{"id":"https://openalex.org/W4414982131","doi":"https://doi.org/10.1145/3771542","title":"Toward a Robust Detection of PowerShell Malware against Code Mixing and Obfuscation by Using Sentence Transformer and Similarity Learning","display_name":"Toward a Robust Detection of PowerShell Malware against Code Mixing and Obfuscation by Using Sentence Transformer and Similarity Learning","publication_year":2025,"publication_date":"2025-10-09","ids":{"openalex":"https://openalex.org/W4414982131","doi":"https://doi.org/10.1145/3771542"},"language":"en","primary_location":{"id":"doi:10.1145/3771542","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3771542","pdf_url":null,"source":{"id":"https://openalex.org/S4210174050","display_name":"ACM Transactions on Privacy and Security","issn_l":"2471-2566","issn":["2471-2566","2471-2574"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by-nc","license_id":"https://openalex.org/licenses/cc-by-nc","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Privacy and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1145/3771542","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5008001911","display_name":"Zhiwei Fu","orcid":"https://orcid.org/0000-0002-2763-6186"},"institutions":[{"id":"https://openalex.org/I5023651","display_name":"McGill University","ror":"https://ror.org/01pxwe438","country_code":"CA","type":"education","lineage":["https://openalex.org/I5023651"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Zhiwei Fu","raw_affiliation_strings":["School of Information Studies, McGill University","No address"],"raw_orcid":"https://orcid.org/0000-0002-2763-6186","affiliations":[{"raw_affiliation_string":"School of Information Studies, McGill University","institution_ids":["https://openalex.org/I5023651"]},{"raw_affiliation_string":"No address","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5020758618","display_name":"Leo Song","orcid":null},"institutions":[{"id":"https://openalex.org/I204722609","display_name":"Queen's University","ror":"https://ror.org/02y72wh86","country_code":"CA","type":"education","lineage":["https://openalex.org/I204722609"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Leo Song","raw_affiliation_strings":["Queen's University","No address"],"raw_orcid":"https://orcid.org/0000-0002-1195-0007","affiliations":[{"raw_affiliation_string":"Queen's University","institution_ids":["https://openalex.org/I204722609"]},{"raw_affiliation_string":"No address","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5007693994","display_name":"Steven H. H. Ding","orcid":"https://orcid.org/0000-0003-4513-200X"},"institutions":[{"id":"https://openalex.org/I5023651","display_name":"McGill University","ror":"https://ror.org/01pxwe438","country_code":"CA","type":"education","lineage":["https://openalex.org/I5023651"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Steven Ding","raw_affiliation_strings":["School of Information Studies, McGill University","No address"],"raw_orcid":"https://orcid.org/0000-0003-4513-200X","affiliations":[{"raw_affiliation_string":"School of Information Studies, McGill University","institution_ids":["https://openalex.org/I5023651"]},{"raw_affiliation_string":"No address","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5084562071","display_name":"Furkan Alaca","orcid":"https://orcid.org/0000-0002-5709-7611"},"institutions":[{"id":"https://openalex.org/I204722609","display_name":"Queen's University","ror":"https://ror.org/02y72wh86","country_code":"CA","type":"education","lineage":["https://openalex.org/I204722609"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Furkan Alaca","raw_affiliation_strings":["School of Computing Science, Queen's University","No address"],"raw_orcid":"https://orcid.org/0000-0002-5709-7611","affiliations":[{"raw_affiliation_string":"School of Computing Science, Queen's University","institution_ids":["https://openalex.org/I204722609"]},{"raw_affiliation_string":"No address","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5109312743","display_name":"Sweta Acharya","orcid":"https://orcid.org/0000-0002-8716-8214"},"institutions":[{"id":"https://openalex.org/I204722609","display_name":"Queen's University","ror":"https://ror.org/02y72wh86","country_code":"CA","type":"education","lineage":["https://openalex.org/I204722609"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Sudipta Acharya","raw_affiliation_strings":["Queen's University","No address"],"raw_orcid":"https://orcid.org/0000-0002-8716-8214","affiliations":[{"raw_affiliation_string":"Queen's University","institution_ids":["https://openalex.org/I204722609"]},{"raw_affiliation_string":"No