{"id":"https://openalex.org/W4389279105","doi":"https://doi.org/10.1145/3627106.3627139","title":"Binary Sight-Seeing: Accelerating Reverse Engineering via Point-of-Interest-Beacons","display_name":"Binary Sight-Seeing: Accelerating Reverse Engineering via Point-of-Interest-Beacons","publication_year":2023,"publication_date":"2023-12-02","ids":{"openalex":"https://openalex.org/W4389279105","doi":"https://doi.org/10.1145/3627106.3627139"},"language":"en","primary_location":{"id":"doi:10.1145/3627106.3627139","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3627106.3627139","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3627106.3627139","source":{"id":"https://openalex.org/S4306417673","display_name":"Annual Computer Security Applications Conference","issn_l":"1063-9527","issn":["1063-9527","2576-9103"],"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Annual Computer Security Applications Conference","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"bronze","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3627106.3627139","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5029633305","display_name":"Richard See","orcid":"https://orcid.org/0009-0003-9588-7096"},"institutions":[{"id":"https://openalex.org/I159176309","display_name":"Universit\u00e4t Hamburg","ror":"https://ror.org/00g30e956","country_code":"DE","type":"education","lineage":["https://openalex.org/I159176309"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Richard August See","raw_affiliation_strings":["Universit\u00e4t Hamburg, Germany"],"raw_orcid":"https://orcid.org/0009-0003-9588-7096","affiliations":[{"raw_affiliation_string":"Universit\u00e4t Hamburg, Germany","institution_ids":["https://openalex.org/I159176309"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5044185808","display_name":"Maximilian Gehring","orcid":"https://orcid.org/0009-0004-5599-5807"},"institutions":[{"id":"https://openalex.org/I31512782","display_name":"Technische Universit\u00e4t Darmstadt","ror":"https://ror.org/05n911h24","country_code":"DE","type":"education","lineage":["https://openalex.org/I31512782"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Maximilian Gehring","raw_affiliation_strings":["TU Darmstadt, Germany"],"raw_orcid":"https://orcid.org/0009-0004-5599-5807","affiliations":[{"raw_affiliation_string":"TU Darmstadt, Germany","institution_ids":["https://openalex.org/I31512782"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5033270363","display_name":"Mathias Fischer","orcid":"https://orcid.org/0000-0002-6254-8288"},"institutions":[{"id":"https://openalex.org/I159176309","display_name":"Universit\u00e4t Hamburg","ror":"https://ror.org/00g30e956","country_code":"DE","type":"education","lineage":["https://openalex.org/I159176309"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Mathias Fischer","raw_affiliation_strings":["Universit\u00e4t Hamburg, Germany"],"raw_orcid":"https://orcid.org/0000-0002-6254-8288","affiliations":[{"raw_affiliation_string":"Universit\u00e4t Hamburg, Germany","institution_ids":["https://openalex.org/I159176309"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5054341757","display_name":"Shankar Karuppayah","orcid":"https://orcid.org/0000-0003-4801-6370"},"institutions":[{"id":"https://openalex.org/I139322472","display_name":"Universiti Sains Malaysia","ror":"https://ror.org/02rgb2k63","country_code":"MY","type":"education","lineage":["https://openalex.org/I139322472"]}],"countries":["MY"],"is_corresponding":false,"raw_author_name":"Shankar Karuppayah","raw_affiliation_strings":["National Advanced IPv6 Centre, Universiti Sains Malaysia, Malaysia"],"raw_orcid":"https://orcid.org/0000-0003-4801-6370","affiliations":[{"raw_affiliation_string":"National Advanced IPv6 Centre, Universiti Sains Malaysia, Malaysia","institution_ids":["https://openalex.org/I139322472"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.2414,"has_fulltext":true,"cited_by_count":1,"citation_normalized_percentile":{"value":0.48125146,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":91,"max":95},"biblio":{"volume":null,"issue":null,"first_page":"594","last_page":"608"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9980999827384949,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.996399998664856,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/reverse-engineering","display_name":"Reverse