{"id":"https://openalex.org/W4389279138","doi":"https://doi.org/10.1145/3627106.3627178","title":"PSP-Mal: Evading Malware Detection via Prioritized Experience-based Reinforcement Learning with Shapley Prior","display_name":"PSP-Mal: Evading Malware Detection via Prioritized Experience-based Reinforcement Learning with Shapley Prior","publication_year":2023,"publication_date":"2023-12-02","ids":{"openalex":"https://openalex.org/W4389279138","doi":"https://doi.org/10.1145/3627106.3627178"},"language":"en","primary_location":{"id":"doi:10.1145/3627106.3627178","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3627106.3627178","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3627106.3627178","source":{"id":"https://openalex.org/S4306417673","display_name":"Annual Computer Security Applications Conference","issn_l":"1063-9527","issn":["1063-9527","2576-9103"],"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Annual Computer Security Applications Conference","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"bronze","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3627106.3627178","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5014299271","display_name":"Dazhi Zhan","orcid":"https://orcid.org/0000-0003-2766-3405"},"institutions":[{"id":"https://openalex.org/I4210163363","display_name":"PLA Army Engineering University","ror":"https://ror.org/05mgp8x93","country_code":"CN","type":"education","lineage":["https://openalex.org/I4210163363"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Dazhi Zhan","raw_affiliation_strings":["Army Engineering University of PLA, China"],"raw_orcid":"https://orcid.org/0000-0003-2766-3405","affiliations":[{"raw_affiliation_string":"Army Engineering University of PLA, China","institution_ids":["https://openalex.org/I4210163363"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5015896110","display_name":"Wei Bai","orcid":"https://orcid.org/0000-0002-9738-0112"},"institutions":[{"id":"https://openalex.org/I4210163363","display_name":"PLA Army Engineering University","ror":"https://ror.org/05mgp8x93","country_code":"CN","type":"education","lineage":["https://openalex.org/I4210163363"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Wei Bai","raw_affiliation_strings":["Army Engineering University of PLA, China"],"raw_orcid":"https://orcid.org/0000-0002-9738-0112","affiliations":[{"raw_affiliation_string":"Army Engineering University of PLA, China","institution_ids":["https://openalex.org/I4210163363"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100737898","display_name":"Xin Liu","orcid":"https://orcid.org/0000-0003-3051-4793"},"institutions":[{"id":"https://openalex.org/I4210163363","display_name":"PLA Army Engineering University","ror":"https://ror.org/05mgp8x93","country_code":"CN","type":"education","lineage":["https://openalex.org/I4210163363"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xin Liu","raw_affiliation_strings":["Army Engineering University of PLA, China"],"raw_orcid":"https://orcid.org/0000-0003-3051-4793","affiliations":[{"raw_affiliation_string":"Army Engineering University of PLA, China","institution_ids":["https://openalex.org/I4210163363"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5053458494","display_name":"Yue Hu","orcid":"https://orcid.org/0000-0002-8115-7020"},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yue Hu","raw_affiliation_strings":["National University of Defense Technology, China"],"raw_orcid":"https://orcid.org/0000-0002-8115-7020","affiliations":[{"raw_affiliation_string":"National University of Defense Technology, China","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5077474570","display_name":"Lei Zhang","orcid":"https://orcid.org/0000-0001-8746-1106"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Lei Zhang","raw_affiliation_strings":["Academy of Military Sciences, China"],"raw_orcid":"https://orcid.org/0000-0001-8746-1106","affiliations":[{"raw_affiliation_string":"Academy of Military Sciences, China","institution_ids":[]}]},{"author_position":"middle","author":{"id":null,"display_name":"Shize Guo","orcid":"https://orcid.org/0009-0007-9678-6632"},"institutions":[{"id":"https://openalex.org/I4210163363","display_name":"PLA Army Engineering University","ror":"https://ror.org/05mgp8x93","country_code":"CN","type":"education","lineage":["https://openalex.org/I4210163363"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Shize Guo","raw_affiliation_strings":["Army Engineering University of PLA, China"],"raw_orcid":"https://orcid.org/0009-0007-9678-6632","affiliations":[{"raw_affiliation_string":"Army Engineering University of PLA, China","institution_ids":["https://openalex.org/I4210163363"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5037669752","display_name":"Zhisong Pan","orcid":"https://orcid.org/0000-0001-8615-7313"},"institutions":[{"id":"https://openalex.org/I4210163363","display_name":"PLA Army Engineering University","ror":"https://ror.org/05mgp8x93","country_code":"CN","type":"education","lineage":["https://openalex.org/I4210163363"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhisong Pan","raw_affiliation_strings":["Army Engineering University of PLA, China"],"raw_orcid":"https://orcid.org/0000-0001-8615-7313","affiliations":[{"raw_affiliation_string":"Army Engineering University of PLA, China","institution_ids":["https://openalex.org/I4210163363"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.3037,"has_fulltext":true,"cited_by_count":6,"citation_normalized_percentile":{"value":0.83375565,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":90,"max":98},"biblio":{"volume":null,"issue":null,"first_page":"580","last_page":"593"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9991999864578247,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9535999894142151,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8179520964622498},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.7301880121231079},{"id":"https://openalex.org/keywords/reinforcement-learning","display_name":"Reinforcement learning","score":0.7179160118103027},{"id":"https://openalex.org/keywords/evasion","display_name":"Evasion (ethics)","score":0.6087712049484253},{"id":"https://openalex.org/keywords/black-box","display_name":"Black box","score":0.5998088717460632},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.5487844944000244},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.473141074180603},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.46909770369529724},{"id":"https://openalex.org/keywords/executable","display_name":"Executable","score":0.4521988034248352},{"id":"https://openalex.org/keywords/commit","display_name":"Commit","score":0.4186432957649231},{"id":"https://openalex.org/keywords/thompson-sampling","display_name":"Thompson sampling","score":0.41837477684020996},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.2974358797073364},{"id":"https://openalex.org/keywords/bayesian-probability","display_name":"Bayesian probability","score":0.09816375374794006}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8179520964622498},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.7301880121231079},{"id":"https://openalex.org/C97541855","wikidata":"https://www.wikidata.org/wiki/Q830687","display_name":"Reinforcement learning","level":2,"score":0.7179160118103027},{"id":"https://openalex.org/C2781251061","wikidata":"https://www.wikidata.org/wiki/Q5416089","display_name":"Evasion (ethics)","level":3,"score":0.6087712049484253},{"id":"https://openalex.org/C94966114","wikidata":"https://www.wikidata.org/wiki/Q29256","display_name":"Black box","level":2,"score":0.5998088717460632},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.5487844944000244},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.473141074180603},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.46909770369529724},{"id":"https://openalex.org/C160145156","wikidata":"https://www.wikidata.org/wiki/Q778586","display_name":"Executable","level":2,"score":0.4521988034248352},{"id":"https://openalex.org/C153180980","wikidata":"https://www.wikidata.org/wiki/Q19776675","display_name":"Commit","level":2,"score":0.4186432957649231},{"id":"https://openalex.org/C73602740","wikidata":"https://www.wikidata.org/wiki/Q7795822","display_name":"Thompson sampling","level":3,"score":0.41837477684020996},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.2974358797073364},{"id":"https://openalex.org/C107673813","wikidata":"https://www.wikidata.org/wiki/Q812534","display_name":"Bayesian probability","level":2,"score":0.09816375374794006},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C8891405","wikidata":"https://www.wikidata.org/wiki/Q1059","display_name":"Immune system","level":2,"score":0.0},{"id":"https://openalex.org/C203014093","wikidata":"https://www.wikidata.org/wiki/Q101929","display_name":"Immunology","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3627106.3627178","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3627106.3627178","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3627106.3627178","source":{"id":"https://openalex.org/S4306417673","display_name":"Annual Computer Security Applications Conference","issn_l":"1063-9527","issn":["1063-9527","2576-9103"],"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Annual Computer Security Applications Conference","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3627106.3627178","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3627106.3627178","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3627106.3627178","source":{"id":"https://openalex.org/S4306417673","display_name":"Annual Computer Security Applications Conference","issn_l":"1063-9527","issn":["1063-9527","2576-9103"],"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Annual Computer Security Applications Conference","raw_type":"proceedings-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions","score":0.6000000238418579}],"awards":[{"id":"https://openalex.org/G1226025691","display_name":null,"funder_award_id":"62076251","funder_id":"https://openalex.org/F4320323817","funder_display_name":"Universitas