{"id":"https://openalex.org/W7163040924","doi":"https://doi.org/10.48550/arxiv.2605.31337","title":"When Entropy Is Not Enough: Multi-Modal Classification of Encrypted and Compressed Data Fragments","display_name":"When Entropy Is Not Enough: Multi-Modal Classification of Encrypted and Compressed Data Fragments","publication_year":2026,"publication_date":"2026-05-29","ids":{"openalex":"https://openalex.org/W7163040924","doi":"https://doi.org/10.48550/arxiv.2605.31337"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2605.31337","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.31337","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2605.31337","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5062718348","display_name":"Fabio De Gaspari","orcid":"https://orcid.org/0000-0001-9718-1044"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"De Gaspari, Fabio","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5080694735","display_name":"Dorjan Hitaj","orcid":"https://orcid.org/0000-0001-5686-3831"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Hitaj, Dorjan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137567330","display_name":"Samuele Salaris","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Salaris, Samuele","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5137546652","display_name":"Luigi V. Mancini","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Mancini, Luigi V.","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.6134999990463257,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.6134999990463257,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.24770000576972961,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.030500000342726707,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/byte","display_name":"Byte","score":0.6679999828338623},{"id":"https://openalex.org/keywords/encryption","display_name":"Encryption","score":0.5497999787330627},{"id":"https://openalex.org/keywords/entropy","display_name":"Entropy (arrow of time)","score":0.5246000289916992},{"id":"https://openalex.org/keywords/raw-data","display_name":"Raw data","score":0.5156999826431274},{"id":"https://openalex.org/keywords/binary-data","display_name":"Binary data","score":0.4677000045776367},{"id":"https://openalex.org/keywords/classifier","display_name":"Classifier (UML)","score":0.46209999918937683},{"id":"https://openalex.org/keywords/binary-number","display_name":"Binary number","score":0.44920000433921814},{"id":"https://openalex.org/keywords/pattern-recognition","display_name":"Pattern recognition (psychology)","score":0.4406999945640564},{"id":"https://openalex.org/keywords/identification","display_name":"Identification (biology)","score":0.35269999504089355}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7213000059127808},{"id":"https://openalex.org/C43364308","wikidata":"https://www.wikidata.org/wiki/Q8799","display_name":"Byte","level":2,"score":0.6679999828338623},{"id":"https://openalex.org/C148730421","wikidata":"https://www.wikidata.org/wiki/Q141090","display_name":"Encryption","level":2,"score":0.5497999787330627},{"id":"https://openalex.org/C106301342","wikidata":"https://www.wikidata.org/wiki/Q4117933","display_name":"Entropy (arrow of time)","level":2,"score":0.5246000289916992},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5181000232696533},{"id":"https://openalex.org/C132964779","wikidata":"https://www.wikidata.org/wiki/Q2110223","display_name":"Raw data","level":2,"score":0.5156999826431274},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4916999936103821},{"id":"https://openalex.org/C2779190172","wikidata":"https://www.wikidata.org/wiki/Q4913888","display_name":"Binary data","level":3,"score":0.4677000045776367},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.46209999918937683},{"id":"https://openalex.org/C48372109","wikidata":"https://www.wikidata.org/wiki/Q3913","display_name":"Binary number","level":2,"score":0.44920000433921814},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.4406999945640564},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.3779999911785126},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.35269999504089355},{"id":"https://openalex.org/C114289077","wikidata":"https://www.wikidata.org/wiki/Q3284399","display_name":"Statistical model","level":2,"score":0.3377000093460083},{"id":"https://openalex.org/C46686674","wikidata":"https://www.wikidata.org/wiki/Q466303","display_name":"Boosting (machine learning)","level":2,"score":0.33250001072883606},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3151000142097473},{"id":"https://openalex.org/C87007009","wikidata":"https://www.wikidata.org/wiki/Q210832","display_name":"Statistical hypothesis testing","level":2,"score":0.3140999972820282},{"id":"https://openalex.org/C207850805","wikidata":"https://www.wikidata.org/wiki/Q269608","display_name":"Reverse