{"id":"https://openalex.org/W4385481489","doi":"https://doi.org/10.1186/s42400-023-00157-w","title":"MRm-DLDet: a memory-resident malware detection framework based on memory forensics and deep neural network","display_name":"MRm-DLDet: a memory-resident malware detection framework based on memory forensics and deep neural network","publication_year":2023,"publication_date":"2023-08-03","ids":{"openalex":"https://openalex.org/W4385481489","doi":"https://doi.org/10.1186/s42400-023-00157-w"},"language":"en","primary_location":{"id":"doi:10.1186/s42400-023-00157-w","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s42400-023-00157-w","pdf_url":"https://cybersecurity.springeropen.com/counter/pdf/10.1186/s42400-023-00157-w","source":{"id":"https://openalex.org/S3035238565","display_name":"Cybersecurity","issn_l":"2523-3246","issn":["2523-3246"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Cybersecurity","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://cybersecurity.springeropen.com/counter/pdf/10.1186/s42400-023-00157-w","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100717400","display_name":"Jiaxi Liu","orcid":"https://orcid.org/0000-0003-2912-9409"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jiaxi Liu","raw_affiliation_strings":["Institute of Information Engineering, Chinese Academy of Sciences, Beijing, 100085, China","School of Cyber Security, University of Chinese Academy of Sciences, Beijing, 100049, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences, Beijing, 100085, China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"raw_affiliation_string":"School of Cyber Security, University of Chinese Academy of Sciences, Beijing, 100049, China","institution_ids":["https://openalex.org/I4210165038"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5005502772","display_name":"Yunjiang Feng","orcid":"https://orcid.org/0000-0003-2412-1213"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yun Feng","raw_affiliation_strings":["Institute of Information Engineering, Chinese Academy of Sciences, Beijing, 100085, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences, Beijing, 100085, China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100446438","display_name":"Xinyu Liu","orcid":"https://orcid.org/0000-0002-6776-9063"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xinyu Liu","raw_affiliation_strings":["Institute of Information Engineering, Chinese Academy of Sciences, Beijing, 100085, China","School of Cyber Security, University of Chinese Academy of Sciences, Beijing, 100049, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences, Beijing, 100085, China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"raw_affiliation_string":"School of Cyber Security, University of Chinese Academy of Sciences, Beijing, 100049, China","institution_ids":["https://openalex.org/I4210165038"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5112796980","display_name":"Jianjun Zhao","orcid":null},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jianjun Zhao","raw_affiliation_strings":["Institute of Information Engineering, Chinese Academy of Sciences, Beijing, 100085, China","School of Cyber Security, University of Chinese Academy of Sciences, Beijing, 100049, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences, Beijing, 100085, China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"raw_affiliation_string":"School of Cyber Security, University of Chinese Academy of Sciences, Beijing, 100049, China","institution_ids":["https://openalex.org/I4210165038"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5004834139","display_name":"Qixu Liu","orcid":"https://orcid.org/0000-0003-0895-9585"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":true,"raw_author_name":"Qixu Liu","raw_affiliation_strings":["Institute of Information Engineering, Chinese Academy of Sciences, Beijing, 100085, China","School of Cyber Security, University of Chinese Academy of Sciences, Beijing, 100049, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences, Beijing, 100085, China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"raw_affiliation_string":"School of Cyber Security, University of Chinese Academy of Sciences, Beijing, 100049, China","institution_ids":["https://openalex.org/I4210165038"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":["https://openalex.org/A5004834139"],"corresponding_institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404","https://openalex.org/I4210165038"],"apc_list":{"value":1230,"currency":"USD","value_usd":1230},"apc_paid":{"value":1230,"currency":"USD","value_usd":1230},"fwci":3.7357,"has_fulltext":true,"cited_by_count":28,"citation_normalized_percentile":{"value":0.94483352,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":98,"max":100},"biblio":{"volume":"6","issue":"1","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9973000288009644,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9876999855041504,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8450435400009155},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.654711902141571},{"id":"https://openalex.org/keywords/evasion","display_name":"Evasion (ethics)","score":0.48853763937950134},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.4836762845516205},{"id":"https://openalex.org/keywords/memory-leak","display_name":"Memory leak","score":0.4538229703903198},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.30992981791496277},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.3063878118991852},{"id":"https://openalex.org/keywords/memory-management","display_name":"Memory management","score":0.2405734658241272},{"id":"https://openalex.org/keywords/semiconductor-memory","display_name":"Semiconductor memory","score":0.13121312856674194}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8450435400009155},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.654711902141571},{"id":"https://openalex.org/C2781251061","wikidata":"https://www.wikidata.org/wiki/Q5416089","display_name":"Evasion (ethics)","level":3,"score":0.48853763937950134},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.4836762845516205},{"id":"https://openalex.org/C156731835","wikidata":"https://www.wikidata.org/wiki/Q751740","display_name":"Memory leak","level":4,"score":0.4538229703903198},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.30992981791496277},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.3063878118991852},{"id":"https://openalex.org/C176649486","wikidata":"https://www.wikidata.org/wiki/Q2308807","display_name":"Memory management","level":3,"score":0.2405734658241272},{"id":"https://openalex.org/C98986596","wikidata":"https://www.wikidata.org/wiki/Q1143031","display_name":"Semiconductor memory","level":2,"score":0.13121312856674194},{"id":"https://openalex.org/C203014093","wikidata":"https://www.wikidata.org/wiki/Q101929","display_name":"Immunology","level":1,"score":0.0},{"id":"https://openalex.org/C8891405","wikidata":"https://www.wikidata.org/wiki/Q1059","display_name":"Immune system","level":2,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1186/s42400-023-00157-w","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s42400-023-00157-w","pdf_url":"https://cybersecurity.springeropen.com/counter/pdf/10.1186/s42400-023-00157-w","source":{"id":"https://openalex.org/S3035238565","display_name":"Cybersecurity","issn_l":"2523-3246","issn":["2523-3246"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Cybersecurity","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:ebf54135b95a4065abe4d8f0f641aa1a","is_oa":true,"landing_page_url":"https://doaj.org/article/ebf54135b95a4065abe4d8f0f641aa1a","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Cybersecurity, Vol 6, Iss 1, Pp 1-22 (2023)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1186/s42400-023-00157-w","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s42400-023-00157-w","pdf_url":"https://cybersecurity.springeropen.com/counter/pdf/10.1186/s42400-023-00157-w","source":{"id":"https://openalex.org/S3035238565","display_name":"Cybersecurity","issn_l":"2523-3246","issn":["2523-3246"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Cybersecurity","raw_type":"journal-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.6600000262260437,"display_name":"Peace, Justice and strong institutions"}],"awards":[{"id":"https://openalex.org/G3390532264","display_name":null,"funder_award_id":"XDC02040100","funder_id":"https://openalex.org/F4320321133","funder_display_name":"Chinese Academy of Sciences"},{"id":"https://openalex.org/G529307786","display_name":null,"funder_award_id":"2019163","funder_id":"https://openalex.org/F4320322847","funder_display_name":"Youth Innovation Promotion Association of the Chinese Academy of Sciences"},{"id":"https://openalex.org/G8058437614","display_name":null,"funder_award_id":"XDC02040100","funder_id":"https://openalex.org/F4320322847","funder_display_name":"Youth Innovation Promotion Association of the Chinese Academy of Sciences"},{"id":"https://openalex.org/G8701658582","display_name":null,"funder_award_id":"No.2019163","funder_id":"https://openalex.org/F4320322847","funder_display_name":"Youth Innovation Promotion Association of the Chinese Academy of Sciences"}],"funders":[{"id":"https://openalex.org/F4320321133","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35"},{"id":"https://openalex.org/F4320322847","display_name":"Youth Innovation Promotion Association of the Chinese Academy of Sciences","ror":"https://ror.org/031141b54"},{"id":"https://openalex.org/F4320335892","display_name":"Youth Innovation Promotion