{"id":"https://openalex.org/W4401610149","doi":"https://doi.org/10.23919/ifipnetworking62109.2024.10619782","title":"MalFusion: Simple String Manipulations Confuse Malware Detection","display_name":"MalFusion: Simple String Manipulations Confuse Malware Detection","publication_year":2024,"publication_date":"2024-06-03","ids":{"openalex":"https://openalex.org/W4401610149","doi":"https://doi.org/10.23919/ifipnetworking62109.2024.10619782"},"language":"en","primary_location":{"id":"doi:10.23919/ifipnetworking62109.2024.10619782","is_oa":false,"landing_page_url":"http://dx.doi.org/10.23919/ifipnetworking62109.2024.10619782","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2024 IFIP Networking Conference (IFIP Networking)","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5010171705","display_name":"Sri Shaila G","orcid":null},"institutions":[{"id":"https://openalex.org/I4210108451","display_name":"Palo Alto Networks (United States)","ror":"https://ror.org/01rn6rn86","country_code":"US","type":"company","lineage":["https://openalex.org/I4210108451"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Sri Shaila G","raw_affiliation_strings":["Palo Alto Networks"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Palo Alto Networks","institution_ids":["https://openalex.org/I4210108451"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5018876909","display_name":"Michalis Faloutsos","orcid":"https://orcid.org/0000-0002-3882-9987"},"institutions":[{"id":"https://openalex.org/I103635307","display_name":"University of California, Riverside","ror":"https://ror.org/03nawhv43","country_code":"US","type":"education","lineage":["https://openalex.org/I103635307"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Michalis Faloutsos","raw_affiliation_strings":["University of California,Riverside"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of California,Riverside","institution_ids":["https://openalex.org/I103635307"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.13099211,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"113","last_page":"121"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9933000206947327,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9929999709129333,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.8351716995239258},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7561442852020264},{"id":"https://openalex.org/keywords/simple","display_name":"Simple (philosophy)","score":0.6988802552223206},{"id":"https://openalex.org/keywords/string","display_name":"String (physics)","score":0.6033077836036682},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.4567100405693054},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.39395251870155334},{"id":"https://openalex.org/keywords/mathematics","display_name":"Mathematics","score":0.15719282627105713}],"concepts":[{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.8351716995239258},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7561442852020264},{"id":"https://openalex.org/C2780586882","wikidata":"https://www.wikidata.org/wiki/Q7520643","display_name":"Simple (philosophy)","level":2,"score":0.6988802552223206},{"id":"https://openalex.org/C157486923","wikidata":"https://www.wikidata.org/wiki/Q1376436","display_name":"String (physics)","level":2,"score":0.6033077836036682},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4567100405693054},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.39395251870155334},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.15719282627105713},{"id":"https://openalex.org/C111472728","wikidata":"https://www.wikidata.org/wiki/Q9471","display_name":"Epistemology","level":1,"score":0.0},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0},{"id":"https://openalex.org/C37914503","wikidata":"https://www.wikidata.org/wiki/Q156495","display_name":"Mathematical physics","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.23919/ifipnetworking62109.2024.10619782","is_oa":false,"landing_page_url":"http://dx.doi.org/10.23919/ifipnetworking62109.2024.10619782","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2024 IFIP Networking Conference (IFIP Networking)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G289326564","display_name":"SaTC: CORE: Small: SOFIA: Finding and profiling malware source-code in public