{"id":"https://openalex.org/W7131638860","doi":"https://doi.org/10.1145/3799692","title":"Resilient Dynamic Analysis for Windows Malware Technique Discovery against Behavior Obfuscation","display_name":"Resilient Dynamic Analysis for Windows Malware Technique Discovery against Behavior Obfuscation","publication_year":2026,"publication_date":"2026-02-26","ids":{"openalex":"https://openalex.org/W7131638860","doi":"https://doi.org/10.1145/3799692"},"language":"en","primary_location":{"id":"doi:10.1145/3799692","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3799692","pdf_url":null,"source":{"id":"https://openalex.org/S4210174050","display_name":"ACM Transactions on Privacy and Security","issn_l":"2471-2566","issn":["2471-2566","2471-2574"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Privacy and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1145/3799692","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Yi-Ting Huang","orcid":"https://orcid.org/0000-0002-6315-8927"},"institutions":[{"id":"https://openalex.org/I154864474","display_name":"National Taiwan University of Science and Technology","ror":"https://ror.org/00q09pe49","country_code":"TW","type":"education","lineage":["https://openalex.org/I154864474"]}],"countries":["TW"],"is_corresponding":false,"raw_author_name":"Yi-Ting Huang","raw_affiliation_strings":["National Taiwan University of Science and Technology"],"raw_orcid":"https://orcid.org/0000-0002-6315-8927","affiliations":[{"raw_affiliation_string":"National Taiwan University of Science and Technology","institution_ids":["https://openalex.org/I154864474"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Lisa Liu","orcid":"https://orcid.org/0000-0002-8784-9976"},"institutions":[{"id":"https://openalex.org/I31746571","display_name":"UNSW Sydney","ror":"https://ror.org/03r8z3t63","country_code":"AU","type":"education","lineage":["https://openalex.org/I31746571"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Lisa Liu","raw_affiliation_strings":["University of New South Wales"],"raw_orcid":"https://orcid.org/0000-0002-8784-9976","affiliations":[{"raw_affiliation_string":"University of New South Wales","institution_ids":["https://openalex.org/I31746571"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5089608199","display_name":"Ying-Ren Guo","orcid":"https://orcid.org/0000-0002-7508-0397"},"institutions":[{"id":"https://openalex.org/I84653119","display_name":"Academia Sinica","ror":"https://ror.org/05bxb3784","country_code":"TW","type":"facility","lineage":["https://openalex.org/I84653119"]}],"countries":["TW"],"is_corresponding":false,"raw_author_name":"Ying-Ren Guo","raw_affiliation_strings":["Academia Sinica"],"raw_orcid":"https://orcid.org/0000-0002-7508-0397","affiliations":[{"raw_affiliation_string":"Academia Sinica","institution_ids":["https://openalex.org/I84653119"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5031103842","display_name":"Guo-Wei Wong","orcid":"https://orcid.org/0000-0002-1748-7818"},"institutions":[{"id":"https://openalex.org/I16733864","display_name":"National Taiwan University","ror":"https://ror.org/05bqach95","country_code":"TW","type":"education","lineage":["https://openalex.org/I16733864"]}],"countries":["TW"],"is_corresponding":false,"raw_author_name":"Guo-Wei Wong","raw_affiliation_strings":["National Taiwan University"],"raw_orcid":"https://orcid.org/0000-0002-1748-7818","affiliations":[{"raw_affiliation_string":"National Taiwan University","institution_ids":["https://openalex.org/I16733864"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5052257130","display_name":"Timothy Lynar","orcid":"https://orcid.org/0000-0001-7934-5658"},"institutions":[{"id":"https://openalex.org/I31746571","display_name":"UNSW Sydney","ror":"https://ror.org/03r8z3t63","country_code":"AU","type":"education","lineage":["https://openalex.org/I31746571"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Timothy Lynar","raw_affiliation_strings":["University of New South Wales"],"raw_orcid":"https://orcid.org/0000-0001-7934-5658","affiliations":[{"raw_affiliation_string":"University of New South Wales","institution_ids":["https://openalex.org/I31746571"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5052520979","display_name":"Meng Chang Chen","orcid":"https://orcid.org/0000-0002-6815-2436"},"institutions":[{"id":"https://openalex.org/I84653119","display_name":"Academia