{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,18]],"date-time":"2026-07-18T08:03:04Z","timestamp":1784361784135,"version":"3.55.0"},"publisher-location":"Singapore","reference-count":22,"publisher":"Springer Nature Singapore","isbn-type":[{"value":"9789819230174","type":"print"},{"value":"9789819230181","type":"electronic"}],"license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026]]},"DOI":"10.1007\/978-981-92-3018-1_10","type":"book-chapter","created":{"date-parts":[[2026,7,18]],"date-time":"2026-07-18T07:27:25Z","timestamp":1784359645000},"page":"225-242","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["ShellMamba: Anomaly Detection of\u00a0Shell Command Sequences"],"prefix":"10.1007","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-1126-0441","authenticated-orcid":false,"given":"Qiwei","family":"Zong","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9861-4224","authenticated-orcid":false,"given":"Yongqiang","family":"Dong","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"ShiShun","family":"Zhu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4310-0672","authenticated-orcid":false,"given":"Xingshen","family":"Wei","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2026,7,18]]},"reference":[{"key":"10_CR1","unstructured":"Verizon Business: 2024 Data Breach Investigations Report (2024). https:\/\/www.verizon.com\/business\/resources\/Tb7e\/reports\/2024-dbir-data-breach-investigations-report.pdf"},{"key":"10_CR2","series-title":"IFIP Advances in Information and Communication Technology","doi-asserted-by":"publisher","first-page":"421","DOI":"10.1007\/978-3-030-00828-4_43","volume-title":"Intelligent Information Processing IX","author":"W Jiang","year":"2018","unstructured":"Jiang, W., Tian, Y., Liu, W., Liu, W.: An insider threat detection method based on user behavior analysis. In: Shi, Z., Mercier-Laurent, E., Li, J. (eds.) IIP 2018. IAICT, vol. 538, pp. 421\u2013429. Springer, Cham (2018). https:\/\/doi.org\/10.1007\/978-3-030-00828-4_43"},{"key":"10_CR3","doi-asserted-by":"publisher","first-page":"168","DOI":"10.1016\/j.comcom.2020.03.048","volume":"156","author":"J Liu","year":"2020","unstructured":"Liu, J., Duan, M., Li, W., et al.: HMMs based masquerade detection for network security with parallel computing. Comput. Commun. 156, 168\u2013173 (2020). https:\/\/doi.org\/10.1016\/j.comcom.2020.03.048","journal-title":"Comput. Commun."},{"key":"10_CR4","doi-asserted-by":"publisher","unstructured":"Al-Janabi, M., Altamimi, A.M.: A comparative analysis of machine learning techniques for classification and detection of malware. In: 21st International Arab Conference on Information Technology, ACIT 2020, Giza, Egypt, November 28-30, 2020, pp. 1\u20139. IEEE (2020). https:\/\/doi.org\/10.1109\/ACIT50332.2020.9300081","DOI":"10.1109\/ACIT50332.2020.9300081"},{"issue":"4","key":"10_CR5","doi-asserted-by":"publisher","first-page":"2485","DOI":"10.1109\/JIOT.2021.3086398","volume":"9","author":"H Alasmary","year":"2022","unstructured":"Alasmary, H., Anwar, A., Abusnaina, A., et al.: ShellCore: automating malicious IoT software detection using shell commands representation. IEEE Internet Things J. 9(4), 2485\u20132496 (2022). https:\/\/doi.org\/10.1109\/JIOT.2021.3086398","journal-title":"IEEE Internet Things J."},{"key":"10_CR6","doi-asserted-by":"publisher","unstructured":"Tian, Y., Wang, J., Zhou, Z., et al.: CNN-Webshell: malicious web shell detection with convolutional neural network. In: Proceedings of the 2017 VI International Conference on Network, Communication and Computing, ICNCC 2017, pp. 75\u201379. Association for Computing Machinery, New York (2017). https:\/\/doi.org\/10.1145\/3171592.3171593","DOI":"10.1145\/3171592.3171593"},{"key":"10_CR7","doi-asserted-by":"publisher","unstructured":"Hendler, D., Kels, S., Rubin, A.: Detecting malicious powershell commands using deep neural networks. In: Proceedings of the 2018 on Asia Conference on Computer and Communications Security, AsiaCCS 2018, Incheon, Republic of Korea, June 04-08, 2018, pp. 187\u2013197. ACM (2018). https:\/\/doi.org\/10.1145\/3196494.3196511","DOI":"10.1145\/3196494.3196511"},{"key":"10_CR8","doi-asserted-by":"crossref","unstructured":"Zhai, H., Wang, Y., Zou, X., et al.: Masquerade detection based on temporal convolutional network. In: 2022 IEEE 25th International Conference on Computer Supported Cooperative Work in Design (CSCWD), pp. 305\u2013310. IEEE (2022)","DOI":"10.1109\/CSCWD54268.2022.9776088"},{"key":"10_CR9","unstructured":"Liu, Z., Buford, J.F.: Anomaly detection of command shell sessions based on DistilBERT: unsupervised and supervised approaches. In: Deason, L., Samtani, S., Raff, E., Rudd, E.M. (eds.) Proceedings of the Conference on Applied Machine Learning in Information Security, Arlington, Virginia, USA, October 19-20, 2023, CEUR Workshop Proceedings, pp. 60\u201376. CEUR-WS.org (2023)"},{"key":"10_CR10","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2022.102658","volume":"116","author":"A Alahmadi","year":"2022","unstructured":"Alahmadi, A., Alkhraan, N., BinSaeedan, W.: MPSAutodetect: a malicious powershell script detection model based on stacked denoising auto-encoder. Comput. Secur. 116, 102658 (2022). https:\/\/doi.org\/10.1016\/j.cose.2022.102658","journal-title":"Comput. Secur."