{"id":"https://openalex.org/W7163355128","doi":"https://doi.org/10.48550/arxiv.2606.03218","title":"The Role of Domain-Specific Features in Malware Detection: A macOS Case Study","display_name":"The Role of Domain-Specific Features in Malware Detection: A macOS Case Study","publication_year":2026,"publication_date":"2026-06-02","ids":{"openalex":"https://openalex.org/W7163355128","doi":"https://doi.org/10.48550/arxiv.2606.03218"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.03218","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.03218","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.03218","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5137713939","display_name":"Biagio Montaruli","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Montaruli, Biagio","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5068913678","display_name":"Andrea Oliveri","orcid":"https://orcid.org/0000-0001-7820-1927"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Oliveri, Andrea","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137765102","display_name":"Savino Dambra","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Dambra, Savino","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5002025561","display_name":"Davide Balzarotti","orcid":"https://orcid.org/0000-0001-5957-6213"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Balzarotti, Davide","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9943000078201294,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9943000078201294,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.0008999999845400453,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.0008999999845400453,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.7305999994277954},{"id":"https://openalex.org/keywords/detector","display_name":"Detector","score":0.46700000762939453},{"id":"https://openalex.org/keywords/android","display_name":"Android (operating system)","score":0.4650000035762787},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.4341000020503998},{"id":"https://openalex.org/keywords/mobile-device","display_name":"Mobile device","score":0.40709999203681946},{"id":"https://openalex.org/keywords/android-malware","display_name":"Android malware","score":0.373199999332428}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7698000073432922},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.7305999994277954},{"id":"https://openalex.org/C94915269","wikidata":"https://www.wikidata.org/wiki/Q1834857","display_name":"Detector","level":2,"score":0.46700000762939453},{"id":"https://openalex.org/C557433098","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android (operating system)","level":2,"score":0.4650000035762787},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.4341000020503998},{"id":"https://openalex.org/C186967261","wikidata":"https://www.wikidata.org/wiki/Q5082128","display_name":"Mobile device","level":2,"score":0.40709999203681946},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4032000005245209},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3912000060081482},{"id":"https://openalex.org/C2989133298","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android malware","level":3,"score":0.373199999332428},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3325999975204468},{"id":"https://openalex.org/C2776145971","wikidata":"https://www.wikidata.org/wiki/Q30673951","display_name":"Labeled data","level":2,"score":0.3310000002384186},{"id":"https://openalex.org/C51632099","wikidata":"https://www.wikidata.org/wiki/Q3985153","display_name":"Training set","level":2,"score":0.3192000091075897},{"id":"https://openalex.org/C177148314","wikidata":"https://www.wikidata.org/wiki/Q170084","display_name":"Generalization","level":2,"score":0.30550000071525574},{"id":"https://openalex.org/C2780586970","wikidata":"https://www.wikidata.org/wiki/Q1357284","display_name":"Popularity","level":2,"score":0.2752000093460083},{"id":"https://openalex.org/C23123220","wikidata":"https://www.wikidata.org/wiki/Q816826","display_name":"Information retrieval","level":1,"score":0.2621999979019165},{"id":"https://openalex.org/C136389625","wikidata":"https://www.wikidata.org/wiki/Q334384","display_name":"Supervised learning","level":3,"score":0.25859999656677246}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.03218","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.03218","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.03218","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.03218","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Despite":[0],"the":[1,24,33,36,40,44,54,61,68,72,156,159,168,177,215,221,250],"growing":[2],"popularity":[3],"of":[4,26,35,43,56,114,142,146,155,158,180,194],"macOS":[5,27,84,197],"among":[6],"end":[7],"users":[8],"and":[9,19,39,93,120,124,219],"enterprise":[10],"systems,":[11,22],"malware":[12,28,102,230],"research":[13,251],"has":[14],"primarily":[15],"focused":[16],"on":[17,110,190],"Windows":[18],"Android":[20],"operating":[21,37],"leaving":[23],"problem":[25],"detection":[29,62,131,147,210,241],"relatively":[30],"unexplored.":[31],"Indeed,":[32],"specificity":[34],"system":[38,95],"unique":[41],"characteristics":[42],"Mach-O":[45],"file":[46],"format":[47],"can":[48],"play":[49],"a":[50,99,106,111,187,191,207,237],"fundamental":[51],"role":[52],"in":[53,71,144,173,240],"classification":[55],"unknown":[57],"samples,":[58,116,231],"drastically":[59],"increasing":[60],"rate.":[63,148],"In":[64],"this":[65],"work,":[66],"for":[67,226],"first":[69],"time":[70],"literature,":[73],"we":[74,185,244],"employ":[75],"new":[76,169,192],"domain-specific":[77,170,222],"features,":[78,161],"i.e.,":[79],"static":[80],"features":[81,223],"specific":[82],"to":[83,97,175,228,236,249],"binaries,":[85],"such":[86],"as":[87,232],"embedded":[88],"certificates,":[89],"entitlements,":[90],"persistence":[91],"techniques":[92],"key":[94],"APIs,":[96],"train":[98],"machine":[100],"learning":[101],"detector.":[103],"We":[104,149],"perform":[105,186],"comprehensive":[107],"experimental":[108],"evaluation":[109,189],"novel":[112,229],"dataset":[113,193,248],"41,129":[115],"comprising":[117],"11,413":[118],"benign":[119],"29,716":[121],"malicious":[122],"executables,":[123],"demonstrate":[125],"that":[126,163,202],"our":[127,164,181,204,247],"solution":[128],"achieves":[129],"state-of-the-art":[130,216],"performance":[132],"(98.50%),":[133],"outperforming":[134],"all":[135],"existing":[136],"approaches,":[137],"with":[138],"an":[139,152],"average":[140],"improvement":[141],"16%":[143],"terms":[145],"also":[150,245],"provide":[151],"in-depth":[153],"analysis":[154],"importance":[157],"individual":[160],"showing":[162],"detector":[165,182,205],"effectively":[166],"leverages":[167],"features.":[171],"Then,":[172],"order":[174],"evaluate":[176],"generalization":[178],"capabilities":[179],"over":[183],"time,":[184],"real-world":[188],"9,000":[195],"fresh":[196],"executables.":[198],"The":[199],"results":[200],"show":[201],"(i)":[203],"maintains":[206],"very":[208],"high":[209],"rate":[211],"(99.50%),":[212],"(ii)":[213],"outperforms":[214],"by":[217],"50%,":[218],"(iii)":[220],"are":[224],"crucial":[225],"generalizing":[227],"their":[233],"removal":[234],"leads":[235],"15.92%":[238],"drop":[239],"performance.":[242],"Finally,":[243],"release":[246],"community.":[252]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-06-04T00:00:00"}