engineering","level":2,"score":0.310699999332428},{"id":"https://openalex.org/C9679016","wikidata":"https://www.wikidata.org/wiki/Q1417473","display_name":"Principle of maximum entropy","level":2,"score":0.3091999888420105},{"id":"https://openalex.org/C162319229","wikidata":"https://www.wikidata.org/wiki/Q175263","display_name":"Data structure","level":2,"score":0.30820000171661377},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.3068999946117401},{"id":"https://openalex.org/C78548338","wikidata":"https://www.wikidata.org/wiki/Q2493","display_name":"Data compression","level":2,"score":0.3059999942779541},{"id":"https://openalex.org/C149441793","wikidata":"https://www.wikidata.org/wiki/Q200726","display_name":"Probability distribution","level":2,"score":0.3012000024318695},{"id":"https://openalex.org/C134261354","wikidata":"https://www.wikidata.org/wiki/Q938438","display_name":"Statistical inference","level":2,"score":0.2948000133037567},{"id":"https://openalex.org/C160920958","wikidata":"https://www.wikidata.org/wiki/Q7662746","display_name":"Synthetic data","level":2,"score":0.28859999775886536},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.2874000072479248},{"id":"https://openalex.org/C2778864079","wikidata":"https://www.wikidata.org/wiki/Q173285","display_name":"Digital data","level":3,"score":0.28380000591278076},{"id":"https://openalex.org/C2986587452","wikidata":"https://www.wikidata.org/wiki/Q938438","display_name":"Statistical analysis","level":2,"score":0.27070000767707825},{"id":"https://openalex.org/C179518139","wikidata":"https://www.wikidata.org/wiki/Q5140297","display_name":"Coding (social sciences)","level":2,"score":0.2680000066757202},{"id":"https://openalex.org/C2781238097","wikidata":"https://www.wikidata.org/wiki/Q175026","display_name":"Object (grammar)","level":2,"score":0.25839999318122864},{"id":"https://openalex.org/C84418412","wikidata":"https://www.wikidata.org/wiki/Q3246940","display_name":"Digital forensics","level":2,"score":0.2581999897956848},{"id":"https://openalex.org/C124851039","wikidata":"https://www.wikidata.org/wiki/Q2665459","display_name":"Compressed sensing","level":2,"score":0.2540999948978424}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2605.31337","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.31337","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2605.31337","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.31337","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Reliable":[0],"identification":[1],"of":[2,78,103,124,140,161],"encrypted":[3,22],"data":[4,19,34,80,104],"fragments":[5,25,31,102],"is":[6,26,81,157],"essential":[7],"in":[8,96,144,148],"cybersecurity,":[9],"with":[10,138],"applications":[11],"to":[12,142,163],"ransomware":[13],"detection,":[14],"digital":[15],"forensics,":[16],"and":[17,35,121,146],"large-scale":[18],"analysis.":[20],"Distinguishing":[21],"from":[23,63],"compressed":[24],"particularly":[27],"challenging,":[28],"as":[29],"short":[30],"lack":[32],"structural":[33],"exhibit":[36],"low":[37],"statistical":[38,41],"redundancy.":[39],"Traditional":[40],"methods":[42,137],"based":[43],"on":[44,50,69],"byte-level":[45],"distributions":[46],"show":[47],"limited":[48],"effectiveness":[49],"this":[51,90],"task.":[52],"Recent":[53],"machine":[54],"learning":[55,60],"approaches":[56],"improve":[57],"performance":[58],"by":[59],"subtle":[61],"patterns":[62],"raw":[64,125],"bytes,":[65],"but":[66],"predominantly":[67],"rely":[68],"single-modal":[70],"representations,":[71],"implicitly":[72],"assuming":[73],"that":[74,89,117,132,154],"a":[75,93,112],"single":[76],"view":[77],"the":[79],"sufficient":[82],"for":[83],"accurate":[84],"classification.":[85,150],"This":[86],"paper":[87],"shows":[88],"assumption":[91],"becomes":[92],"fundamental":[94],"limitation":[95],"low-information":[97],"settings,":[98],"when":[99],"only":[100],"small":[101],"are":[105],"available":[106],"(512--2048":[107],"Bytes).":[108],"We":[109],"propose":[110],"Triumvir,":[111],"multi-modal,":[113],"uncertainty-aware":[114],"ensemble":[115],"architecture":[116],"integrates":[118],"statistical,":[119],"sequential,":[120],"spatial":[122],"representations":[123],"byte":[126],"fragments.":[127],"Extensive":[128],"experimental":[129],"analysis":[130],"demonstrates":[131],"Triumvir":[133],"consistently":[134],"outperforms":[135],"state-of-the-art":[136],"gains":[139],"up":[141,162],"+4.5pp":[143],"binary":[145],"+6.4pp":[147],"multiclass":[149],"Ablation":[151],"studies":[152],"confirm":[153],"combining":[155],"modalities":[156],"critical,":[158],"yielding":[159],"improvements":[160],"+5pp":[164],"over":[165],"partial":[166],"configurations.":[167]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-06-02T00:00:00"}