{"id":"https://openalex.org/W2965169440","doi":"https://doi.org/10.13016/iris-0jtw","title":"AUTOMATIC FEATURE ENGINEERING FOR DISCOVERING AND EXPLAINING MALICIOUS BEHAVIORS","display_name":"AUTOMATIC FEATURE ENGINEERING FOR DISCOVERING AND EXPLAINING MALICIOUS BEHAVIORS","publication_year":2019,"publication_date":"2019-01-01","ids":{"openalex":"https://openalex.org/W2965169440","doi":"https://doi.org/10.13016/iris-0jtw","mag":"2965169440"},"language":"en","primary_location":{"id":"mag:2965169440","is_oa":false,"landing_page_url":"https://drum.lib.umd.edu/handle/1903/22000","pdf_url":null,"source":null,"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":null},"type":"dissertation","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.13016/iris-0jtw","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5113018360","display_name":"Ziyun Zhu","orcid":null},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Zhu, Ziyun","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":["https://openalex.org/A5113018360"],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11159","display_name":"Manufacturing Process and Optimization","score":0.08020000159740448,"subfield":{"id":"https://openalex.org/subfields/2209","display_name":"Industrial and Manufacturing Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11159","display_name":"Manufacturing Process and Optimization","score":0.08020000159740448,"subfield":{"id":"https://openalex.org/subfields/2209","display_name":"Industrial and Manufacturing Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/feature-engineering","display_name":"Feature engineering","score":0.5604967474937439},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.555927574634552},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.47103410959243774},{"id":"https://openalex.org/keywords/data-science","display_name":"Data science","score":0.4633975327014923},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.33652544021606445},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.3325967788696289},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.32952046394348145},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.0852288007736206},{"id":"https://openalex.org/keywords/philosophy","display_name":"Philosophy","score":0.06849199533462524}],"concepts":[{"id":"https://openalex.org/C2778827112","wikidata":"https://www.wikidata.org/wiki/Q22245680","display_name":"Feature engineering","level":3,"score":0.5604967474937439},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.555927574634552},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.47103410959243774},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.4633975327014923},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.33652544021606445},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3325967788696289},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.32952046394348145},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.0852288007736206},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.06849199533462524},{"id":"https://openalex.org/C41895202","wikidata":"https://www.wikidata.org/wiki/Q8162","display_name":"Linguistics","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"mag:2965169440","is_oa":false,"landing_page_url":"https://drum.lib.umd.edu/handle/1903/22000","pdf_url":null,"source":null,"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":null},{"id":"doi:10.13016/iris-0jtw","is_oa":true,"landing_page_url":"https://doi.org/10.13016/iris-0jtw","pdf_url":null,"source":{"id":"https://openalex.org/S4306402644","display_name":"Digital Repository at the University of Maryland (University of Maryland College Park)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I66946132","host_organization_name":"University of Maryland, College Park","host_organization_lineage":["https://openalex.org/I66946132"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Collection"}],"best_oa_location":{"id":"doi:10.13016/iris-0jtw","is_oa":true,"landing_page_url":"https://doi.org/10.13016/iris-0jtw","pdf_url":null,"source":{"id":"https://openalex.org/S4306402644","display_name":"Digital Repository at the University of Maryland (University of Maryland College Park)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I66946132","host_organization_name":"University of Maryland, College