{"id":"https://openalex.org/W2975826887","doi":"https://doi.org/10.3233/jcs-191292","title":"Decoupling coding habits from functionality for effective binary authorship attribution","display_name":"Decoupling coding habits from functionality for effective binary authorship attribution","publication_year":2019,"publication_date":"2019-09-26","ids":{"openalex":"https://openalex.org/W2975826887","doi":"https://doi.org/10.3233/jcs-191292","mag":"2975826887"},"language":"en","primary_location":{"id":"doi:10.3233/jcs-191292","is_oa":false,"landing_page_url":"https://doi.org/10.3233/jcs-191292","pdf_url":null,"source":{"id":"https://openalex.org/S106992369","display_name":"Journal of Computer Security","issn_l":"0926-227X","issn":["0926-227X","1875-8924"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310318577","host_organization_name":"IOS Press","host_organization_lineage":["https://openalex.org/P4310318577"],"host_organization_lineage_names":["IOS Press"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Computer Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5000085565","display_name":"Saed Alrabaee","orcid":"https://orcid.org/0000-0001-8842-493X"},"institutions":[{"id":"https://openalex.org/I201726411","display_name":"United Arab Emirates University","ror":"https://ror.org/01km6p862","country_code":"AE","type":"education","lineage":["https://openalex.org/I201726411"]}],"countries":["AE"],"is_corresponding":true,"raw_author_name":"Saed Alrabaee","raw_affiliation_strings":["Information Systems and Security, CIT, United Arab Emirates University, Al Ain, UAE. E-mail:\u00a0","Information Systems and Security, CIT, United Arab Emirates University, Al Ain, UAE. E-mail:\u00a0salrabaee@uaeu.ac.ae"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Information Systems and Security, CIT, United Arab Emirates University, Al Ain, UAE. E-mail:\u00a0","institution_ids":["https://openalex.org/I201726411"]},{"raw_affiliation_string":"Information Systems and Security, CIT, United Arab Emirates University, Al Ain, UAE. E-mail:\u00a0salrabaee@uaeu.ac.ae","institution_ids":["https://openalex.org/I201726411"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5019530993","display_name":"Paria Shirani","orcid":"https://orcid.org/0000-0001-5592-1518"},"institutions":[{"id":"https://openalex.org/I60158472","display_name":"Concordia University","ror":"https://ror.org/0420zvk78","country_code":"CA","type":"education","lineage":["https://openalex.org/I60158472"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Paria Shirani","raw_affiliation_strings":["CIISE, Concordia University, Montreal, QC, Canada. E-mails:\u00a0,\u00a0,\u00a0","CIISE, Concordia University, Montreal, QC, Canada. E-mails:\u00a0p_shira@encs.concordia.ca,\u00a0wang@ciise.concordia.ca,\u00a0debbabi@ciise.concordia.ca"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"CIISE, Concordia University, Montreal, QC, Canada. E-mails:\u00a0,\u00a0,\u00a0","institution_ids":["https://openalex.org/I60158472"]},{"raw_affiliation_string":"CIISE, Concordia University, Montreal, QC, Canada. E-mails:\u00a0p_shira@encs.concordia.ca,\u00a0wang@ciise.concordia.ca,\u00a0debbabi@ciise.concordia.ca","institution_ids":["https://openalex.org/I60158472"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100730397","display_name":"Lingyu Wang","orcid":"https://orcid.org/0000-0002-7441-7541"},"institutions":[{"id":"https://openalex.org/I60158472","display_name":"Concordia University","ror":"https://ror.org/0420zvk78","country_code":"CA","type":"education","lineage":["https://openalex.org/I60158472"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Lingyu Wang","raw_affiliation_strings":["CIISE, Concordia University, Montreal, QC, Canada. E-mails:\u00a0,\u00a0,\u00a0","CIISE, Concordia University, Montreal, QC, Canada. E-mails:\u00a0p_shira@encs.concordia.ca,\u00a0wang@ciise.concordia.ca,\u00a0debbabi@ciise.concordia.ca"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"CIISE, Concordia University, Montreal, QC, Canada. E-mails:\u00a0,\u00a0,\u00a0","institution_ids":["https://openalex.org/I60158472"]},{"raw_affiliation_string":"CIISE, Concordia