referenced_works_count":35,"referenced_works":["https://openalex.org/W61130390","https://openalex.org/W200681053","https://openalex.org/W1976327390","https://openalex.org/W1988295638","https://openalex.org/W1988986734","https://openalex.org/W1997761579","https://openalex.org/W1999094552","https://openalex.org/W2077488147","https://openalex.org/W2078910959","https://openalex.org/W2099151437","https://openalex.org/W2140455318","https://openalex.org/W2149439200","https://openalex.org/W2158467476","https://openalex.org/W2160372331","https://openalex.org/W2171070266","https://openalex.org/W2330567702","https://openalex.org/W2486441280","https://openalex.org/W2573389470","https://openalex.org/W2575541032","https://openalex.org/W2603093875","https://openalex.org/W2732916693","https://openalex.org/W2765181145","https://openalex.org/W2784097977","https://openalex.org/W2792618813","https://openalex.org/W2800695847","https://openalex.org/W2922526186","https://openalex.org/W2964262883","https://openalex.org/W2972552958","https://openalex.org/W2996806689","https://openalex.org/W2998066361","https://openalex.org/W2998074434","https://openalex.org/W3029914026","https://openalex.org/W4319442612","https://openalex.org/W6608206699","https://openalex.org/W6732103485"],"related_works":["https://openalex.org/W2807886874","https://openalex.org/W2946613364","https://openalex.org/W1697346018","https://openalex.org/W2113326855","https://openalex.org/W611259847","https://openalex.org/W2354785495","https://openalex.org/W642986199","https://openalex.org/W2320858910","https://openalex.org/W1995118279","https://openalex.org/W4240624848"],"abstract_inverted_index":{"There":[0],"is":[1,32,263],"a":[2,54,86,113],"lack":[3],"of":[4,7,18,29,57,112,115,120,152,158,237,259],"scientific":[5,55],"testing":[6],"commercially":[8],"available":[9],"malware":[10,30,61,88],"detectors,":[11],"especially":[12,225],"those":[13],"that":[14,214],"boast":[15],"accurate":[16],"classification":[17],"never-before-seen":[19,82],"(i.e.,":[20],"zero-day)":[21],"files":[22,102,172],"using":[23],"machine":[24],"learning":[25],"(ML).":[26],"Consequently,":[27],"efficacy":[28],"detectors":[31],"opaque,":[33],"inhibiting":[34],"end":[35,251],"users":[36,252],"from":[37,43],"making":[38],"informed":[39],"decisions":[40],"and":[41,81,107,124,138,147,160,173,232,248],"researchers":[42,247],"targeting":[44],"gaps":[45],"in":[46],"current":[47],"detectors.":[48],"In":[49],"this":[50],"article,":[51],"we":[52,95],"present":[53,132],"evaluation":[56,156],"four":[58,216],"prominent":[59],"commercial":[60],"detection":[62,136,202],"tools":[63,77,145,165,187,217],"to":[64],"assist":[65],"an":[66,181],"organization":[67],"with":[68,194],"two":[69,149],"primary":[70],"questions:":[71],"To":[72,93],"what":[73],"extent":[74],"do":[75],"ML-based":[76,164],"accurately":[78],"classify":[79],"previously":[80],"files?":[83],"Is":[84],"purchasing":[85],"network-level":[87],"detector":[89],"worth":[90],"the":[91,153,163,175,260],"cost?":[92],"investigate,":[94],"tested":[96],"each":[97],"tool":[98,177],"against":[99],"3,536":[100],"total":[101],"(2,554":[103],"or":[104,109,209],"72%":[105],"malicious":[106,121],"982":[108],"28%":[110],"benign)":[111],"variety":[114],"file":[116,227],"types,":[117],"including":[118,239],"hundreds":[119],"zero-days,":[122],"polyglots,":[123],"APT-style":[125],"files,":[126,242],"delivered":[127],"on":[128,135,204,226],"multiple":[129,144],"protocols.":[130],"We":[131],"statistical":[133],"results":[134,212],"time":[137],"accuracy,":[139],"consider":[140],"complementary":[141],"analysis":[142],"(using":[143],"together),":[146],"provide":[148,188],"novel":[150],"applications":[151],"recent":[154],"cost\u2013benefit":[155],"procedure":[157],"Iannacone":[159],"Bridges.":[161],"Although":[162],"are":[166,253],"more":[167],"effective":[168],"at":[169],"detecting":[170],"zero-day":[171],"executables,":[174],"signature-based":[176],"might":[178],"still":[179],"be":[180],"overall":[182],"better":[183],"option.":[184],"Both":[185],"network-based":[186],"substantial":[189],"(simulated)":[190],"savings":[191],"when":[192],"paired":[193],"either":[195],"host":[196],"tool,":[197],"yet":[198],"both":[199],"show":[200,213],"poor":[201],"rates":[203],"protocols":[205],"other":[206,229],"than":[207,230],"HTTP":[208],"SMTP.":[210],"Our":[211],"all":[215,240],"have":[218],"near-perfect":[219],"precision":[220],"but":[221],"alarmingly":[222],"low":[223],"recall,":[224],"types":[228],"executables":[231],"office":[233],"files:":[234],"Thirty-seven":[235],"percent":[236],"malware,":[238],"polyglot":[241],"were":[243],"undetected.":[244],"Priorities":[245],"for":[246,250,256],"takeaways":[249],"given.":[254],"Code":[255],"future":[257],"use":[258],"cost":[261],"model":[262],"provided.":[264]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":2},{"year":2023,"cited_by_count":1}],"updated_date":"2026-07-14T08:27:34.040176","created_date":"2023-02-17T00:00:00"}