{"id":"https://openalex.org/W4385692196","doi":"https://doi.org/10.1145/3600160.3605010","title":"Bypassing antivirus detection: old-school malware, new tricks","display_name":"Bypassing antivirus detection: old-school malware, new tricks","publication_year":2023,"publication_date":"2023-08-09","ids":{"openalex":"https://openalex.org/W4385692196","doi":"https://doi.org/10.1145/3600160.3605010"},"language":"en","primary_location":{"id":"doi:10.1145/3600160.3605010","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3600160.3605010","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3600160.3605010","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 18th International Conference on Availability, Reliability and Security","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3600160.3605010","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5087799945","display_name":"Efstratios Chatzoglou","orcid":"https://orcid.org/0000-0001-6507-5052"},"institutions":[{"id":"https://openalex.org/I98805295","display_name":"University of the Aegean","ror":"https://ror.org/03zsp3p94","country_code":"GR","type":"education","lineage":["https://openalex.org/I98805295"]}],"countries":["GR"],"is_corresponding":false,"raw_author_name":"Efstratios Chatzoglou","raw_affiliation_strings":["University of the Aegean, Greece"],"raw_orcid":"https://orcid.org/0000-0001-6507-5052","affiliations":[{"raw_affiliation_string":"University of the Aegean, Greece","institution_ids":["https://openalex.org/I98805295"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5038882355","display_name":"\u0393\u03b5\u03ce\u03c1\u03b3\u03b9\u03bf\u03c2 \u039a\u03b1\u03c1\u03cc\u03c0\u03bf\u03c5\u03bb\u03bf\u03c2","orcid":"https://orcid.org/0000-0002-0142-7503"},"institutions":[{"id":"https://openalex.org/I4210118689","display_name":"Joint Research Centre","ror":"https://ror.org/02qezmz13","country_code":"IT","type":"government","lineage":["https://openalex.org/I1320481043","https://openalex.org/I2800387288","https://openalex.org/I4210118689","https://openalex.org/I4210161702"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Georgios Karopoulos","raw_affiliation_strings":["European Commission, Joint Research Centre (JRC), Italy"],"raw_orcid":"https://orcid.org/0000-0002-0142-7503","affiliations":[{"raw_affiliation_string":"European Commission, Joint Research Centre (JRC), Italy","institution_ids":["https://openalex.org/I4210118689"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5047345306","display_name":"Georgios Kambourakis","orcid":"https://orcid.org/0000-0001-6348-5031"},"institutions":[{"id":"https://openalex.org/I98805295","display_name":"University of the Aegean","ror":"https://ror.org/03zsp3p94","country_code":"GR","type":"education","lineage":["https://openalex.org/I98805295"]}],"countries":["GR"],"is_corresponding":false,"raw_author_name":"Georgios Kambourakis","raw_affiliation_strings":["University of the Aegean, Greece"],"raw_orcid":"https://orcid.org/0000-0001-6348-5031","affiliations":[{"raw_affiliation_string":"University of the Aegean, Greece","institution_ids":["https://openalex.org/I98805295"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5069801003","display_name":"Zisis Tsiatsikas","orcid":"https://orcid.org/0000-0002-9481-0906"},"institutions":[{"id":"https://openalex.org/I98805295","display_name":"University of the Aegean","ror":"https://ror.org/03zsp3p94","country_code":"GR","type":"education","lineage":["https://openalex.org/I98805295"]}],"countries":["GR"],"is_corresponding":false,"raw_author_name":"Zisis Tsiatsikas","raw_affiliation_strings":["University of the Aegean, Greece"],"raw_orcid":"https://orcid.org/0000-0002-9481-0906","affiliations":[{"raw_affiliation_string":"University of the Aegean, Greece","institution_ids":["https://openalex.org/I98805295"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":2.8935,"has_fulltext":true,"cited_by_count":12,"citation_normalized_percentile":{"value":0.93895008,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":90,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"10"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9983000159263611,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9941999912261963,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.9514890313148499},{"id":"https://openalex.org/keywords/evasion","display_name":"Evasion (ethics)","score":0.7873057126998901},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.7400448322296143},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7005217671394348},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.6576992273330688},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.6183781027793884},{"id":"https://openalex.org/keywords/hacker","display_name":"Hacker","score":0.5559932589530945},{"id":"https://openalex.org/keywords/executable","display_name":"Executable","score":0.5324146747589111},{"id":"https://openalex.org/keywords/cryptovirology","display_name":"Cryptovirology","score":0.5190285444259644},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.2672639489173889}],"concepts":[{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.9514890313148499},{"id":"https://openalex.org/C2781251061","wikidata":"https://www.wikidata.org/wiki/Q5416089","display_name":"Evasion (ethics)","level":3,"score":0.7873057126998901},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.7400448322296143},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7005217671394348},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6576992273330688},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.6183781027793884},{"id":"https://openalex.org/C86844869","wikidata":"https://www.wikidata.org/wiki/Q2798820","display_name":"Hacker","level":2,"score":0.5559932589530945},{"id":"https://openalex.org/C160145156","wikidata":"https://www.wikidata.org/wiki/Q778586","display_name":"Executable","level":2,"score":0.5324146747589111},{"id":"https://openalex.org/C84525096","wikidata":"https://www.wikidata.org/wiki/Q3506050","display_name":"Cryptovirology","level":3,"score":0.5190285444259644},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.2672639489173889},{"id":"https://openalex.org/C151730666","wikidata":"https://www.wikidata.org/wiki/Q7205","display_name":"Paleontology","level":1,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C8891405","wikidata":"https://www.wikidata.org/wiki/Q1059","display_name":"Immune system","level":2,"score":0.0},{"id":"https://openalex.org/C203014093","wikidata":"https://www.wikidata.org/wiki/Q101929","display_name":"Immunology","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3600160.3605010","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3600160.3605010","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3600160.3605010","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 18th International Conference on Availability, Reliability and Security","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3600160.3605010","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3600160.3605010","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3600160.3605010","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 18th International Conference on Availability, Reliability and Security","raw_type":"proceedings-article"},"sustainable_development_goals":[{"score":0.7400000095367432,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4385692196.pdf","grobid_xml":"https://content.openalex.org/works/W4385692196.grobid-xml"},"referenced_works_count":12,"referenced_works":["https://openalex.org/W2024170198","https://openalex.org/W2089735638","https://openalex.org/W2158557632","https://openalex.org/W2774161712","https://openalex.org/W2790484531","https://openalex.org/W2923511423","https://openalex.org/W2988961468","https://openalex.org/W3092771185","https://openalex.org/W4225935968","https://openalex.org/W4312843618","https://openalex.org/W4328101204","https://openalex.org/W4366590248"],"related_works":["https://openalex.org/W1995118279","https://openalex.org/W4240624848","https://openalex.org/W4249009605","https://openalex.org/W2900526031","https://openalex.org/W4256304280","https://openalex.org/W4387298227","https://openalex.org/W2470029541","https://openalex.org/W4387065217","https://openalex.org/W2470502009","https://openalex.org/W4368275542"],"abstract_inverted_index":{"Being":[0],"on":[1,15,47],"a":[2,12,19,55,90],"mushrooming":[3],"spree":[4],"since":[5],"at":[6],"least":[7],"2013,":[8],"malware":[9,25,76,156],"can":[10],"take":[11],"large":[13],"toll":[14],"any":[16],"system.":[17],"In":[18,43],"perpetual":[20],"cat-and-mouse":[21],"chase":[22],"with":[23],"defenders,":[24],"writers":[26],"constantly":[27],"conjure":[28],"new":[29],"methods":[30],"to":[31,37,124,149],"hide":[32],"their":[33],"code":[34],"so":[35],"as":[36],"evade":[38],"detection":[39,61,69,134],"by":[40],"security":[41],"products.":[42],"this":[44,52],"context,":[45],"focusing":[46],"the":[48,60,114,117,142,155,163,169,176],"MS":[49],"Windows":[50],"platform,":[51],"work":[53],"contributes":[54],"comprehensive":[56],"empirical":[57],"evaluation":[58],"regarding":[59,113],"capacity":[62],"of":[63,92,116,133,141,154,162,168,175],"popular,":[64],"off-the-shelf":[65],"antivirus":[66],"and":[67,70,105],"endpoint":[68],"response":[71],"engines":[72,146],"when":[73],"facing":[74],"legacy":[75],"obfuscated":[77],"via":[78],"more":[79],"or":[80],"less":[81,151],"uncommon":[82],"but":[83,173],"publicly":[84],"known":[85],"methods.":[86],"Our":[87],"experiments":[88],"exploit":[89],"blend":[91],"seven":[93],"traditional":[94],"AV":[95,145],"evasion":[96],"techniques":[97],"in":[98,102,120,131],"16":[99],"executables":[100],"built":[101],"C++,":[103],"Go,":[104],"Rust.":[106],"Furthermore,":[107],"we":[108],"conduct":[109],"an":[110],"incipient":[111],"study":[112],"ability":[115],"ChatGPT":[118],"chatbot":[119],"assisting":[121],"threat":[122],"actors":[123],"produce":[125],"ready-to-use":[126],"malware.":[127],"The":[128],"derived":[129],"results":[130],"terms":[132],"rate":[135],"are":[136],"highly":[137],"unexpected:":[138],"approximately":[139],"half":[140,153,161],"12":[143],"tested":[144],"were":[147],"able":[148],"detect":[150],"than":[152],"variants,":[157,164],"four":[158],"AVs":[159],"exactly":[160],"while":[165],"only":[166],"two":[167],"rest":[170],"detected":[171],"all":[172],"one":[174],"variants.":[177]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":6},{"year":2024,"cited_by_count":3},{"year":2023,"cited_by_count":1}],"updated_date":"2026-07-31T08:31:51.225901","created_date":"2025-10-10T00:00:00"}