{"id":"https://openalex.org/W4388867297","doi":"https://doi.org/10.1145/3576915.3616625","title":"PackGenome: Automatically Generating Robust YARA Rules for Accurate Malware Packer Detection","display_name":"PackGenome: Automatically Generating Robust YARA Rules for Accurate Malware Packer Detection","publication_year":2023,"publication_date":"2023-11-15","ids":{"openalex":"https://openalex.org/W4388867297","doi":"https://doi.org/10.1145/3576915.3616625"},"language":"en","primary_location":{"id":"doi:10.1145/3576915.3616625","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3576915.3616625","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5084419890","display_name":"Shijia Li","orcid":"https://orcid.org/0000-0002-3527-1332"},"institutions":[{"id":"https://openalex.org/I205237279","display_name":"Nankai University","ror":"https://ror.org/01y1kjr75","country_code":"CN","type":"education","lineage":["https://openalex.org/I205237279"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Shijia Li","raw_affiliation_strings":["Nankai University, TKLNDST, & DISSEC, Tianjin, China"],"raw_orcid":"https://orcid.org/0000-0002-3527-1332","affiliations":[{"raw_affiliation_string":"Nankai University, TKLNDST, & DISSEC, Tianjin, China","institution_ids":["https://openalex.org/I205237279"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101420644","display_name":"Jiang Ming","orcid":"https://orcid.org/0000-0001-9682-0502"},"institutions":[{"id":"https://openalex.org/I114832834","display_name":"Tulane University","ror":"https://ror.org/04vmvtb21","country_code":"US","type":"education","lineage":["https://openalex.org/I114832834"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jiang Ming","raw_affiliation_strings":["Tulane University, New Orleans, LA, USA"],"raw_orcid":"https://orcid.org/0000-0001-9682-0502","affiliations":[{"raw_affiliation_string":"Tulane University, New Orleans, LA, USA","institution_ids":["https://openalex.org/I114832834"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5035619910","display_name":"Pengda Qiu","orcid":"https://orcid.org/0009-0004-4073-1649"},"institutions":[{"id":"https://openalex.org/I205237279","display_name":"Nankai University","ror":"https://ror.org/01y1kjr75","country_code":"CN","type":"education","lineage":["https://openalex.org/I205237279"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Pengda Qiu","raw_affiliation_strings":["Nankai University, TKLNDST, & DISSEC, Tianjin, China"],"raw_orcid":"https://orcid.org/0009-0004-4073-1649","affiliations":[{"raw_affiliation_string":"Nankai University, TKLNDST, & DISSEC, Tianjin, China","institution_ids":["https://openalex.org/I205237279"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5064817291","display_name":"Qiantong Chen","orcid":"https://orcid.org/0009-0009-7165-2800"},"institutions":[{"id":"https://openalex.org/I205237279","display_name":"Nankai University","ror":"https://ror.org/01y1kjr75","country_code":"CN","type":"education","lineage":["https://openalex.org/I205237279"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Qiyuan Chen","raw_affiliation_strings":["Nankai University, TKLNDST, & DISSEC, Tianjin, China"],"raw_orcid":"https://orcid.org/0009-0009-7165-2800","affiliations":[{"raw_affiliation_string":"Nankai University, TKLNDST, & DISSEC, Tianjin, China","institution_ids":["https://openalex.org/I205237279"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5117823147","display_name":"Lanqing Liu","orcid":"https://orcid.org/0009-0007-7838-7101"},"institutions":[{"id":"https://openalex.org/I205237279","display_name":"Nankai University","ror":"https://ror.org/01y1kjr75","country_code":"CN","type":"education","lineage":["https://openalex.org/I205237279"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Lanqing Liu","raw_affiliation_strings":["Nankai University, TKLNDST, & DISSEC, Tianjin, China"],"raw_orcid":"https://orcid.org/0009-0007-7838-7101","affiliations":[{"raw_affiliation_string":"Nankai University, TKLNDST, & DISSEC, Tianjin, China","institution_ids":["https://openalex.org/I205237279"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5035091617","display_name":"Huaifeng Bao","orcid":"https://orcid.org/0000-0002-9657-3633"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Huaifeng Bao","raw_affiliation_strings":["SKLOIS, IIE, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-9657-3633","affiliations":[{"raw_affiliation_string":"SKLOIS, IIE, Beijing, China","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100367053","display_name":"Qiang Wang","orcid":"https://orcid.org/0000-0003-1115-2387"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Qiang Wang","raw_affiliation_strings":["SKLOIS, IIE, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0003-1115-2387","affiliations":[{"raw_affiliation_string":"SKLOIS, IIE, Beijing, China","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5005646333","display_name":"Chunfu Jia","orcid":"https://orcid.org/0000-0002-5588-9690"},"institutions":[{"id":"https://openalex.org/I205237279","display_name":"Nankai University","ror":"https://ror.org/01y1kjr75","country_code":"CN","type":"education","lineage":["https://openalex.org/I205237279"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Chunfu Jia","raw_affiliation_strings":["Nankai University, TKLNDST, & DISSEC, Tianjin, China"],"raw_orcid":"https://orcid.org/0000-0002-5588-9690","affiliations":[{"raw_affiliation_string":"Nankai University, TKLNDST, & DISSEC, Tianjin, China","institution_ids":["https://openalex.org/I205237279"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":11,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"3078","last_page":"3092"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9977999925613403,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9955999851226807,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.9075874090194702},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8157222270965576},{"id":"https://openalex.org/keywords/obfuscation","display_name":"Obfuscation","score":0.8148097991943359},{"id":"https://openalex.org/keywords/byte","display_name":"Byte","score":0.6671087145805359},{"id":"https://openalex.org/keywords/signature","display_name":"Signature (topology)","score":0.6535733342170715},{"id":"https://openalex.org/keywords/false-positive-paradox","display_name":"False positive paradox","score":0.6478573679924011},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.4623386263847351},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.44716769456863403},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.3424398899078369},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.26436707377433777},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.14636129140853882},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.07547891139984131}],"concepts":[{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.9075874090194702},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8157222270965576},{"id":"https://openalex.org/C40305131","wikidata":"https://www.wikidata.org/wiki/Q2616305","display_name":"Obfuscation","level":2,"score":0.8148097991943359},{"id":"https://openalex.org/C43364308","wikidata":"https://www.wikidata.org/wiki/Q8799","display_name":"Byte","level":2,"score":0.6671087145805359},{"id":"https://openalex.org/C2779696439","wikidata":"https://www.wikidata.org/wiki/Q7512811","display_name":"Signature (topology)","level":2,"score":0.6535733342170715},{"id":"https://openalex.org/C64869954","wikidata":"https://www.wikidata.org/wiki/Q1859747","display_name":"False positive paradox","level":2,"score":0.6478573679924011},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.4623386263847351},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.44716769456863403},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3424398899078369},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.26436707377433777},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.14636129140853882},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.07547891139984131},{"id":"https://openalex.org/C2524010","wikidata":"https://www.wikidata.org/wiki/Q8087","display_name":"Geometry","level":1,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3576915.3616625","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3576915.3616625","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.8100000023841858,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[{"id":"https://openalex.org/G67964675","display_name":null,"funder_award_id":"2019YJSS092","funder_id":"https://openalex.org/F4320336754","funder_display_name":"Tianjin Research Innovation Project for Postgraduate Students"},{"id":"https://openalex.org/G8678592975","display_name":null,"funder_award_id":"62172238, 61972215, and 61972073","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320336754","display_name":"Tianjin Research Innovation Project for Postgraduate Students","ror":null}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":26,"referenced_works":["https://openalex.org/W1508225132","https://openalex.org/W1981033991","https://openalex.org/W2010417554","https://openalex.org/W2012737144","https://openalex.org/W2077747890","https://openalex.org/W2110599247","https://openalex.org/W2150423842","https://openalex.org/W2414803796","https://openalex.org/W2596953812","https://openalex.org/W2601109766","https://openalex.org/W2620946705","https://openalex.org/W2752395945","https://openalex.org/W2794801050","https://openalex.org/W2890434219","https://openalex.org/W2947883149","https://openalex.org/W3007070494","https://openalex.org/W3008443984","https://openalex.org/W3084078945","https://openalex.org/W3105646798","https://openalex.org/W3108921945","https://openalex.org/W3111894367","https://openalex.org/W3168148707","https://openalex.org/W3213145987","https://openalex.org/W4226519994","https://openalex.org/W4239813889","https://openalex.org/W4284881142"],"related_works":["https://openalex.org/W2620652965","https://openalex.org/W2024170198","https://openalex.org/W4296272594","https://openalex.org/W2900526031","https://openalex.org/W2289039654","https://openalex.org/W2728713145","https://openalex.org/W2470502009","https://openalex.org/W2131332603","https://openalex.org/W2072617132","https://openalex.org/W4360993664"],"abstract_inverted_index":{"Binary":[0],"packing,":[1],"a":[2],"widely-used":[3],"program":[4,12],"obfuscation":[5],"style,":[6],"compresses":[7],"or":[8,57],"encrypts":[9],"the":[10,98],"original":[11],"and":[13],"then":[14],"recovers":[15],"it":[16],"at":[17],"runtime.":[18],"Packed":[19],"malware":[20,62],"samples":[21],"are":[22,94,106],"pervasive---they":[23],"conceal":[24],"arresting":[25],"code":[26],"features":[27],"as":[28,92],"unintelligible":[29],"data":[30],"to":[31,37,47,61,77,96,109],"evade":[32],"detection.":[33],"To":[34],"rapidly":[35],"respond":[36],"large-scale":[38],"packed":[39],"malware,":[40],"security":[41],"analysts":[42],"search":[43,97],"specific":[44],"binary":[45],"patterns":[46,56],"identify":[48],"corresponding":[49],"packers.":[50],"The":[51],"quality":[52],"of":[53,100],"such":[54],"packer":[55,66],"signatures":[58],"is":[59],"vital":[60],"dissection.":[63],"However,":[64],"existing":[65],"signature":[67],"rules":[68,83],"severely":[69],"rely":[70],"on":[71],"human":[72],"analysts'":[73],"experience.":[74],"In":[75],"addition":[76],"expensive":[78],"manual":[79],"efforts,":[80],"these":[81],"human-written":[82],"(e.g.,":[84],"YARA)":[85],"also":[86],"suffer":[87],"from":[88],"high":[89],"false":[90],"positives:":[91],"they":[93,105],"designed":[95],"pattern":[99],"bytes":[101],"rather":[102],"than":[103],"instructions,":[104],"very":[107],"likely":[108],"mismatch":[110],"with":[111],"unexpected":[112],"instructions.":[113]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":5},{"year":2024,"cited_by_count":5}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}