{"id":"https://openalex.org/W2794748563","doi":"https://doi.org/10.1504/ijesdf.2018.10011975","title":"Effective methods to detect metamorphic malware: a systematic review","display_name":"Effective methods to detect metamorphic malware: a systematic review","publication_year":2018,"publication_date":"2018-01-01","ids":{"openalex":"https://openalex.org/W2794748563","doi":"https://doi.org/10.1504/ijesdf.2018.10011975","mag":"2794748563"},"language":"en","primary_location":{"id":"doi:10.1504/ijesdf.2018.10011975","is_oa":true,"landing_page_url":"https://doi.org/10.1504/ijesdf.2018.10011975","pdf_url":"https://www.inderscienceonline.com/doi/full/10.1504/IJESDF.2018.090948","source":{"id":"https://openalex.org/S198660693","display_name":"International Journal of Electronic Security and Digital Forensics","issn_l":"1751-911X","issn":["1751-911X","1751-9128"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310317825","host_organization_name":"Inderscience Publishers","host_organization_lineage":["https://openalex.org/P4310317825"],"host_organization_lineage_names":["Inderscience Publishers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal of Electronic Security and Digital Forensics","raw_type":"journal-article"},"type":"review","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"bronze","oa_url":"https://www.inderscienceonline.com/doi/full/10.1504/IJESDF.2018.090948","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5015623576","display_name":"Ali Mansour","orcid":"https://orcid.org/0000-0003-4144-8832"},"institutions":[{"id":"https://openalex.org/I147554453","display_name":"University of Bedfordshire","ror":"https://ror.org/0400avk24","country_code":"GB","type":"education","lineage":["https://openalex.org/I147554453"]},{"id":"https://openalex.org/I44738892","display_name":"Joseph Sarwuan Tarka University Makurdi","ror":"https://ror.org/05hgtp764","country_code":"NG","type":"education","lineage":["https://openalex.org/I44738892"]},{"id":"https://openalex.org/I919958821","display_name":"Bayero University Kano","ror":"https://ror.org/049pzty39","country_code":"NG","type":"education","lineage":["https://openalex.org/I919958821"]}],"countries":["GB","NG"],"is_corresponding":false,"raw_author_name":"Ali Mansour","raw_affiliation_strings":["Computer Engineering from Bayero University Kano, Nigeria in 2012,","School of Computer Science and Technology University of Bedfordshire","Security and Digital Forensics (Distinction) from University of Bedfordshire, UK","State University Makurdi, Nigeria,","University Square, Luton, Bedfordshire, LU1 3JU, UK","University of Bedfordshire, UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Computer Engineering from Bayero University Kano, Nigeria in 2012,","institution_ids":["https://openalex.org/I919958821"]},{"raw_affiliation_string":"School of Computer Science and Technology University of Bedfordshire","institution_ids":[]},{"raw_affiliation_string":"Security and Digital Forensics (Distinction) from University of Bedfordshire, UK","institution_ids":["https://openalex.org/I147554453"]},{"raw_affiliation_string":"State University Makurdi, Nigeria,","institution_ids":["https://openalex.org/I44738892"]},{"raw_affiliation_string":"University Square, Luton, Bedfordshire, LU1 3JU, UK","institution_ids":["https://openalex.org/I147554453"]},{"raw_affiliation_string":"University of Bedfordshire, UK","institution_ids":["https://openalex.org/I147554453"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5085428147","display_name":"Moses Ashawa","orcid":"https://orcid.org/0000-0002-1016-0791"},"institutions":[{"id":"https://openalex.org/I147554453","display_name":"University of Bedfordshire","ror":"https://ror.org/0400avk24","country_code":"GB","type":"education","lineage":["https://openalex.org/I147554453"]},{"id":"https://openalex.org/I44738892","display_name":"Joseph Sarwuan Tarka University Makurdi","ror":"https://ror.org/05hgtp764","country_code":"NG","type":"education","lineage":["https://openalex.org/I44738892"]},{"id":"https://openalex.org/I919958821","display_name":"Bayero University Kano","ror":"https://ror.org/049pzty39","country_code":"NG","type":"education","lineage":["https://openalex.org/I919958821"]}],"countries":["GB","NG"],"is_corresponding":false,"raw_author_name":"Moses Ashawa","raw_affiliation_strings":["Computer Engineering from Bayero University Kano, Nigeria in 2012,","School of Computer Science and Technology University of Bedfordshire","Security and Digital Forensics (Distinction) from University of Bedfordshire, UK","State University Makurdi, Nigeria,","University Square, Luton, Bedfordshire, LU1 3JU, UK","University of