University, Montreal, QC, Canada. E-mails:\u00a0p_shira@encs.concordia.ca,\u00a0wang@ciise.concordia.ca,\u00a0debbabi@ciise.concordia.ca","institution_ids":["https://openalex.org/I60158472"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5028605138","display_name":"Mourad Debbabi","orcid":"https://orcid.org/0000-0003-3015-3043"},"institutions":[{"id":"https://openalex.org/I60158472","display_name":"Concordia University","ror":"https://ror.org/0420zvk78","country_code":"CA","type":"education","lineage":["https://openalex.org/I60158472"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Mourad Debbabi","raw_affiliation_strings":["CIISE, Concordia University, Montreal, QC, Canada. E-mails:\u00a0,\u00a0,\u00a0","CIISE, Concordia University, Montreal, QC, Canada. E-mails:\u00a0p_shira@encs.concordia.ca,\u00a0wang@ciise.concordia.ca,\u00a0debbabi@ciise.concordia.ca"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"CIISE, Concordia University, Montreal, QC, Canada. E-mails:\u00a0,\u00a0,\u00a0","institution_ids":["https://openalex.org/I60158472"]},{"raw_affiliation_string":"CIISE, Concordia University, Montreal, QC, Canada. E-mails:\u00a0p_shira@encs.concordia.ca,\u00a0wang@ciise.concordia.ca,\u00a0debbabi@ciise.concordia.ca","institution_ids":["https://openalex.org/I60158472"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5022528241","display_name":"Aiman Hanna","orcid":"https://orcid.org/0000-0002-2657-0154"},"institutions":[{"id":"https://openalex.org/I4210148195","display_name":"Concordia University","ror":"https://ror.org/04dwckp88","country_code":"US","type":"education","lineage":["https://openalex.org/I4210148195"]},{"id":"https://openalex.org/I60158472","display_name":"Concordia University","ror":"https://ror.org/0420zvk78","country_code":"CA","type":"education","lineage":["https://openalex.org/I60158472"]}],"countries":["CA","US"],"is_corresponding":false,"raw_author_name":"Aiman Hanna","raw_affiliation_strings":["Computer Science, Concordia University, Montreal, QC, Canada. E-mail:\u00a0","Computer Science, Concordia University, Montreal, QC, Canada. E-mail:\u00a0contact@aimanhanna.com"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Computer Science, Concordia University, Montreal, QC, Canada. E-mail:\u00a0","institution_ids":["https://openalex.org/I60158472","https://openalex.org/I4210148195"]},{"raw_affiliation_string":"Computer Science, Concordia University, Montreal, QC, Canada. E-mail:\u00a0contact@aimanhanna.com","institution_ids":["https://openalex.org/I60158472"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":5,"corresponding_author_ids":["https://openalex.org/A5000085565"],"corresponding_institution_ids":["https://openalex.org/I201726411"],"apc_list":null,"apc_paid":null,"fwci":0.8347,"has_fulltext":false,"cited_by_count":10,"citation_normalized_percentile":{"value":0.73596737,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":98},"biblio":{"volume":"27","issue":"6","first_page":"613","last_page":"648"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.998199999332428,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.998199999332428,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12380","display_name":"Authorship Attribution and Profiling","score":0.9824000000953674,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.972599983215332,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8400944471359253},{"id":"https://openalex.org/keywords/binary-number","display_name":"Binary number","score":0.6489681601524353},{"id":"https://openalex.org/keywords/code-refactoring","display_name":"Code refactoring","score":0.6469197273254395},{"id":"https://openalex.org/keywords/source-code","display_name":"Source code","score":0.6194165945053101},{"id":"https://openalex.org/keywords/coding","display_name":"Coding (social sciences)","score":0.5828859806060791},{"id":"https://openalex.org/keywords/binary-code","display_name":"Binary code","score":0.568057119846344},{"id":"https://openalex.org/keywords/compiler","display_name":"Compiler","score":0.5608446598052979},{"id":"https://openalex.org/keywords/reverse-engineering","display_name":"Reverse