Sinica","ror":"https://ror.org/05bxb3784","country_code":"TW","type":"facility","lineage":["https://openalex.org/I84653119"]}],"countries":["TW"],"is_corresponding":false,"raw_author_name":"Meng Chang Chen","raw_affiliation_strings":["Academia Sinica"],"raw_orcid":"https://orcid.org/0000-0002-6815-2436","affiliations":[{"raw_affiliation_string":"Academia Sinica","institution_ids":["https://openalex.org/I84653119"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.19077734,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"29","issue":"2","first_page":"1","last_page":"32"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9919999837875366,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9919999837875366,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.0019000000320374966,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.0013000000035390258,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/obfuscation","display_name":"Obfuscation","score":0.7598000168800354},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.7549999952316284},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.6794999837875366},{"id":"https://openalex.org/keywords/executable","display_name":"Executable","score":0.6172999739646912},{"id":"https://openalex.org/keywords/embedding","display_name":"Embedding","score":0.5669999718666077},{"id":"https://openalex.org/keywords/malware-analysis","display_name":"Malware analysis","score":0.46959999203681946},{"id":"https://openalex.org/keywords/static-analysis","display_name":"Static analysis","score":0.4106999933719635},{"id":"https://openalex.org/keywords/focus","display_name":"Focus (optics)","score":0.3695000112056732}],"concepts":[{"id":"https://openalex.org/C40305131","wikidata":"https://www.wikidata.org/wiki/Q2616305","display_name":"Obfuscation","level":2,"score":0.7598000168800354},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7573000192642212},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.7549999952316284},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.6794999837875366},{"id":"https://openalex.org/C160145156","wikidata":"https://www.wikidata.org/wiki/Q778586","display_name":"Executable","level":2,"score":0.6172999739646912},{"id":"https://openalex.org/C41608201","wikidata":"https://www.wikidata.org/wiki/Q980509","display_name":"Embedding","level":2,"score":0.5669999718666077},{"id":"https://openalex.org/C2779395397","wikidata":"https://www.wikidata.org/wiki/Q15731404","display_name":"Malware analysis","level":3,"score":0.46959999203681946},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.4106999933719635},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.37599998712539673},{"id":"https://openalex.org/C192209626","wikidata":"https://www.wikidata.org/wiki/Q190909","display_name":"Focus (optics)","level":2,"score":0.3695000112056732},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3617999851703644},{"id":"https://openalex.org/C2778579508","wikidata":"https://www.wikidata.org/wiki/Q722192","display_name":"System call","level":2,"score":0.35199999809265137},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.33980000019073486},{"id":"https://openalex.org/C2983643213","wikidata":"https://www.wikidata.org/wiki/Q6030225","display_name":"Influence function","level":3,"score":0.33899998664855957},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.32199999690055847},{"id":"https://openalex.org/C84525096","wikidata":"https://www.wikidata.org/wiki/Q3506050","display_name":"Cryptovirology","level":3,"score":0.30709999799728394},{"id":"https://openalex.org/C207850805","wikidata":"https://www.wikidata.org/wiki/Q269608","display_name":"Reverse engineering","level":2,"score":0.2957000136375427},{"id":"https://openalex.org/C2779639559","wikidata":"https://www.wikidata.org/wiki/Q7661178","display_name":"Symbolic execution","level":3,"score":0.29260000586509705},{"id":"https://openalex.org/C14036430","wikidata":"https://www.wikidata.org/wiki/Q3736076","display_name":"Function (biology)","level":2,"score":0.27570000290870667},{"id":"https://openalex.org/C115901376","wikidata":"https://www.wikidata.org/wiki/Q184199","display_name":"Automation","level":2,"score":0.2734000086784363},{"id":"https://openalex.org/C3018587665","wikidata":"https://www.wikidata.org/wiki/Q7268696","display_name":"Qualitative analysis","level":3,"score":0.27160000801086426},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.2578999996185303},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.25679999589920044}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3799692","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3799692","pdf_url":null,"source":{"id":"https://openalex.org/S4210174050","display_name":"ACM