Park","host_organization_lineage":["https://openalex.org/I66946132"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Collection"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W2365014315","https://openalex.org/W2979387641","https://openalex.org/W2890008992","https://openalex.org/W2287484170","https://openalex.org/W2084321021","https://openalex.org/W2765735647","https://openalex.org/W3046985810","https://openalex.org/W2736906287","https://openalex.org/W3174658482","https://openalex.org/W47329972","https://openalex.org/W2900150361","https://openalex.org/W2169862386","https://openalex.org/W14275113","https://openalex.org/W3204773130","https://openalex.org/W3011025032","https://openalex.org/W2185633260"],"abstract_inverted_index":{"A":[0],"key":[1],"task":[2],"of":[3,12,16,36,66,80,174,250,267,306,331,353,361,388],"cybersecurity":[4],"is":[5,86,199,414],"to":[6,30,59,90,95,184,201,214,219,277,338,365,372,379,396],"discover":[7],"and":[8,25,52,62,88,102,126,128,176,213,282,297,318,343,349,410],"explain":[9],"malicious":[10,17,69,100,177],"behaviors":[11,18,101],"malware.":[13,161],"The":[14,34,358],"understanding":[15],"helps":[19],"us":[20,276,364],"further":[21,291],"develop":[22],"good":[23],"features":[24,97,168,204,217,243],"apply":[26],"machine":[27,37,238],"learning":[28,38,239],"techniques":[29,39,391],"detect":[31],"various":[32],"attacks.":[33,104],"effectiveness":[35,387],"primarily":[40],"depends":[41],"on":[42,49,68,169,192,245,393],"the":[43,56,63,71,81,130,139,146,209,216,268,293,304,386,398,403,421],"manual":[44,344],"feature":[45,72,110,141,156,231,286,321],"engineering":[46,73,111,142,232,322,409],"process,":[47],"based":[48,244],"human":[50,140],"knowledge":[51,131],"intuition.":[53],"However,":[54],"given":[55],"adversaries\u2019":[57],"efforts":[58],"evade":[60],"detection":[61,301,313],"growing":[64],"volume":[65],"publications":[67],"behaviors,":[70],"process":[74],"likely":[75],"draws":[76],"from":[77,208,314,355,407],"a":[78,108,135,149,155,164,170,185,229,315,329,335,415],"fraction":[79],"relevant":[82],"knowledge.":[83],"Therefore,":[84],"it":[85],"necessary":[87],"important":[89],"design":[91],"an":[92],"automated":[93],"system":[94,150,336],"engineer":[96],"for":[98,113,158,257,299],"discovering":[99],"detecting":[103,159],"First,":[105],"we":[106,227,310,384],"describe":[107,223],"knowledge-based":[109],"technique":[112,233,418],"malware":[114,133,188,224,300,312,380],"detection.":[115],"It":[116],"mines":[117],"documents":[118],"written":[119],"in":[120,134,148,265,324],"natural":[121],"language":[122],"(e.g.":[123,369],"scientific":[124],"literature),":[125],"represents":[127],"queries":[129],"about":[132],"way":[136],"that":[137,190,205,222,327,402,419],"mirrors":[138],"process.":[143],"We":[144,162,290,333,400],"implement":[145,334],"idea":[147],"called":[151,234],"FeatureSmith,":[152],"which":[153,236,375],"generates":[154,420],"set":[157,173,212],"Android":[160,187],"train":[163],"classifier":[165,180],"using":[166],"these":[167],"large":[171],"data":[172,270,280,295,368],"benign":[175],"apps.":[178],"This":[179],"achieves":[181],"comparable":[182],"performance":[183],"state-of-the-art":[186],"detector":[189],"relies":[191],"manually":[193,210],"engineered":[194,211],"features.":[195],"In":[196,272,382],"addition,":[197,273],"FeatureSmith":[198],"able":[200],"suggest":[202],"informative":[203],"are":[206],"absent":[207],"link":[215,366],"generated":[218],"abstract":[220],"concepts":[221],"behaviors.":[225],"Second,":[226],"propose":[228],"data-driven":[230],"ReasonSmith,":[235],"explains":[237],"models":[240],"by":[241,284,347],"ranking":[242],"their":[246],"global":[247,316],"importance.":[248],"Instead":[249],"interpreting":[251],"how":[252],"neural":[253],"networks":[254],"make":[255],"decisions":[256],"one":[258],"specific":[259],"sample,":[260],"ReasonSmith":[261,274],"captures":[262],"general":[263],"importance":[264],"terms":[266],"whole":[269],"set.":[271],"allows":[275],"efficiently":[278],"identify":[279],"biases":[281,296],"artifacts,":[283],"comparing":[285],"rankings":[287],"over":[288],"time.":[289],"summarize":[292],"common":[294,416],"artifacts":[298],"problems":[302],"at":[303],"level":[305],"API":[307],"calls.":[308],"Third,":[309],"study":[311,385],"view,":[317],"explore":[319],"automatic":[320],"problem":[323],"analyzing":[325],"campaigns":[326],"include":[328],"series":[330],"actions.":[332],"ChainSmith":[337],"bridge":[339],"large-scale":[340],"field":[341],"measurement":[342],"campaign":[345,404],"report":[346],"extracting":[348],"categorizing":[350],"IOCs":[351,362],"(indicators":[352],"compromise)":[354],"security":[356,370],"blogs.":[357],"semantic":[359],"roles":[360],"allow":[363],"qualitative":[367],"blogs)":[371],"quantitative":[373],"measurements,":[374],"brings":[376],"new":[377],"insights":[378],"campaigns.":[381],"particular,":[383],"different":[389],"persuasion":[390,417],"used":[392],"enticing":[394],"user":[395],"download":[397],"payloads.":[399],"find":[401],"usually":[405],"starts":[406],"social":[408],"\u201cmissing":[411],"codec\u201d":[412],"ruse":[413],"most":[422],"suspicious":[423],"downloads":[424],"each":[425],"day.":[426]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}