engineering","score":0.4579935669898987},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.326476514339447},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.2617396414279938}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8400944471359253},{"id":"https://openalex.org/C48372109","wikidata":"https://www.wikidata.org/wiki/Q3913","display_name":"Binary number","level":2,"score":0.6489681601524353},{"id":"https://openalex.org/C152752567","wikidata":"https://www.wikidata.org/wiki/Q116877","display_name":"Code refactoring","level":3,"score":0.6469197273254395},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.6194165945053101},{"id":"https://openalex.org/C179518139","wikidata":"https://www.wikidata.org/wiki/Q5140297","display_name":"Coding (social sciences)","level":2,"score":0.5828859806060791},{"id":"https://openalex.org/C63435697","wikidata":"https://www.wikidata.org/wiki/Q864135","display_name":"Binary code","level":3,"score":0.568057119846344},{"id":"https://openalex.org/C169590947","wikidata":"https://www.wikidata.org/wiki/Q47506","display_name":"Compiler","level":2,"score":0.5608446598052979},{"id":"https://openalex.org/C207850805","wikidata":"https://www.wikidata.org/wiki/Q269608","display_name":"Reverse engineering","level":2,"score":0.4579935669898987},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.326476514339447},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.2617396414279938},{"id":"https://openalex.org/C94375191","wikidata":"https://www.wikidata.org/wiki/Q11205","display_name":"Arithmetic","level":1,"score":0.0},{"id":"https://openalex.org/C105795698","wikidata":"https://www.wikidata.org/wiki/Q12483","display_name":"Statistics","level":1,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.3233/jcs-191292","is_oa":false,"landing_page_url":"https://doi.org/10.3233/jcs-191292","pdf_url":null,"source":{"id":"https://openalex.org/S106992369","display_name":"Journal of Computer Security","issn_l":"0926-227X","issn":["0926-227X","1875-8924"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310318577","host_organization_name":"IOS Press","host_organization_lineage":["https://openalex.org/P4310318577"],"host_organization_lineage_names":["IOS Press"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Computer Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":53,"referenced_works":["https://openalex.org/W14188531","https://openalex.org/W54929040","https://openalex.org/W58545800","https://openalex.org/W90413272","https://openalex.org/W165726963","https://openalex.org/W765936379","https://openalex.org/W1463623766","https://openalex.org/W1540596182","https://openalex.org/W1574086225","https://openalex.org/W1575961892","https://openalex.org/W1580559113","https://openalex.org/W1779974843","https://openalex.org/W2006985892","https://openalex.org/W2010452235","https://openalex.org/W2013759182","https://openalex.org/W2019608710","https://openalex.org/W2020563325","https://openalex.org/W2030906223","https://openalex.org/W2038276547","https://openalex.org/W2050520440","https://openalex.org/W2082594235","https://openalex.org/W2090836891","https://openalex.org/W2092942461","https://openalex.org/W2096921767","https://openalex.org/W2098262260","https://openalex.org/W2102833942","https://openalex.org/W2106053110","https://openalex.org/W2110792853","https://openalex.org/W2112725702","https://openalex.org/W2119804197","https://openalex.org/W2128859735","https://openalex.org/W2129364433","https://openalex.org/W2150188172","https://openalex.org/W2151505086","https://openalex.org/W2153887189","https://openalex.org/W2154053567","https://openalex.org/W2155535003","https://openalex.org/W2156279557","https://openalex.org/W2159702664","https://openalex.org/W2162833336","https://openalex.org/W2170060345","https://openalex.org/W2308071406","https://openalex.org/W2516577067","https://openalex.org/W2564822508","https://openalex.org/W2620895032","https://openalex.org/W2627063456","https://openalex.org/W2742948365","https://openalex.org/W2790751137","https://openalex.org/W2806