Bedfordshire, UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Computer Engineering from Bayero University Kano, Nigeria in 2012,","institution_ids":["https://openalex.org/I919958821"]},{"raw_affiliation_string":"School of Computer Science and Technology University of Bedfordshire","institution_ids":[]},{"raw_affiliation_string":"Security and Digital Forensics (Distinction) from University of Bedfordshire, UK","institution_ids":["https://openalex.org/I147554453"]},{"raw_affiliation_string":"State University Makurdi, Nigeria,","institution_ids":["https://openalex.org/I44738892"]},{"raw_affiliation_string":"University Square, Luton, Bedfordshire, LU1 3JU, UK","institution_ids":["https://openalex.org/I147554453"]},{"raw_affiliation_string":"University of Bedfordshire, UK","institution_ids":["https://openalex.org/I147554453"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5034385519","display_name":"Muhammad Hamisu","orcid":null},"institutions":[{"id":"https://openalex.org/I147554453","display_name":"University of Bedfordshire","ror":"https://ror.org/0400avk24","country_code":"GB","type":"education","lineage":["https://openalex.org/I147554453"]},{"id":"https://openalex.org/I44738892","display_name":"Joseph Sarwuan Tarka University Makurdi","ror":"https://ror.org/05hgtp764","country_code":"NG","type":"education","lineage":["https://openalex.org/I44738892"]},{"id":"https://openalex.org/I919958821","display_name":"Bayero University Kano","ror":"https://ror.org/049pzty39","country_code":"NG","type":"education","lineage":["https://openalex.org/I919958821"]}],"countries":["GB","NG"],"is_corresponding":false,"raw_author_name":"Muhammad Hamisu","raw_affiliation_strings":["Computer Engineering from Bayero University Kano, Nigeria in 2012,","School of Computer Science and Technology University of Bedfordshire","Security and Digital Forensics (Distinction) from University of Bedfordshire, UK","State University Makurdi, Nigeria,","University Square, Luton, Bedfordshire, LU1 3JU, UK","University of Bedfordshire, UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Computer Engineering from Bayero University Kano, Nigeria in 2012,","institution_ids":["https://openalex.org/I919958821"]},{"raw_affiliation_string":"School of Computer Science and Technology University of Bedfordshire","institution_ids":[]},{"raw_affiliation_string":"Security and Digital Forensics (Distinction) from University of Bedfordshire, UK","institution_ids":["https://openalex.org/I147554453"]},{"raw_affiliation_string":"State University Makurdi, Nigeria,","institution_ids":["https://openalex.org/I44738892"]},{"raw_affiliation_string":"University Square, Luton, Bedfordshire, LU1 3JU, UK","institution_ids":["https://openalex.org/I147554453"]},{"raw_affiliation_string":"University of Bedfordshire, UK","institution_ids":["https://openalex.org/I147554453"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5018569826","display_name":"Mustafa Irshad","orcid":null},"institutions":[{"id":"https://openalex.org/I147554453","display_name":"University of Bedfordshire","ror":"https://ror.org/0400avk24","country_code":"GB","type":"education","lineage":["https://openalex.org/I147554453"]},{"id":"https://openalex.org/I44738892","display_name":"Joseph Sarwuan Tarka University Makurdi","ror":"https://ror.org/05hgtp764","country_code":"NG","type":"education","lineage":["https://openalex.org/I44738892"]},{"id":"https://openalex.org/I919958821","display_name":"Bayero University Kano","ror":"https://ror.org/049pzty39","country_code":"NG","type":"education","lineage":["https://openalex.org/I919958821"]}],"countries":["GB","NG"],"is_corresponding":false,"raw_author_name":"Mustafa Irshad","raw_affiliation_strings":["Computer Engineering from Bayero University Kano, Nigeria in 2012,","School of Computer Science and Technology University of Bedfordshire","Security and Digital Forensics (Distinction) from University of Bedfordshire, UK","State University Makurdi, Nigeria,","University Square, Luton, Bedfordshire, LU1 3JU, UK","University of Bedfordshire, UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Computer Engineering from Bayero University Kano, Nigeria in 2012,","institution_ids":["https://openalex.org/I919958821"]},{"raw_affiliation_string":"School of Computer Science and Technology University of Bedfordshire","institution_ids":[]},{"raw_affiliation_string":"Security and Digital Forensics (Distinction) from University of Bedfordshire, UK","institution_ids":["https://openalex.org/I147554453"]},{"raw_affiliation_string":"State University Makurdi, Nigeria,","institution_ids":["https://openalex.org/I44738892"]},{"raw_affiliation_string":"University Square, Luton, Bedfordshire, LU1 