{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,11,5]],"date-time":"2025-11-05T13:59:01Z","timestamp":1762351141178},"reference-count":39,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2009,5,6]],"date-time":"2009-05-06T00:00:00Z","timestamp":1241568000000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["J Intell Inf Syst"],"published-print":{"date-parts":[[2010,8]]},"DOI":"10.1007\/s10844-009-0086-7","type":"journal-article","created":{"date-parts":[[2009,5,5]],"date-time":"2009-05-05T02:59:46Z","timestamp":1241492386000},"page":"1-20","source":"Crossref","is-referenced-by-count":34,"title":["Hierarchical associative classifier (HAC) for malware detection from the large and imbalanced gray list"],"prefix":"10.1007","volume":"35","author":[{"given":"Yanfang","family":"Ye","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Tao","family":"Li","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Kai","family":"Huang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Qingshan","family":"Jiang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yong","family":"Chen","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2009,5,6]]},"reference":[{"key":"86_CR1","doi-asserted-by":"crossref","unstructured":"Agrawal, R., & Imielinski, T. (1993). Mining association rules between sets of items in large databases. In Proceedings of SIGMOD.","DOI":"10.1145\/170036.170072"},{"key":"86_CR2","doi-asserted-by":"crossref","unstructured":"Baralis, E., & Torino, P. (2002). A lazy approach to pruning classification rules. In Proceedings of the 2002 IEEE international conference on data mining.","DOI":"10.1109\/ICDM.2002.1183883"},{"key":"86_CR3","doi-asserted-by":"crossref","unstructured":"Bayardo, R., Agrawal, R., & Gunopulos, D. (1999). Constraint-based rule mining in large, dense databases. In ICDE-99.","DOI":"10.1109\/ICDE.1999.754924"},{"key":"86_CR4","doi-asserted-by":"crossref","first-page":"67","DOI":"10.1007\/s11416-006-0012-2","volume":"2","author":"U Bayer","year":"2006","unstructured":"Bayer, U., Moser, A., Kruegel, C., & Kirda, E. (2006). Dynamic analysis of malicious code. Journal in Computer Virology, 2, 67\u201377.","journal-title":"Journal in Computer Virology"},{"key":"86_CR5","doi-asserted-by":"crossref","first-page":"321","DOI":"10.1613\/jair.953","volume":"16","author":"N Chawla","year":"2002","unstructured":"Chawla, N., Bowyer, K., Hall, L., & Kegelmeyer, W. (2002). SMOTE: Synthetic minority over-sampling technique. Journal of Artificial Intelligence Research, 16, 321\u2013357.","journal-title":"Journal of Artificial Intelligence Research"},{"key":"86_CR6","doi-asserted-by":"crossref","unstructured":"Christodorescu, M., Jha, S., & Kruegel, C. (2007). Mining specifications of malicious behavior. In Proceedings of ESEC\/FSE07 (pp. 5\u201314).","DOI":"10.1145\/1287624.1287628"},{"key":"86_CR7","unstructured":"Drummond, C., & Holte, C. (2003). C4.5, class imbalance, and cost sensitivity: Why undersampling beats oversampling. In Proc. of the ICML-2003 workshop: Learning with imbalanced data sets II (pp. 1\u20138)."},{"key":"86_CR8","unstructured":"Elkan, C. (2001). The foundations of cost-sensitive learning. In Proceedings of the seventeenth international conference on machine learning (pp. 239\u2013246)."