address","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.8049,"has_fulltext":false,"cited_by_count":2,"citation_normalized_percentile":{"value":0.86950883,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":97,"max":98},"biblio":{"volume":"28","issue":"4","first_page":"1","last_page":"23"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9993000030517578,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9988999962806702,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.7585999965667725},{"id":"https://openalex.org/keywords/obfuscation","display_name":"Obfuscation","score":0.7157999873161316},{"id":"https://openalex.org/keywords/scripting-language","display_name":"Scripting language","score":0.6552000045776367},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.4771000146865845},{"id":"https://openalex.org/keywords/scalability","display_name":"Scalability","score":0.43709999322891235},{"id":"https://openalex.org/keywords/sentence","display_name":"Sentence","score":0.4368000030517578},{"id":"https://openalex.org/keywords/classifier","display_name":"Classifier (UML)","score":0.42669999599456787},{"id":"https://openalex.org/keywords/header","display_name":"Header","score":0.4117000102996826},{"id":"https://openalex.org/keywords/sliding-window-protocol","display_name":"Sliding window protocol","score":0.39910000562667847}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8568999767303467},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.7585999965667725},{"id":"https://openalex.org/C40305131","wikidata":"https://www.wikidata.org/wiki/Q2616305","display_name":"Obfuscation","level":2,"score":0.7157999873161316},{"id":"https://openalex.org/C61423126","wikidata":"https://www.wikidata.org/wiki/Q187432","display_name":"Scripting language","level":2,"score":0.6552000045776367},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5447999835014343},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.4771000146865845},{"id":"https://openalex.org/C48044578","wikidata":"https://www.wikidata.org/wiki/Q727490","display_name":"Scalability","level":2,"score":0.43709999322891235},{"id":"https://openalex.org/C2777530160","wikidata":"https://www.wikidata.org/wiki/Q41796","display_name":"Sentence","level":2,"score":0.4368000030517578},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.42669999599456787},{"id":"https://openalex.org/C48105269","wikidata":"https://www.wikidata.org/wiki/Q1141160","display_name":"Header","level":2,"score":0.4117000102996826},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4034999907016754},{"id":"https://openalex.org/C102392041","wikidata":"https://www.wikidata.org/wiki/Q592860","display_name":"Sliding window protocol","level":3,"score":0.39910000562667847},{"id":"https://openalex.org/C2781251061","wikidata":"https://www.wikidata.org/wiki/Q5416089","display_name":"Evasion (ethics)","level":3,"score":0.35670000314712524},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.3375000059604645},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.3361999988555908},{"id":"https://openalex.org/C84525096","wikidata":"https://www.wikidata.org/wiki/Q3506050","display_name":"Cryptovirology","level":3,"score":0.33329999446868896},{"id":"https://openalex.org/C2778579508","wikidata":"https://www.wikidata.org/wiki/Q722192","display_name":"System call","level":2,"score":0.325300008058548},{"id":"https://openalex.org/C103278499","wikidata":"https://www.wikidata.org/wiki/Q254465","display_name":"Similarity (geometry)","level":3,"score":0.31450000405311584},{"id":"https://openalex.org/C199190896","wikidata":"https://www.wikidata.org/wiki/Q3509276","display_name":"Learning classifier system","level":3,"score":0.30970001220703125},{"id":"https://openalex.org/C519991488","wikidata":"https://www.wikidata.org/wiki/Q28865","display_name":"Python (programming language)","level":2,"score":0.30000001192092896},{"id":"https://openalex.org/C153083717","wikidata":"https://www.wikidata.org/wiki/Q6535263","display_name":"Leverage (statistics)","level":2,"score":0.29660001397132874},{"id":"https://openalex.org/C153258448","wikidata":"https://www.wikidata.org/wiki/Q1199743","display_name":"Gradient descent","level":3,"score":0.2892000079154968},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.2745000123977661},{"id":"https://openalex.org/C2780907237","wikidata":"https://www.wikidata.org/wiki/Q2986238","display_name":"Plagiarism detection","level":2,"score":0.26840001344680786},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.2662999927997589},{"id":"https://openalex.org/C2779696439","wikidata":"https://www.wikidata.org/wiki/Q7512811","display_name":"Signature (topology)","level":2,"score":0.2653999924659729},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.26249998807907104},{"id":"https://openalex.org/C206688291","wikidata":"https://www.wikidata.org/wiki/Q7617819","display_name":"Stochastic gradient descent","level":3,"score":0.2621000111103058},{"id":"https://openalex.org/C2778751112","wikidata":"https://www.wikidata.org/wiki/Q835016","display_name":"Window (computing)","level":2,"score":0.257999986410141},{"id":"https://openalex.org/C114289077","wikidata":"https://www.wikidata.org/wiki/Q3284399","display_name":"Statistical model","level":2,"score":0.2549999952316284}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3771542","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3771542","pdf_url":null,"source":{"id":"https://openalex.org/S4210174050","display_name":"ACM Transactions on Privacy and Security","issn_l":"2471-2566","issn":["2471-2566","2471-2574"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by-nc","license_id":"https://openalex.org/licenses/cc-by-nc","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Privacy and Security","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1145/3771542","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3771542","pdf_url":null,"source":{"id":"https://openalex.org/S4210174050","display_name":"ACM Transactions on Privacy and Security","issn_l":"2471-2566","issn":["2471-2566","2471-2574"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by-nc","license_id":"https://openalex.org/licenses/cc-by-nc","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Privacy and Security","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":15,"referenced_works":["https://openalex.org/W377362545","https://openalex.org/W2158698691","https://openalex.org/W2553682957","https://openalex.org/W2627491027","https://openalex.org/W2941205140","https://openalex.org/W3091934055","https://openalex.org/W3098605233","https://openalex.org/W3148862282","https://openalex.org/W3163821226","https://openalex.org/W3202712981","https://openalex.org/W4225293062","https://openalex.org/W4255387151","https://openalex.org/W4307570965","https://openalex.org/W4391069661","https://openalex.org/W4413832322"],"related_works":[],"abstract_inverted_index":{"Embedded":[0],"PowerShell":[1,38,126,234],"commands":[2,41,58],"or":[3,155],"scripts":[4,39],"are":[5,59,77],"among":[6],"the":[7,67,151,185,192],"most":[8],"popular":[9],"malware":[10,13,235],"payloads.":[11],"For":[12],"that":[14,124,168],"prioritizes":[15],"stealthiness,":[16],"such":[17],"as":[18],"fileless":[19],"malware,":[20],"PowerShell\u2019s":[21],"access":[22],"to":[23,51,175,187],"Windows":[24],"API":[25],"functions":[26],"without":[27,150],"additional":[28],"libraries":[29],"makes":[30],"it":[31],"useful":[32],"for":[33,46,153,232],"evading":[34],"detection.":[35],"Detecting":[36],"malicious":[37,57,125],"and":[40,114,133,140,191,206,211,229],"is":[42,123],"an":[43],"open":[44],"challenge":[45],"proactive":[47],"endpoint":[48],"protection":[49],"due":[50,174],"three":[52],"major":[53],"issues:":[54],"(1)":[55],"The":[56,180],"usually":[60,78],"hidden":[61],"in":[62,221,237],"a":[63,99,163,227],"long":[64,189],"script":[65,213],"beyond":[66],"processing":[68],"limit":[69],"of":[70,202],"typical":[71],"machine":[72],"learning":[73,166],"models.":[74],"(2)":[75],"They":[76],"mixed":[79,212],"with":[80],"bulky":[81],"benign":[82,137],"scripts.":[83],"(3)":[84],"Script":[85],"obfuscation":[86,178],"can":[87,143],"easily":[88],"conceal":[89],"their":[90],"potential":[91],"matching":[92],"signatures.":[93],"In":[94],"this":[95,160],"article,":[96],"we":[97],"introduce":[98],"novel":[100],"model":[101,186,199],"addressing":[102],"these":[103,141],"challenges.":[104],"It":[105],"incorporates":[106],"similarity":[107,165],"learning,":[108],"sentence":[109,148],"transformer,":[110],"sliding":[111,181],"window":[112,182],"method,":[113],"stochastic":[115],"gradient":[116],"descent":[117],"(SGD)":[118],"classifier.":[119],"Our":[120,198],"key":[121],"insight":[122,161],"code,":[127],"particularly":[128],"when":[129],"obfuscated,":[130],"exhibits":[131],"semantic":[132],"statistical":[134],"deviations":[135,142],"from":[136],"administrative":[138],"usage,":[139],"be":[144],"captured":[145],"by":[146,218],"contrastive":[147],"embeddings":[149],"need":[152],"de-obfuscation":[154],"handcrafted":[156],"features.":[157],"We":[158],"operate":[159],"through":[162],"Siamese":[164],"framework":[167],"improves":[169],"robustness":[170],"against":[171],"Out-of-Vocabulary":[172],"tokens":[173],"unseen":[176],"code":[177],"methods.":[179],"method":[183],"enables":[184],"handle":[188],"scripts,":[190],"SGD":[193],"classifier":[194],"evaluates":[195],"segment-level":[196],"maliciousness.":[197],"achieves":[200],"accuracies":[201],"99.01%,":[203],"97.59%,":[204],"98.70%,":[205],"99.73%":[207],"across":[208],"multiple":[209],"obfuscated":[210],"benchmarks,":[214],"outperforming":[215],"existing":[216],"baselines":[217],"over":[219],"30%":[220],"all":[222],"cases.":[223],"This":[224],"work":[225],"demonstrates":[226],"scalable":[228],"effective":[230],"strategy":[231],"robust":[233],"detection":[236],"real-world":[238],"scenarios.":[239]},"counts_by_year":[{"year":2026,"cited_by_count":2}],"updated_date":"2026-05-21T06:26:12.895304","created_date":"2025-10-10T00:00:00"}