{"id":"https://openalex.org/W3158446351","doi":"https://doi.org/10.3390/e23050507","title":"Hfinger: Malware HTTP Request Fingerprinting","display_name":"Hfinger: Malware HTTP Request Fingerprinting","publication_year":2021,"publication_date":"2021-04-23","ids":{"openalex":"https://openalex.org/W3158446351","doi":"https://doi.org/10.3390/e23050507","mag":"3158446351","pmid":"https://pubmed.ncbi.nlm.nih.gov/33922568"},"language":"en","primary_location":{"id":"doi:10.3390/e23050507","is_oa":true,"landing_page_url":"https://doi.org/10.3390/e23050507","pdf_url":"https://www.mdpi.com/1099-4300/23/5/507/pdf?version=1619172308","source":{"id":"https://openalex.org/S195231649","display_name":"Entropy","issn_l":"1099-4300","issn":["1099-4300"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Entropy","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj","pubmed"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://www.mdpi.com/1099-4300/23/5/507/pdf?version=1619172308","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5038764329","display_name":"Piotr Bia\u0142czak","orcid":"https://orcid.org/0000-0002-4077-5885"},"institutions":[{"id":"https://openalex.org/I108403487","display_name":"Warsaw University of Technology","ror":"https://ror.org/00y0xnp53","country_code":"PL","type":"education","lineage":["https://openalex.org/I108403487"]},{"id":"https://openalex.org/I4210087266","display_name":"Institute of Computer Science","ror":"https://ror.org/003fvp964","country_code":"PL","type":"facility","lineage":["https://openalex.org/I4210087266","https://openalex.org/I99542240"]},{"id":"https://openalex.org/I4210136276","display_name":"NASK National Research Institute","ror":"https://ror.org/03ajsaw82","country_code":"PL","type":"facility","lineage":["https://openalex.org/I4210136276"]}],"countries":["PL"],"is_corresponding":true,"raw_author_name":"Piotr Bia\u0142czak","raw_affiliation_strings":["CERT Polska/Research and Academic Computer Network (NASK), Kolska 12, 01-045 Warsaw, Poland","Institute of Computer Science, Warsaw University of Technology, Nowowiejska 15/19, 00-665 Warsaw, Poland"],"raw_orcid":"https://orcid.org/0000-0002-4077-5885","affiliations":[{"raw_affiliation_string":"CERT Polska/Research and Academic Computer Network (NASK), Kolska 12, 01-045 Warsaw, Poland","institution_ids":["https://openalex.org/I4210136276"]},{"raw_affiliation_string":"Institute of Computer Science, Warsaw University of Technology, Nowowiejska 15/19, 00-665 Warsaw, Poland","institution_ids":["https://openalex.org/I108403487","https://openalex.org/I4210087266"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5089469997","display_name":"Wojciech Mazurczyk","orcid":"https://orcid.org/0000-0002-8509-4127"},"institutions":[{"id":"https://openalex.org/I108403487","display_name":"Warsaw University of Technology","ror":"https://ror.org/00y0xnp53","country_code":"PL","type":"education","lineage":["https://openalex.org/I108403487"]},{"id":"https://openalex.org/I4210087266","display_name":"Institute of Computer Science","ror":"https://ror.org/003fvp964","country_code":"PL","type":"facility","lineage":["https://openalex.org/I4210087266","https://openalex.org/I99542240"]}],"countries":["PL"],"is_corresponding":false,"raw_author_name":"Wojciech Mazurczyk","raw_affiliation_strings":["Institute of Computer Science, Warsaw University of Technology, Nowowiejska 15/19, 00-665 Warsaw, Poland"],"raw_orcid":"https://orcid.org/0000-0002-8509-4127","affiliations":[{"raw_affiliation_string":"Institute of Computer Science, Warsaw University of Technology, Nowowiejska 15/19, 00-665 Warsaw, Poland","institution_ids":["https://openalex.org/I108403487","https://openalex.org/I4210087266"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":["https://openalex.org/A5038764329"],"corresponding_institution_ids":["https://openalex.org/I108403487","https://openalex.org/I4210087266","https://openalex.org/I4210136276"],"apc_list":{"value":2000,"currency":"CHF","value_usd":2227},"apc_paid":{"value":2000,"currency":"CHF","value_usd":2227},"fwci":0.7795,"has_fulltext":true,"cited_by_count":8,"citation_normalized_percentile":{"value":0.7263546,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":97},"biblio":{"volume":"23","issue":"5","first_page":"507","last_page":"507"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8679977655410767},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.8520119786262512},{"id":"https://openalex.org/keywords/protocol","display_name":"Protocol (science)","score":0.5945832133293152},{"id":"https://openalex.org/keywords/payload","display_name":"Payload (computing)","score":0.5627226233482361},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.4657754600048065},{"id":"https://openalex.org/keywords/malware-analysis","display_name":"Malware