3JU, UK","institution_ids":["https://openalex.org/I147554453"]},{"raw_affiliation_string":"University of Bedfordshire, UK","institution_ids":["https://openalex.org/I147554453"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5015951925","display_name":"Haider Al\u2010Khateeb","orcid":"https://orcid.org/0000-0001-8944-123X"},"institutions":[{"id":"https://openalex.org/I147554453","display_name":"University of Bedfordshire","ror":"https://ror.org/0400avk24","country_code":"GB","type":"education","lineage":["https://openalex.org/I147554453"]},{"id":"https://openalex.org/I44738892","display_name":"Joseph Sarwuan Tarka University Makurdi","ror":"https://ror.org/05hgtp764","country_code":"NG","type":"education","lineage":["https://openalex.org/I44738892"]},{"id":"https://openalex.org/I919958821","display_name":"Bayero University Kano","ror":"https://ror.org/049pzty39","country_code":"NG","type":"education","lineage":["https://openalex.org/I919958821"]}],"countries":["GB","NG"],"is_corresponding":false,"raw_author_name":"Haider M. Al Khateeb","raw_affiliation_strings":["Computer Engineering from Bayero University Kano, Nigeria in 2012,","School of Computer Science and Technology University of Bedfordshire","Security and Digital Forensics (Distinction) from University of Bedfordshire, UK","State University Makurdi, Nigeria,","University Square, Luton, Bedfordshire, LU1 3JU, UK","University of Bedfordshire, UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Computer Engineering from Bayero University Kano, Nigeria in 2012,","institution_ids":["https://openalex.org/I919958821"]},{"raw_affiliation_string":"School of Computer Science and Technology University of Bedfordshire","institution_ids":[]},{"raw_affiliation_string":"Security and Digital Forensics (Distinction) from University of Bedfordshire, UK","institution_ids":["https://openalex.org/I147554453"]},{"raw_affiliation_string":"State University Makurdi, Nigeria,","institution_ids":["https://openalex.org/I44738892"]},{"raw_affiliation_string":"University Square, Luton, Bedfordshire, LU1 3JU, UK","institution_ids":["https://openalex.org/I147554453"]},{"raw_affiliation_string":"University of Bedfordshire, UK","institution_ids":["https://openalex.org/I147554453"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.2639,"has_fulltext":true,"cited_by_count":10,"citation_normalized_percentile":{"value":0.81818182,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":97},"biblio":{"volume":"10","issue":"2","first_page":"138","last_page":"138"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9884999990463257,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9871000051498413,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.8511075377464294},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8332457542419434},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.47653159499168396},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.3827448785305023}],"concepts":[{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.8511075377464294},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8332457542419434},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.47653159499168396},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3827448785305023}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1504/ijesdf.2018.10011975","is_oa":true,"landing_page_url":"https://doi.org/10.1504/ijesdf.2018.10011975","pdf_url":"https://www.inderscienceonline.com/doi/full/10.1504/IJESDF.2018.090948","source":{"id":"https://openalex.org/S198660693","display_name":"International Journal of Electronic Security and Digital Forensics","issn_l":"1751-911X","issn":["1751-911X","1751-9128"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310317825","host_organization_name":"Inderscience Publishers","host_organization_lineage":["https://openalex.org/P4310317825"],"host_organization_lineage_names":["Inderscience Publishers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal of Electronic Security and Digital Forensics","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1504/ijesdf.2018.10011975","is_oa":true,"landing_page_url":"https://doi.org/10.1504/ijesdf.2018.10011975","pdf_url":"https://www.inderscienceonline.com/doi/full/10.1504/IJESDF.2018.090948","source":{"id":"https://openalex.org/S198660693","display_name":"International Journal of Electronic Security and Digital Forensics","issn_l":"1751-911X","issn":["1751-911X","1751-9128"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310317825","host_organization_name":"Inderscience Publishers","host_organization_lineage":["https://openalex.org/P4310317825"],"host_organization_lineage_names":["Inderscience Publishers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal of Electronic Security and Digital Forensics","raw_type":"journal-article"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.4099999964237213,"id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W2794748563.pdf","grobid_xml":"https://content.openalex.org/works/W2794748563.grobid-xml"},"referenced_works_count":58,"referenced_works":["https://openalex.org/W125551951","https://openalex.org/W140639879","https://openalex.org/W1542951322","https://openalex.org/W1652196843","https://openalex.org/W1966150547","https://openalex.org/W1971911274","https://openalex.org/W1973211701","https://openalex.org/W1974326986","https://openalex.org/W1982193684","https://openalex.org/W1986778261","https://openalex.org/W1986989387","https://openalex.org/W2001496424","https://openalex.org/W2003791967","https://openalex.org/W2005491441","https://openalex.org/W2011009207","https://openalex.org/W2013346350","https://openalex.org/W2021059700","https://openalex.org/W2021436318","https://openalex.org/W2044751544","https://openalex.org/W2045756085","https://openalex.org/W2054093027","https://openalex.org/W2066220442","https://openalex.org/W2066833290","https://openalex.org/W2069640103","https://openalex.org/W2076952382","https://openalex.org/W2079215333","https://openalex.org/W2090858760","https://openalex.org/W2092446507","https://openalex.org/W2111574103","https://openalex.org/W2114065168","https://openalex.org/W2127969088","https://openalex.org/W2129294800","https://openalex.org/W2145056020","https://openalex.org/W2150423842","https://openalex.org/W2154871153","https://openalex.org/W2156570058","https://openalex.org/W2157153057","https://openalex.org/W2170060345","https://openalex.org/W2183310907","https://openalex.org/W2185177440","https://openalex.org/W2186336457","https://openalex.org/W2205761907","https://openalex.org/W2246811656","https://openalex.org/W2293617811","https://openalex.org/W2347098755","https://openalex.org/W2512987138","https://openalex.org/W2539582590","https://openalex.org/W2547841473","https://openalex.org/W2564494760","https://openalex.org/W2569607704","https://openalex.org/W2998066361","https://openalex.org/W3105952379","https://openalex.org/W4254029842","https://openalex.org/W4254552916","https://openalex.org/W4381304672","https://openalex.org/W4391285994","https://openalex.org/W6682777827","https://openalex.org/W6835688855"],"related_works":["https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W2097492617","https://openalex.org/W2753240997","https://openalex.org/W1764168690","https://openalex.org/W2537959205","https://openalex.org/W2740895074","https://openalex.org/W3152891574","https://openalex.org/W4284893819","https://openalex.org/W4366249425"],"abstract_inverted_index":{"The":[0,43,74],"succeeding":[1],"code":[2,31,33,100,108],"for":[3],"metamorphic":[4,97],"Malware":[5],"is":[6,19,49],"routinely":[7],"rewritten":[8],"to":[9,50,106],"remain":[10],"stealthy":[11],"and":[12,25,35,87,109,125,134],"undetected":[13],"within":[14],"infected":[15],"environments.":[16],"This":[17],"characteristic":[18],"maintained":[20],"by":[21],"means":[22],"of":[23,46,58,76,96,103,119],"encryption":[24],"decryption":[26],"methods,":[27],"obfuscation":[28],"through":[29],"garbage":[30],"insertion,":[32],"transformation":[34],"registry":[36],"modification":[37],"which":[38],"makes":[39],"detection":[40,79,95],"very":[41],"challenging.":[42],"main":[44],"objective":[45],"this":[47,67],"study":[48],"contribute":[51],"an":[52],"evidence-based":[53],"narrative":[54],"demonstrating":[55],"the":[56,77,94,117],"effectiveness":[57],"recent":[59],"proposals.":[60],"Sixteen":[61],"primary":[62],"studies":[63],"were":[64,113],"included":[65],"in":[66],"analysis":[68],"based":[69],"on":[70,116],"a":[71],"pre-defined":[72],"protocol.":[73],"majority":[75],"reviewed":[78],"methods":[80],"used":[81],"Opcode,":[82],"Control":[83],"Flow":[84],"Graph":[85],"(CFG)":[86],"API":[88],"Call":[89],"Graph.":[90],"Key":[91],"challenges":[92],"facing":[93],"malware":[98],"include":[99],"obfuscation,":[101],"lack":[102],"dynamic":[104],"capabilities":[105],"analyse":[107],"application":[110],"difficulty.":[111],"Methods":[112],"further":[114],"analysed":[115],"basis":[118],"their":[120],"approach,":[121],"limitation,":[122],"empirical":[123],"evidence":[124],"key":[126],"parameters":[127],"such":[128],"as":[129],"dataset,":[130],"Detection":[131],"Rate":[132,137],"(DR)":[133],"False":[135],"Positive":[136],"(FPR).":[138]},"counts_by_year":[{"year":2021,"cited_by_count":4},{"year":2020,"cited_by_count":1},{"year":2019,"cited_by_count":3},{"year":2018,"cited_by_count":2}],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2025-10-10T00:00:00"}