engineering","score":0.8948221802711487},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8272548913955688},{"id":"https://openalex.org/keywords/beacon","display_name":"Beacon","score":0.7429919242858887},{"id":"https://openalex.org/keywords/malware-analysis","display_name":"Malware analysis","score":0.5785502791404724},{"id":"https://openalex.org/keywords/executable","display_name":"Executable","score":0.563676118850708},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.558735191822052},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.5559723377227783},{"id":"https://openalex.org/keywords/plug-in","display_name":"Plug-in","score":0.44554367661476135},{"id":"https://openalex.org/keywords/obfuscation","display_name":"Obfuscation","score":0.4151771664619446},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.29653412103652954},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.21972787380218506},{"id":"https://openalex.org/keywords/real-time-computing","display_name":"Real-time computing","score":0.199567049741745}],"concepts":[{"id":"https://openalex.org/C207850805","wikidata":"https://www.wikidata.org/wiki/Q269608","display_name":"Reverse engineering","level":2,"score":0.8948221802711487},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8272548913955688},{"id":"https://openalex.org/C102168758","wikidata":"https://www.wikidata.org/wiki/Q7321258","display_name":"Beacon","level":2,"score":0.7429919242858887},{"id":"https://openalex.org/C2779395397","wikidata":"https://www.wikidata.org/wiki/Q15731404","display_name":"Malware analysis","level":3,"score":0.5785502791404724},{"id":"https://openalex.org/C160145156","wikidata":"https://www.wikidata.org/wiki/Q778586","display_name":"Executable","level":2,"score":0.563676118850708},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.558735191822052},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.5559723377227783},{"id":"https://openalex.org/C4924752","wikidata":"https://www.wikidata.org/wiki/Q184148","display_name":"Plug-in","level":2,"score":0.44554367661476135},{"id":"https://openalex.org/C40305131","wikidata":"https://www.wikidata.org/wiki/Q2616305","display_name":"Obfuscation","level":2,"score":0.4151771664619446},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.29653412103652954},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.21972787380218506},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.199567049741745}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3627106.3627139","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3627106.3627139","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3627106.3627139","source":{"id":"https://openalex.org/S4306417673","display_name":"Annual Computer Security Applications Conference","issn_l":"1063-9527","issn":["1063-9527","2576-9103"],"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Annual Computer Security Applications Conference","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3627106.3627139","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3627106.3627139","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3627106.3627139","source":{"id":"https://openalex.org/S4306417673","display_name":"Annual Computer Security Applications Conference","issn_l":"1063-9527","issn":["1063-9527","2576-9103"],"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Annual Computer Security Applications Conference","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320322757","display_name":"Universiti Sains