869036","https://openalex.org/W2886161275","https://openalex.org/W2941288924","https://openalex.org/W3014224367","https://openalex.org/W4247464060"],"related_works":["https://openalex.org/W4313549863","https://openalex.org/W194942058","https://openalex.org/W2991900792","https://openalex.org/W2088986462","https://openalex.org/W1985388819","https://openalex.org/W2055981842","https://openalex.org/W2765199869","https://openalex.org/W1638297612","https://openalex.org/W2034043169","https://openalex.org/W2161708016"],"abstract_inverted_index":{"Binary":[0],"authorship":[1,92,103,253],"attribution":[2,104],"refers":[3],"to":[4,23,36,50,67,116,241,258,261,272],"the":[5,9,25,37,69,196,237],"process":[6],"of":[7,11,32,39,131,150,157,183],"identifying":[8],"author":[10,58],"a":[12,40,64,76,110,128,148,180,186],"given":[13,65],"anonymous":[14],"binary":[15,41,66,112,140],"file":[16],"based":[17,154,194],"on":[18,155,195,276],"stylistic":[19],"characteristics.":[20],"It":[21],"aims":[22],"automate":[24],"laborious":[26],"and":[27,59,89,217,246,270],"error-prone":[28],"reverse":[29],"engineering":[30],"task":[31],"discovering":[33],"information":[34],"related":[35],"author(s)":[38],"code.":[42,141],"Existing":[43],"works":[44,74],"typically":[45],"employ":[46],"machine":[47],"learning":[48],"methods":[49,172],"extract":[51],"features":[52,85,151],"that":[53,152,168],"are":[54,153],"unique":[55,108],"for":[56,101],"each":[57],"subsequently":[60],"match":[61],"them":[62],"against":[63],"identify":[68],"author.":[70],"However,":[71],"most":[72],"existing":[73,171],"share":[75],"common":[77],"critical":[78],"limitation,":[79],"i.e.,":[80],"they":[81],"cannot":[82],"distinguish":[83],"between":[84],"representing":[86,91],"program":[87,133],"functionality":[88,134,255],"those":[90],"(e.g.,":[93],"authors\u2019":[94,136],"coding":[95,137,144,278],"habits).":[96],"Such":[97],"distinction":[98],"is":[99,107,223,230,239],"crucial":[100],"effective":[102],"because":[105],"what":[106],"in":[109,139,173,207,234],"particular":[111],"may":[113],"be":[114],"attributed":[115],"either":[117],"author,":[118],"compiler,":[119],"or":[120],"function.":[121],"In":[122],"this":[123],"study,":[124],"we":[125],"present":[126],"BinAuthor":[127,146,169,222,260],"system":[129],"capable":[130],"decoupling":[132,252],"from":[135,200,254],"habits":[138],"To":[142],"capture":[143],"habits,":[145],"leverages":[147],"set":[149],"collections":[156],"functionality-independent":[158],"choices":[159],"made":[160],"by":[161],"authors":[162,184],"during":[163],"coding.":[164],"Our":[165],"evaluation":[166],"demonstrates":[167],"outperforms":[170],"several":[174,218],"aspects.":[175],"First,":[176],"it":[177],"successfully":[178],"attributes":[179],"larger":[181],"number":[182],"with":[185,248],"significantly":[187],"higher":[188],"accuracy":[189,235],"(around":[190],"[Formula:":[191],"see":[192,204],"text])":[193],"large":[197],"datasets":[198],"extracted":[199],"selected":[201],"open-source":[202],"C[Formula:":[203],"text]":[205],"projects":[206],"GitHub,":[208],"Google":[209],"Code":[210,215],"Jam":[211],"events,":[212],"Planet":[213],"Source":[214],"contests,":[216],"programming":[219],"projects.":[220],"Second,":[221],"more":[224],"robust":[225],"than":[226],"previous":[227],"methods;":[228],"there":[229],"no":[231],"significant":[232],"drop":[233],"when":[236],"code":[238],"subjected":[240],"refactoring":[242],"techniques,":[243],"simple":[244],"obfuscation,":[245],"processed":[247],"different":[249],"compilers.":[250],"Finally,":[251],"allows":[256],"us":[257],"apply":[259],"real":[262],"malware":[263],"binaries":[264],"(Citadel,":[265],"Zeus,":[266],"Stuxnet,":[267],"Flame,":[268],"Bunny,":[269],"Babar)":[271],"automatically":[273],"generate":[274],"evidence":[275],"similar":[277],"habits.":[279]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":1},{"year":2024,"cited_by_count":2},{"year":2023,"cited_by_count":1},{"year":2022,"cited_by_count":2},{"year":2021,"cited_by_count":1},{"year":2020,"cited_by_count":2}],"updated_date":"2026-06-07T08:38:57.713557","created_date":"2025-10-10T00:00:00"}