Brawijaya"},{"id":"https://openalex.org/G3367274174","display_name":null,"funder_award_id":"62106281","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G4683421875","display_name":null,"funder_award_id":"62076251","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320323817","display_name":"Universitas Brawijaya","ror":"https://ror.org/01wk3d929"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4389279138.pdf","grobid_xml":"https://content.openalex.org/works/W4389279138.grobid-xml"},"referenced_works_count":33,"referenced_works":["https://openalex.org/W1893133781","https://openalex.org/W1916732574","https://openalex.org/W1966948031","https://openalex.org/W1973403081","https://openalex.org/W2024170198","https://openalex.org/W2099053789","https://openalex.org/W2746553466","https://openalex.org/W2776884785","https://openalex.org/W2806076636","https://openalex.org/W2903774075","https://openalex.org/W2923951475","https://openalex.org/W2932977083","https://openalex.org/W2942795289","https://openalex.org/W2959169310","https://openalex.org/W2962700793","https://openalex.org/W2963165251","https://openalex.org/W2964301649","https://openalex.org/W2973628901","https://openalex.org/W3015481738","https://openalex.org/W3020273542","https://openalex.org/W3083694078","https://openalex.org/W3090219579","https://openalex.org/W3091896612","https://openalex.org/W3102543338","https://openalex.org/W3164220323","https://openalex.org/W3164891553","https://openalex.org/W3201016636","https://openalex.org/W3213482711","https://openalex.org/W4214483364","https://openalex.org/W4288072399","https://openalex.org/W4291474832","https://openalex.org/W4299301436","https://openalex.org/W4320477201"],"related_works":["https://openalex.org/W1995118279","https://openalex.org/W4240624848","https://openalex.org/W2783112941","https://openalex.org/W4387298227","https://openalex.org/W2526398307","https://openalex.org/W2470029541","https://openalex.org/W4387065217","https://openalex.org/W4310895554","https://openalex.org/W4368275542","https://openalex.org/W4285357721"],"abstract_inverted_index":{"With":[0],"the":[1,33,61,67,73,79,86,95,130,140,145,160,165,179,196,221],"widespread":[2],"application":[3],"of":[4,23,46,129,148,199,218],"machine":[5],"learning":[6,35],"techniques":[7],"in":[8,72,78,121,164],"malware":[9,53,113],"detection,":[10],"researchers":[11],"have":[12,30],"proposed":[13],"various":[14],"adversarial":[15,20],"attack":[16,197],"methods":[17,120],"to":[18,59,84,106,143,182,188],"generate":[19,107],"examples":[21],"(AEs)":[22],"malware,":[24],"thereby":[25],"evading":[26],"detection.":[27],"Previous":[28],"studies":[29],"shown":[31],"that":[32,209],"reinforcement":[34],"(RL)":[36],"framework":[37,81,116,201],"can":[38],"enable":[39],"black-box":[40,74,131],"attacks":[41],"by":[42,133],"performing":[43],"a":[44,100],"sequence":[45],"function-preserving":[47],"operations,":[48],"which":[49,76,186],"produces":[50],"functional":[51],"evasive":[52],"samples.":[54],"However,":[55],"it":[56],"is":[57,157,212],"difficult":[58],"obtain":[60],"useful":[62],"guidance":[63,163],"and":[64,98,137,176,191,205,227,231],"feedbacks":[65],"from":[66],"environment":[68],"for":[69],"agent":[70],"training":[71],"scenario,":[75],"results":[77,207],"RL":[80,102,166],"being":[82],"unable":[83],"learn":[85],"effective":[87,184],"evasion":[88,216],"policy.":[89],"In":[90],"this":[91],"paper,":[92],"we":[93,177],"propose":[94,139],"Shapley":[96,135,141,161],"prior":[97,142,162],"establish":[99],"prior-guidance-based":[101],"framework,":[103],"namely":[104],"PSP-Mal,":[105],"AEs":[108],"against":[109,220],"Portable":[110],"Executable":[111],"(PE)":[112],"detectors.":[114],"Our":[115],"improves":[117],"on":[118,225],"existing":[119],"three":[122],"aspects:":[123],"1)":[124],"We":[125,194],"explore":[126],"feature":[127],"effects":[128],"model":[132],"computing":[134],"values":[136],"further":[138],"represent":[144],"expected":[146],"impact":[147],"operations.":[149],"2)":[150],"A":[151],"novel":[152],"prioritized":[153],"experience":[154],"utilization":[155],"mechanism":[156],"established":[158],"regarding":[159],"framework.":[167],"3)":[168],"The":[169,215],"actions":[170],"are":[171],"expanded":[172],"into":[173],"item-content":[174],"pairs":[175],"use":[178],"Thompson":[180],"sampling":[181],"choose":[183],"content,":[185],"helps":[187],"reduce":[189],"randomness":[190],"ensure":[192],"repeatability.":[193],"compare":[195],"performance":[198],"our":[200,210],"with":[202],"other":[203],"methods,":[204],"experimental":[206],"demonstrate":[208],"algorithm":[211],"more":[213],"effective.":[214],"rates":[217],"PSP-Mal":[219],"LightGBM":[222],"models":[223],"trained":[224],"EMBER":[226],"SOREL-20M":[228],"reach":[229],"76.88%":[230],"72.03%,":[232],"respectively.":[233]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":3},{"year":2024,"cited_by_count":1}],"updated_date":"2026-07-31T08:31:51.225901","created_date":"2025-10-10T00:00:00"}