},{"key":"86_CR9","doi-asserted-by":"crossref","unstructured":"Han, J., Pei, J., & Yin, Y. (2000). Mining frequent patterns without candidate generation. In Proceedings of SIGMOD (pp. 1\u201312).","DOI":"10.1145\/342009.335372"},{"key":"86_CR10","doi-asserted-by":"crossref","first-page":"415","DOI":"10.1109\/72.991427","volume":"13","author":"C Hsu","year":"2002","unstructured":"Hsu, C., & Lin, C. (2002). A comparison of methods for multiclass support vector machines. IEEE Transactions on Neural Networks, 13, 415\u2013425.","journal-title":"IEEE Transactions on Neural Networks"},{"key":"86_CR11","doi-asserted-by":"crossref","first-page":"4","DOI":"10.1109\/34.824819","volume":"22","author":"A Jain","year":"2000","unstructured":"Jain, A., Duin, R., & Mao, J. (2000). Statistical pattern recognition: A review. IEEE Transactions on Pattern Analysis and Machine Intelligence, 22, 4\u201337.","journal-title":"IEEE Transactions on Pattern Analysis and Machine Intelligence"},{"issue":"5","key":"86_CR12","doi-asserted-by":"crossref","first-page":"429C450","DOI":"10.3233\/IDA-2002-6504","volume":"6","author":"N Japkowicz","year":"2002","unstructured":"Japkowicz, N., & Stephen, S. (2002). The class imbalance problem: A systematic study. In Intelligent Data Analysis, 6(5), 429C450.","journal-title":"Intelligent Data Analysis"},{"key":"86_CR13","doi-asserted-by":"crossref","unstructured":"Joshi, M., Agarwal, R., & Kumar, V. (2001). Mining needles in a haystack: Classifying rare classes via two-phase rule induction. In SIGMOD 01 conference on management of data (pp. 91\u2013102).","DOI":"10.1145\/375663.375673"},{"key":"86_CR14","unstructured":"Kamei, R., & Ralescu, A. (2003). Piecewise linear separanility using support vector machines. In Proc. of the MAICS conference (pp. 52C53)."},{"key":"86_CR15","unstructured":"Kephart, J., Sorkin, G., Swimmer, M., & White, S. (1997). Blueprint for a computer immune system. In Virus Bulletin International Conference."},{"key":"86_CR16","doi-asserted-by":"crossref","first-page":"20","DOI":"10.1109\/6.275061","volume":"30","author":"J. Kephart","year":"1993","unstructured":"Kephart, J., White, S., & Chess, D. (1993). Computers and epidemiology. IEEE Spectrum, 30, 20\u201326.","journal-title":"IEEE Spectrum"},{"key":"86_CR17","doi-asserted-by":"crossref","unstructured":"Kolter, J., & Maloof, M. (2004). Learning to detect malicious executables in the wild. In Proceedings of KDD\u201904.","DOI":"10.1145\/1014052.1014105"},{"key":"86_CR18","doi-asserted-by":"crossref","unstructured":"Langley, P. (1994). Selection of relevant features in machine learning. In Proceedings of AAAI fall symp.","DOI":"10.21236\/ADA292575"},{"key":"86_CR19","unstructured":"Li, W., Han, J., & Pei, J. (2001). CMAR: Accurate and efficient classification based on multiple class-association rules. In Proceedings of the 2001 IEEE international conference on data mining (ICDM-01) (pp. 369\u2013376)."},{"key":"86_CR20","unstructured":"Liu, B., Hsu, W., & Ma, Y. (1998). Integrating classification and association rule mining. In Proceedings of the fourth international conference on knowledge discovery and data mining (KDD-98) (pp. 80\u201386)."},{"key":"86_CR21","doi-asserted-by":"crossref","unstructured":"Liu, B., Hsu, W., & Ma, Y. (1999). Pruning and summarizing the discovered associations. In KDD-99.","DOI":"10.1145\/312129.312216"},{"key":"86_CR22","doi-asserted-by":"crossref","unstructured":"Mahta, M., Agrawal, R., & Rissanen, J. (1996). SLIQ: A fast scalable classifier for data mining. In EDBT-96.","DOI":"10.1007\/BFb0014141"},{"key":"86_CR23","doi-asserted-by":"crossref","first-page":"1226","DOI":"10.1109\/TPAMI.2005.159","volume":"27","author":"H Peng","year":"2005","unstructured":"Peng, H., Long, F., & Ding, C. (2005). Feature selection based on mutual information: Criteria of max-dependency, max-relevance, and min-redundancy. IEEE Transactions on Pattern Analysis and Machine Intelligence, 27, 1226\u20131238.","journal-title":"IEEE Transactions on Pattern Analysis and Machine Intelligence"},{"key":"86_CR24","doi-asserted-by":"crossref","unstructured":"Schultz, M., Eskin, E., & Zadok, E. (2001). Data mining methods for detection of new malicious executables. In Security and privacy, 2001. Proceedings. 