Malaysia","ror":"https://ror.org/02rgb2k63"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4389279105.pdf","grobid_xml":"https://content.openalex.org/works/W4389279105.grobid-xml"},"referenced_works_count":19,"referenced_works":["https://openalex.org/W1553308705","https://openalex.org/W1599703308","https://openalex.org/W1987535082","https://openalex.org/W1999687070","https://openalex.org/W2024170198","https://openalex.org/W2060692877","https://openalex.org/W2089745089","https://openalex.org/W2131875129","https://openalex.org/W2138788987","https://openalex.org/W2215262239","https://openalex.org/W2533311740","https://openalex.org/W2560252021","https://openalex.org/W2582379727","https://openalex.org/W2782618049","https://openalex.org/W2804073276","https://openalex.org/W2893346372","https://openalex.org/W4239813889","https://openalex.org/W4248166950","https://openalex.org/W6751899208"],"related_works":["https://openalex.org/W2913519194","https://openalex.org/W2007287520","https://openalex.org/W2132360941","https://openalex.org/W4362634109","https://openalex.org/W2055981842","https://openalex.org/W4388820743","https://openalex.org/W2793135307","https://openalex.org/W2532550198","https://openalex.org/W3134235726","https://openalex.org/W2906395579"],"abstract_inverted_index":{"Reverse":[0],"engineering":[1],"is":[2],"still":[3],"a":[4,34,50,74,120,143,203,210],"largely":[5],"manual":[6,221],"and":[7,155,185,238,241],"very":[8,45],"time-consuming":[9],"process.":[10],"To":[11],"ease":[12],"this":[13,246],"process,":[14],"beacons":[15,42,89],"in":[16,32,60,209,245,257,272],"the":[17,56,71,98,103,107,160,167,173,177,180,183,191,216,225,234,254,258,270],"form":[18],"of":[19,97,140,159,169,179,190,227],"known":[20,73],"instructions":[21,64],"or":[22,80],"code":[23],"patterns":[24],"are":[25,63,85],"commonly":[26],"used":[27,87],"to":[28,53,90,93,111,233],"guide":[29,91],"reverse":[30,197],"engineers":[31],"dissecting":[33],"binary.":[35],"However,":[36],"if":[37],"done":[38],"manually,":[39],"identifying":[40],"high-quality":[41,124],"can":[43,147],"be":[44,148],"laborious.":[46],"This":[47],"paper":[48],"introduces":[49],"novel":[51],"method":[52,171],"automatically":[54],"identify":[55],"so-called":[57],"Points-of-Interests":[58],"(POIs)":[59],"binaries.":[61],"POIs":[62,84],"that":[65,100,205],"interact":[66,101],"with":[67,102],"data":[68],"specified":[69,104],"by":[70,175,213,230],"analyst":[72],"priori,":[75],"e.g.,":[76,106],"via":[77,150,172],"sandbox":[78],"analysis":[79,181],"expert":[81],"knowledge.":[82],"These":[83],"then":[86],"as":[88,188],"analysts":[92],"find":[94],"interesting":[95],"parts":[96],"binary":[99],"data,":[105],"encryption":[108,255],"routine.":[109],"Compared":[110],"taint":[112],"analysis,":[113],"our":[114,133,170,228,243,249,265,279],"approach":[115],"offers":[116],"simplicity":[117],"while":[118],"delivering":[119],"select":[121],"few,":[122],"yet":[123],"beacons,":[125],"thereby":[126],"establishing":[127],"clear":[128],"focus":[129],"points.":[130],"Based":[131],"on":[132,278],"proposed":[134],"method,":[135],"we":[136,200,251],"implemented":[137],"two":[138,158,259],"types":[139],"prototypes.":[141],"First,":[142],"prototype":[144,174,204,229,267],"whose":[145],"output":[146],"loaded":[149],"custom":[151],"plugins":[152],"into":[153],"IDA":[154],"Ghidra,":[156],"i.e.,":[157,195],"more":[161],"popular":[162],"reverse-engineering":[163],"tools.":[164],"We":[165,223],"show":[166],"applicability":[168],"summarizing":[176],"insights":[178],"for":[182],"Locky":[184],"Wannacry":[186],"ransomware":[187],"one":[189],"potential":[192],"application":[193],"domains,":[194],"malware":[196,218],"engineering.":[198],"Second,":[199],"also":[201],"introduced":[202],"monitors":[206],"P2P":[207,263],"botnets":[208,240],"fully-automated":[211],"manner":[212],"directly":[214],"instrumenting":[215],"botnet":[217],"without":[219],"requiring":[220],"reverse-engineering.":[222],"demonstrate":[224],"effectiveness":[226],"applying":[231],"it":[232],"ZeroAccess,":[235],"Sality,":[236],"Nugache,":[237],"Kelihos":[239],"summarize":[242],"findings":[244],"paper.":[247],"Using":[248],"approach,":[250],"effortlessly":[252],"found":[253],"function":[256],"analyzed":[260,274],"ransomware.":[261],"For":[262],"botnets,":[264,275],"monitoring":[266],"could":[268],"enumerate":[269],"bots":[271],"all":[273],"only":[276],"relying":[277],"POIs.":[280]},"counts_by_year":[{"year":2025,"cited_by_count":1}],"updated_date":"2026-07-31T08:31:51.225901","created_date":"2025-10-10T00:00:00"}