analysis","score":0.4461739659309387},{"id":"https://openalex.org/keywords/representation","display_name":"Representation (politics)","score":0.42263099551200867},{"id":"https://openalex.org/keywords/hypertext-transfer-protocol","display_name":"Hypertext Transfer Protocol","score":0.4166105091571808},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.39626142382621765},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.36967745423316956},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.25389212369918823},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.16426876187324524},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.0995381772518158}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8679977655410767},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.8520119786262512},{"id":"https://openalex.org/C2780385302","wikidata":"https://www.wikidata.org/wiki/Q367158","display_name":"Protocol (science)","level":3,"score":0.5945832133293152},{"id":"https://openalex.org/C134066672","wikidata":"https://www.wikidata.org/wiki/Q1424639","display_name":"Payload (computing)","level":3,"score":0.5627226233482361},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.4657754600048065},{"id":"https://openalex.org/C2779395397","wikidata":"https://www.wikidata.org/wiki/Q15731404","display_name":"Malware analysis","level":3,"score":0.4461739659309387},{"id":"https://openalex.org/C2776359362","wikidata":"https://www.wikidata.org/wiki/Q2145286","display_name":"Representation (politics)","level":3,"score":0.42263099551200867},{"id":"https://openalex.org/C149672775","wikidata":"https://www.wikidata.org/wiki/Q8777","display_name":"Hypertext Transfer Protocol","level":3,"score":0.4166105091571808},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.39626142382621765},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.36967745423316956},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.25389212369918823},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.16426876187324524},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0995381772518158},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.0},{"id":"https://openalex.org/C94625758","wikidata":"https://www.wikidata.org/wiki/Q7163","display_name":"Politics","level":2,"score":0.0},{"id":"https://openalex.org/C71924100","wikidata":"https://www.wikidata.org/wiki/Q11190","display_name":"Medicine","level":0,"score":0.0},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0},{"id":"https://openalex.org/C142724271","wikidata":"https://www.wikidata.org/wiki/Q7208","display_name":"Pathology","level":1,"score":0.0},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.0},{"id":"https://openalex.org/C204787440","wikidata":"https://www.wikidata.org/wiki/Q188504","display_name":"Alternative medicine","level":2,"score":0.0}],"mesh":[],"locations_count":5,"locations":[{"id":"doi:10.3390/e23050507","is_oa":true,"landing_page_url":"https://doi.org/10.3390/e23050507","pdf_url":"https://www.mdpi.com/1099-4300/23/5/507/pdf?version=1619172308","source":{"id":"https://openalex.org/S195231649","display_name":"Entropy","issn_l":"1099-4300","issn":["1099-4300"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Entropy","raw_type":"journal-article"},{"id":"pmid:33922568","is_oa":false,"landing_page_url":"https://pubmed.ncbi.nlm.nih.gov/33922568","pdf_url":null,"source":{"id":"https://openalex.org/S4306525036","display_name":"PubMed","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I1299303238","host_organization_name":"National Institutes of Health","host_organization_lineage":["https://openalex.org/I1299303238"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Entropy (Basel, Switzerland)","raw_type":null},{"id":"pmh:oai:doaj.org/article:d1e9f201ec854befb1d0997989f25283","is_oa":true,"landing_page_url":"https://doaj.org/article/d1e9f201ec854befb1d0997989f25283","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Entropy, Vol 23, Iss 5, p 507 (2021)","raw_type":"article"},{"id":"pmh:oai:mdpi.com:/1099-4300/23/5/507/","is_oa":true,"landing_page_url":"https://dx.doi.org/10.3390/e23050507","pdf_url":null,"source":{"id":"https://openalex.org/S4306400947","display_name":"MDPI (MDPI AG)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I4210097602","host_organization_name":"Multidisciplinary Digital Publishing Institute (Switzerland)","host_organization_lineage":["https://openalex.org/I4210097602"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Entropy; Volume 23; Issue 5; Pages: 507","raw_type":"Text"},{"id":"pmh:oai:pubmedcentral.nih.gov:8145592","is_oa":true,"landing_page_url":"https://www.ncbi.nlm.nih.gov/pmc/articles/8145592","pdf_url":null,"source":{"id":"https://openalex.org/S2764455111","display_name":"PubMed