},{"key":"10_CR11","doi-asserted-by":"publisher","first-page":"30","DOI":"10.1016\/j.neucom.2021.03.117","volume":"448","author":"Y Fang","year":"2021","unstructured":"Fang, Y., Zhou, X., Huang, C.: Effective method for detecting malicious PowerShell scripts based on hybrid features. Neurocomputing 448, 30\u201339 (2021). https:\/\/doi.org\/10.1016\/j.neucom.2021.03.117","journal-title":"Neurocomputing"},{"key":"10_CR12","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2022.102715","volume":"118","author":"Y Fang","year":"2022","unstructured":"Fang, Y., Huang, C., Zeng, M., et al.: JStrong: malicious JavaScript detection based on code semantic representation and graph neural network. Comput. Secur. 118, 102715 (2022). https:\/\/doi.org\/10.1016\/j.cose.2022.102715","journal-title":"Comput. Secur."},{"issue":"3","key":"10_CR13","doi-asserted-by":"publisher","first-page":"549","DOI":"10.4218\/etrij.2020-0215","volume":"43","author":"J Song","year":"2021","unstructured":"Song, J., Kim, J., Choi, S., et al.: Evaluations of AI-based malicious PowerShell detection with feature optimizations. ETRI J. 43(3), 549\u2013560 (2021). https:\/\/doi.org\/10.4218\/etrij.2020-0215","journal-title":"ETRI J."},{"key":"10_CR14","first-page":"58","volume":"16","author":"M Schonlau","year":"2001","unstructured":"Schonlau, M., DuMouchel, W., Ju, W.-H., et al.: Computer intrusion: detecting masquerades. Stat. Sci. 16, 58\u201374 (2001)","journal-title":"Stat. Sci."},{"key":"10_CR15","volume-title":"Using UNIX: Collected Traces of 168 Users","author":"S Greenberg","year":"1988","unstructured":"Greenberg, S.: Using UNIX: Collected Traces of 168 Users. University of Calgary, Science Faculty (1988)"},{"key":"10_CR16","unstructured":"Lane, T., Brodley, C.: An Application of Machine Learning to Anomaly Detection. COAST Technical report 97-03, Purdue University (1997)"},{"key":"10_CR17","doi-asserted-by":"crossref","unstructured":"Lin, X.V., Wang, C., Zettlemoyer, L., et al.: NL2Bash: a corpus and semantic parser for natural language interface to the linux operating system. In: Calzolari, N., et al (eds.) Proceedings of the Eleventh International Conference on Language Resources and Evaluation (LREC 2018), Miyazaki, Japan. European Language Resources Association (ELRA) (2018)","DOI":"10.63317\/42er6x4bacdf"},{"key":"10_CR18","unstructured":"Trizna, D.: Shell language processing: Unix command parsing for machine learning. arXiv preprint arXiv:2107.02438 (2021)"},{"key":"10_CR19","doi-asserted-by":"crossref","unstructured":"Wang, K., Reimers, N., Gurevych, I.: TSDAE: using transformer-based sequential denoising auto-encoder for unsupervised sentence embedding learning. In: Moens, M.-F., Huang, X., Specia, L., Yih, S.W. (eds.) Findings of the Association for Computational Linguistics: EMNLP 2021, Virtual Event \/ Punta Cana, Dominican Republic, 16-20 November, 2021, pp. 671\u2013688. Association for Computational Linguistics (2021)","DOI":"10.18653\/v1\/2021.findings-emnlp.59"},{"key":"10_CR20","unstructured":"Gu, A., Dao, T.: Mamba: linear-time sequence modeling with selective state spaces. arXiv preprint arXiv:2312.00752 (2023)"},{"key":"10_CR21","unstructured":"Vaswani, A., Shazeer, N., Parmar, N., et al.: Attention is all you need. In: Guyon, I., et al (eds.) Advances in Neural Information Processing Systems 30: Annual Conference on Neural Information Processing Systems 2017, 4\u20139 December 2017, pp. 6000\u20136010. Long Beach, CA, USA (2017)"},{"key":"10_CR22","doi-asserted-by":"publisher","unstructured":"Zhang, X., Xu, Y., Lin, Q., et al.: Robust log-based anomaly detection on unstable log data. In: Dumas, M., Pfahl, D., Apel, S., Russo, A. (eds.) Proceedings of the ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering, ESEC\/SIGSOFT FSE 2019, Tallinn, Estonia, August 26-30, 2019, pp. 807\u2013817. ACM (2019). https:\/\/doi.org\/10.1145\/3338906.3338931","DOI":"10.1145\/3338906.3338931"}],"container-title":["Lecture Notes in Computer Science","Information Security and Privacy"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-981-92-3018-1_10","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,18]],"date-time":"2026-07-18T07:27:27Z","timestamp":1784359647000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-981-92-3018-1_10"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"ISBN":["9789819230174","9789819230181"],"references-count":22,"URL":"https:\/\/doi.org\/10.1007\/978-981-92-3018-1_10","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]},"assertion":[{"value":"18 July 2026","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"ACISP","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Australasian Conference on Information Security and Privacy","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Perth, WA","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Australia","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2026","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"6 July 2026","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"9 July 2026","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"31","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"acisp2026","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/acisp-conference.github.io\/acisp2026\/index.html","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}