archives at scale","funder_award_id":"2132642","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":47,"referenced_works":["https://openalex.org/W94487276","https://openalex.org/W755860182","https://openalex.org/W1445387515","https://openalex.org/W2014742088","https://openalex.org/W2074891727","https://openalex.org/W2084979543","https://openalex.org/W2095720311","https://openalex.org/W2104839588","https://openalex.org/W2461373307","https://openalex.org/W2625739732","https://openalex.org/W2744095836","https://openalex.org/W2749572357","https://openalex.org/W2794652108","https://openalex.org/W2932977083","https://openalex.org/W2942795289","https://openalex.org/W2949639282","https://openalex.org/W2961099251","https://openalex.org/W2972021782","https://openalex.org/W2982596671","https://openalex.org/W2987962504","https://openalex.org/W2998066361","https://openalex.org/W3003440657","https://openalex.org/W3014224367","https://openalex.org/W3029868457","https://openalex.org/W3095312831","https://openalex.org/W3104158743","https://openalex.org/W3107723856","https://openalex.org/W3109112485","https://openalex.org/W3109130616","https://openalex.org/W3113371616","https://openalex.org/W3129214326","https://openalex.org/W3159521830","https://openalex.org/W3168097936","https://openalex.org/W3206660056","https://openalex.org/W3206706367","https://openalex.org/W4210864560","https://openalex.org/W4247464060","https://openalex.org/W4301864181","https://openalex.org/W4306406262","https://openalex.org/W4387880891","https://openalex.org/W4389075571","https://openalex.org/W6628532452","https://openalex.org/W6718890697","https://openalex.org/W6767470819","https://openalex.org/W6778140923","https://openalex.org/W6784880316","https://openalex.org/W6794840795"],"related_works":["https://openalex.org/W2097492617","https://openalex.org/W2753240997","https://openalex.org/W1764168690","https://openalex.org/W2537959205","https://openalex.org/W2740895074","https://openalex.org/W2772446090","https://openalex.org/W4284893819","https://openalex.org/W2249809453","https://openalex.org/W3152891574","https://openalex.org/W4316881845"],"abstract_inverted_index":{"We":[0,31,72],"explore":[1],"how":[2,163],"a":[3,38],"hacker":[4],"confuse":[5,43],"malware":[6,27,48,134,190],"detection":[7],"engines":[8,20,45,95,106,148,171,185],"with":[9,79,186],"minimal":[10],"effort.":[11],"As":[12],"our":[13,33,57,126,155],"overarching":[14,100],"contribution,":[15],"we":[16,91,120,145,161,177],"show":[17,121,162],"that":[18,103,122,147,179],"such":[19,113],"can":[21],"be":[22,61],"easily":[23],"manipulated":[24],"to":[25,40,60,133,164,194],"misclassify":[26,172],"and":[28,42,49,66,82,87,90],"benign":[29,174],"binaries.":[30,175],"substantiate":[32],"claim":[34],"by":[35,97,169],"developing":[36],"MalFusion,":[37],"framework":[39],"stress-test":[41],"anti-malware":[44,94,105],"in":[46,116],"identifying":[47],"its":[50],"family":[51],"type.":[52],"The":[53,99],"design":[54],"goal":[55],"for":[56,85],"method":[58],"is":[59,102,131,181],"as":[62,64,114,142,158],"simple":[63,127],"possible":[65],"without":[67],"changing":[68],"the":[69,104,138],"binary":[70],"functionality.":[71],"apply":[73],"MalFusion":[74],"on":[75,109,189],"1750":[76],"binaries":[77,139,157,191],"compiled":[78],"different":[80],"compilers":[81],"compiler":[83],"options":[84],"ARM":[86],"MIPS":[88],"architectures":[89],"use":[92],"71":[93],"provided":[96],"VirusTotal.":[98],"observation":[101],"rely":[107],"heavily":[108],"source-level":[110],"string":[111,128],"matching":[112],"strings":[115],"printf":[117],"commands.":[118],"First,":[119],"when":[123],"one":[124],"of":[125,137],"manipulation":[129],"techniques":[130],"applied":[132],"source-code,":[135],"100%":[136],"are":[140,192],"deemed":[141],"benign.":[143],"Second,":[144],"observe":[146,178],"learn:":[149],"within":[150],"two":[151],"weeks,":[152],"they":[153],"identify":[154],"modified":[156],"malware.":[159],"Third,":[160],"exploit":[165],"this":[166],"\u201clearning\u201d":[167],"capability":[168],"making":[170],"string-modified":[173],"Finally,":[176],"there":[180],"no":[182],"free":[183],"lunch:":[184],"higher":[187],"recall":[188],"prone":[193],"false":[195],"nositives.":[196]},"counts_by_year":[],"updated_date":"2026-06-22T08:00:12.763002","created_date":"2025-10-10T00:00:00"}