Central","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I1299303238","host_organization_name":"National Institutes of Health","host_organization_lineage":["https://openalex.org/I1299303238"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Entropy (Basel)","raw_type":"Text"}],"best_oa_location":{"id":"doi:10.3390/e23050507","is_oa":true,"landing_page_url":"https://doi.org/10.3390/e23050507","pdf_url":"https://www.mdpi.com/1099-4300/23/5/507/pdf?version=1619172308","source":{"id":"https://openalex.org/S195231649","display_name":"Entropy","issn_l":"1099-4300","issn":["1099-4300"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Entropy","raw_type":"journal-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/17","display_name":"Partnerships for the goals","score":0.4399999976158142}],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W3158446351.pdf","grobid_xml":"https://content.openalex.org/works/W3158446351.grobid-xml"},"referenced_works_count":15,"referenced_works":["https://openalex.org/W9904157","https://openalex.org/W1827212170","https://openalex.org/W1968693391","https://openalex.org/W2050326248","https://openalex.org/W2484902940","https://openalex.org/W2770182958","https://openalex.org/W2884020303","https://openalex.org/W3015392158","https://openalex.org/W3022250440","https://openalex.org/W3026820624","https://openalex.org/W3082213524","https://openalex.org/W3099769045","https://openalex.org/W3102059489","https://openalex.org/W4256208877","https://openalex.org/W7065034038"],"related_works":["https://openalex.org/W2768892939","https://openalex.org/W2469507153","https://openalex.org/W2008790809","https://openalex.org/W2134874482","https://openalex.org/W4285507391","https://openalex.org/W2397240470","https://openalex.org/W2602767565","https://openalex.org/W170652726","https://openalex.org/W2883822334","https://openalex.org/W3164408430"],"abstract_inverted_index":{"Malicious":[0],"software":[1],"utilizes":[2],"HTTP":[3,48,62,78],"protocol":[4,94],"for":[5],"communication":[6],"purposes,":[7],"creating":[8],"network":[9],"traffic":[10,21,40],"that":[11,104,156],"is":[12,171],"hard":[13],"to":[14,34],"identify":[15,38],"as":[16,92,146],"it":[17,66,197],"blends":[18],"into":[19],"the":[20,61,86,89,106,118,138,200],"generated":[22],"by":[23,41,113,164,198,204,219],"benign":[24,193],"applications.":[25],"To":[26,68],"this":[27],"aim,":[28],"fingerprinting":[29,80],"tools":[30,53,144],"have":[31,122],"been":[32],"developed":[33,119],"help":[35],"track":[36,215],"and":[37,97,132,141,149,192,195,216],"such":[39,91,145],"providing":[42,99,220],"a":[43,75,100,110,114,210],"short":[44],"representation":[45,103],"of":[46,88,161,202],"malicious":[47],"requests.":[49],"However,":[50],"currently":[51],"existing":[52,143,176],"do":[54],"not":[55,187],"analyze":[56,65],"all":[57],"information":[58,84,108],"included":[59],"in":[60,109,182],"message":[63],"or":[64],"insufficiently.":[67],"address":[69],"these":[70,180],"issues,":[71],"we":[72,121,133],"propose":[73],"Hfinger,":[74],"novel":[76],"malware":[77,168,191,218],"request":[79,90,102],"tool.":[81],"It":[82],"extracts":[83],"from":[85],"parts":[87],"URI,":[93],"information,":[95],"headers,":[96],"payload,":[98],"concise":[101],"preserves":[105],"extracted":[107],"form":[111],"interpretable":[112],"human":[115],"analyst.":[116],"For":[117],"solution,":[120],"performed":[123],"an":[124],"extensive":[125],"experimental":[126],"evaluation":[127],"using":[128],"real-world":[129],"data":[130],"sets":[131],"also":[134],"compared":[135],"Hfinger":[136,165,185,212],"with":[137],"most":[139,206],"related":[140],"popular":[142],"FATT,":[147],"Mercury,":[148],"p0f.":[150],"The":[151],"conducted":[152],"effectiveness":[153],"analysis":[154],"reveals":[155],"on":[157],"average":[158],"only":[159],"1.85%":[160],"requests":[162],"fingerprinted":[163],"collide":[166],"between":[167,190],"families,":[169],"what":[170],"8-34":[172],"times":[173],"lower":[174],"than":[175,224],"tools.":[177,227],"Moreover,":[178],"unlike":[179],"tools,":[181],"default":[183],"mode,":[184],"does":[186],"introduce":[188],"collisions":[189],"applications":[194],"achieves":[196],"increasing":[199],"number":[201],"fingerprints":[203,223],"at":[205],"3":[207],"times.":[208],"As":[209],"result,":[211],"can":[213],"effectively":[214],"hunt":[217],"more":[221],"unique":[222],"other":[225],"standard":[226]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":1},{"year":2024,"cited_by_count":2},{"year":2023,"cited_by_count":1},{"year":2022,"cited_by_count":3}],"updated_date":"2026-07-22T07:51:19.307946","created_date":"2025-10-10T00:00:00"}