Transactions on Privacy and Security","issn_l":"2471-2566","issn":["2471-2566","2471-2574"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Privacy and Security","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1145/3799692","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3799692","pdf_url":null,"source":{"id":"https://openalex.org/S4210174050","display_name":"ACM Transactions on Privacy and Security","issn_l":"2471-2566","issn":["2471-2566","2471-2574"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Privacy and Security","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G488973441","display_name":null,"funder_award_id":"109-2221-E-001-010-MY3, 110-2218-E-001-001-MBK","funder_id":"https://openalex.org/F4320331164","funder_display_name":"National Science and Technology Council"}],"funders":[{"id":"https://openalex.org/F4320331164","display_name":"National Science and Technology Council","ror":"https://ror.org/00wnb9798"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":35,"referenced_works":["https://openalex.org/W1545528966","https://openalex.org/W1893133781","https://openalex.org/W1972978214","https://openalex.org/W1994020507","https://openalex.org/W2003568760","https://openalex.org/W2024170198","https://openalex.org/W2044423349","https://openalex.org/W2110978214","https://openalex.org/W2469346691","https://openalex.org/W2496323672","https://openalex.org/W2557513839","https://openalex.org/W2591830932","https://openalex.org/W2789729245","https://openalex.org/W2792867061","https://openalex.org/W2792991556","https://openalex.org/W2915280428","https://openalex.org/W2934843808","https://openalex.org/W2964301649","https://openalex.org/W2972552958","https://openalex.org/W2973628901","https://openalex.org/W2979826702","https://openalex.org/W2988961468","https://openalex.org/W2997591727","https://openalex.org/W3003925307","https://openalex.org/W3004908285","https://openalex.org/W3016369654","https://openalex.org/W3048012689","https://openalex.org/W3143383981","https://openalex.org/W3211182750","https://openalex.org/W3212419298","https://openalex.org/W4213143249","https://openalex.org/W4287644588","https://openalex.org/W4385713347","https://openalex.org/W4387179211","https://openalex.org/W4390317718"],"related_works":[],"abstract_inverted_index":{"In":[0,36],"this":[1,103],"article,":[2],"we":[3,41,135],"focus":[4],"on":[5],"the":[6,15,19,96],"robustness":[7,152],"of":[8,23,62,98,114,140],"behavior-based":[9,33,69],"malware":[10,24,54],"analysis":[11,49],"models,":[12],"justified":[13],"by":[14],"need":[16],"to":[17,38,67,90,111,153],"address":[18],"high":[20],"mutation":[21],"rates":[22],"executables":[25],"that":[26],"debilitate":[27],"conventional":[28],"signature-based":[29],"approaches":[30],"and":[31,84,95,131,144,151],"even":[32],"AI":[34],"solutions.":[35],"response":[37],"these":[39,99],"challenges,":[40],"propose":[42],"MAMBA":[43,75,105,141],"+":[44,76,106,142],",":[45,143],"an":[46],"obfuscation-resistant":[47],"dynamic":[48],"approach":[50],"tailored":[51],"for":[52,120],"uncovering":[53],"behavior.":[55],"We":[56],"have":[57],"assembled":[58],"a":[59,86,124],"comprehensive":[60,125],"collection":[61],"behavioral":[63],"obfuscation":[64],"attacks":[65],"designed":[66],"undermine":[68],"models.":[70],"The":[71],"central":[72],"concept":[73],"behind":[74],"involves":[77],"treating":[78],"obfuscated":[79],"calls":[80,116],"as":[81],"perturbed":[82],"data":[83],"introducing":[85],"novel":[87],"loss":[88],"function":[89],"effectively":[91],"balance":[92],"ground-truth":[93],"predictions":[94],"handling":[97],"perturbations.":[100],"To":[101],"facilitate":[102],"approach,":[104],"designs":[107],"adapted":[108],"embedding":[109],"mechanisms":[110],"transform":[112],"traces":[113],"API":[115],"into":[117],"high-dimensional":[118],"vectors":[119],"attention":[121],"calculations.":[122],"Through":[123],"empirical":[126],"study":[127],"with":[128],"seven":[129],"obfuscations":[130],"three":[132],"unseen":[133],"attacks,":[134],"reveal":[136],"important":[137],"qualitative":[138],"properties":[139],"quantitatively":[145],"demonstrate":[146],"its":[147],"superiority":[148],"in":[149],"performance":[150],"all":[154],"compared":[155],"methods.":[156]},"counts_by_year":[],"updated_date":"2026-05-21T06:26:12.895304","created_date":"2026-02-27T00:00:00"}