Association","ror":null}],"has_content":{"pdf":true,"grobid_xml":false},"content_urls":{"pdf":"https://content.openalex.org/works/W4385481489.pdf"},"referenced_works_count":32,"referenced_works":["https://openalex.org/W1976468890","https://openalex.org/W1977415353","https://openalex.org/W2010065958","https://openalex.org/W2064675550","https://openalex.org/W2135143063","https://openalex.org/W2194775991","https://openalex.org/W2229662347","https://openalex.org/W2517194566","https://openalex.org/W2517430515","https://openalex.org/W2620957293","https://openalex.org/W2712617220","https://openalex.org/W2744095836","https://openalex.org/W2783112941","https://openalex.org/W2801888526","https://openalex.org/W2806294538","https://openalex.org/W2883886946","https://openalex.org/W2959173014","https://openalex.org/W2964199361","https://openalex.org/W2969659874","https://openalex.org/W2973628901","https://openalex.org/W2996642256","https://openalex.org/W3006334803","https://openalex.org/W3006711782","https://openalex.org/W3013896538","https://openalex.org/W3118382796","https://openalex.org/W3132223643","https://openalex.org/W3135185324","https://openalex.org/W3138173041","https://openalex.org/W3208789089","https://openalex.org/W4213012150","https://openalex.org/W6602311867","https://openalex.org/W6602664198"],"related_works":["https://openalex.org/W2097492617","https://openalex.org/W2783112941","https://openalex.org/W2526398307","https://openalex.org/W2470029541","https://openalex.org/W4387065217","https://openalex.org/W2808001300","https://openalex.org/W4368275542","https://openalex.org/W2470502009","https://openalex.org/W1548771250","https://openalex.org/W3152957156"],"abstract_inverted_index":{"Abstract":[0],"Cyber":[1],"attackers":[2],"have":[3,49],"constantly":[4],"updated":[5],"their":[6],"attack":[7,38],"techniques":[8],"to":[9,22,53,99,143,262],"evade":[10],"antivirus":[11],"software":[12],"detection":[13,73,78,97,201,258],"in":[14,31,64,77,86,141],"recent":[15],"years.":[16],"One":[17],"popular":[18],"evasion":[19,46],"method":[20,39],"is":[21,195],"execute":[23],"malicious":[24,28],"code":[25],"and":[26,48,58,80,110,130,152,221,248,275,280],"perform":[27,75],"actions":[29],"only":[30],"memory.":[32],"Malicious":[33],"programs":[34],"that":[35,127],"use":[36],"this":[37],"are":[40,61],"called":[41],"memory-resident":[42,66,95,196,222],"malware,":[43],"with":[44,185,256],"excellent":[45],"capability,":[47],"posed":[50],"huge":[51],"threats":[52],"cyber":[54],"security.":[55],"Traditional":[56],"static":[57],"dynamic":[59],"methods":[60],"not":[62],"effective":[63],"detecting":[65],"malware.":[67],"In":[68,224],"addition,":[69],"existing":[70],"memory":[71,87,112,118,149],"forensics":[72],"solutions":[74],"unsatisfactorily":[76],"rate":[79],"depend":[81],"on":[82,199,278],"massive":[83],"expert":[84],"knowledge":[85],"analysis.":[88],"This":[89],"paper":[90],"proposes":[91],"MRm-DLDet,":[92,279],"a":[93,106,124,179,193,207,214,257],"state-of-the-art":[94],"malware":[96,197],"framework,":[98],"overcome":[100],"these":[101],"drawbacks.":[102],"MRm-DLDet":[103,142,236,244],"first":[104],"builds":[105],"virtual":[107],"machine":[108],"environment":[109],"captures":[111],"dumps,":[113],"then":[114],"creatively":[115],"processes":[116],"the":[117,157,161,172,175,200,227,235,253,271,281,285],"dumps":[119],"into":[120],"RGB":[121,164,240],"images":[122,165],"using":[123],"pre-processing":[125],"technique":[126],"combines":[128],"deduplication":[129],"ultra-high":[131,238],"resolution":[132,239],"image":[133],"cropping,":[134],"followed":[135],"by":[136],"our":[137],"neural":[138],"network":[139,180],"MRmNet":[140,155],"fully":[144],"extract":[145],"high-dimensional":[146],"features":[147,173],"from":[148,234],"dump":[150],"files":[151],"detect":[153],"them.":[154],"receives":[156],"labeled":[158,231],"sub-images":[159,232],"of":[160,168,174,181,203,218,260,273,287],"cropped":[162],"high-resolution":[163],"as":[166],"input":[167],"ResNet-18,":[169],"which":[170],"extracts":[171],"sub-images.":[176],"Then":[177],"trains":[178],"gated":[182],"recurrent":[183],"units":[184],"an":[186],"attention":[187],"mechanism.":[188],"Finally,":[189],"it":[190,249],"determines":[191],"whether":[192],"program":[194],"based":[198],"results":[202,283],"each":[204],"sub-image":[205],"through":[206],"specially":[208],"designed":[209],"voting":[210],"layer.":[211],"We":[212,242],"created":[213],"high-quality":[215],"dataset":[216,228],"consisting":[217],"2,060":[219],"benign":[220],"programs.":[223],"other":[225],"words,":[226],"contains":[229],"1,287,500":[230],"cut":[233],"transformed":[237],"images.":[241],"implement":[243],"for":[245],"Windows":[246],"10,":[247],"performs":[250],"better":[251],"than":[252],"latest":[254],"methods,":[255],"accuracy":[259],"up":[261],"98.34":[263],"$$\\%$$":[264],"<mml:math":[265],"xmlns:mml=\"http://www.w3.org/1998/Math/MathML\"><mml:mo>%</mml:mo></mml:math>":[266],".":[267],"Moreover,":[268],"we":[269],"measured":[270],"effects":[272],"mimicry":[274],"adversarial":[276],"attacks":[277],"experimental":[282],"demonstrated":[284],"robustness":[286],"MRm-DLDet.":[288]},"counts_by_year":[{"year":2026,"cited_by_count":7},{"year":2025,"cited_by_count":16},{"year":2024,"cited_by_count":5}],"updated_date":"2026-07-26T07:53:14.480251","created_date":"2025-10-10T00:00:00"}