2001 IEEE symposium on 14\u201316 May (pp. 38\u201349).","DOI":"10.1109\/SECPRI.2001.924286"},{"key":"86_CR25","first-page":"541","volume-title":"CCS \u201907: Proceedings of the 14th ACM conference on computer and communications security","author":"Y Song","year":"2007","unstructured":"Song, Y., Locasto, M., Stavrou, A., Keromytis, A., & Stolfo, S. (2007). On the infeasibility of modeling polymorphic shellcode. In CCS \u201907: Proceedings of the 14th ACM conference on computer and communications security (pp. 541\u2013551). New York: ACM."},{"key":"86_CR26","doi-asserted-by":"crossref","unstructured":"Sung, A., Xu, J., Chavez, P., & Mukkamala, S. (2004). Static analyzer of vicious executables (save). In Proceedings of the 20th annual computer security applications conference.","DOI":"10.1109\/CSAC.2004.37"},{"key":"86_CR27","doi-asserted-by":"crossref","first-page":"5","DOI":"10.1109\/64.511768","volume":"11","author":"G Tesauro","year":"1996","unstructured":"Tesauro, G., Kephart, J., & Sorkin, G. (1996). Neural networks for computer virus recognition. IEEE Expert, 11, 5\u20136.","journal-title":"IEEE Expert"},{"issue":"1","key":"86_CR28","doi-asserted-by":"crossref","first-page":"37C65","DOI":"10.1017\/S0269888907001026","volume":"22","author":"F Thabtah","year":"2007","unstructured":"Thabtah, F. (2007). A review of associative classification mining. The Knowledge Engineering Review, 22(1), 37C65.","journal-title":"The Knowledge Engineering Review"},{"key":"86_CR29","unstructured":"Toivonen, H., Klemetinen, M., Ronkainen, P., Hatonen, K., & Mannila, H. (1995). Pruning and grouping discovered association rules. In Mlnet workshop on statistics, machine learning, and discovery in databases (pp. 47\u201352)."},{"key":"86_CR30","unstructured":"Visa, S., & Ralescu, A. (2003). Learning imbalanced and overlapping classes using fuzzy sets. In Proc. of the ICML-2003 workshop: Learning with imbalanced data sets II (p. 97C104)."},{"key":"86_CR31","unstructured":"Visa, S., & Ralescu, A. (2005). Issues in mining imbalanced data sets\u2014A review paper. In Proceedings of the sixteen midwest artificial intelligence and cognitive science conference."},{"key":"86_CR32","first-page":"255","volume-title":"CCS \u201902: Proceedings of the 9th ACM conference on Computer and communications security","author":"D Wagner","year":"2002","unstructured":"Wagner, D., & Soto, P. (2002). Mimicry attacks on host-based intrusion detection systems. In CCS \u201902: Proceedings of the 9th ACM conference on Computer and communications security (pp. 255\u2013264). New York: ACM."},{"key":"86_CR33","unstructured":"Wang, J., Deng, P., Fan, Y., Jaw, L., & Liu, Y. (2003). Virus detection using data mining techniques. In Proceedings of IEEE international conference on data mining."},{"key":"86_CR34","doi-asserted-by":"crossref","unstructured":"Wang, Y., Xin, Q., & Coenen, F. (2007). A novel rule ordering approach in classification association rule mining. In Proceedings of the seventh IEEE international conference on data mining workshops (ICDMW 2007).","DOI":"10.1109\/ICDMW.2007.126"},{"key":"86_CR35","doi-asserted-by":"crossref","unstructured":"Weiss, G. (2004). Mining with rarity: A unifying framework. In SIGKDD Explorations (Vol. 6, No. 1, pp. 7\u201319).","DOI":"10.1145\/1007730.1007734"},{"key":"86_CR36","doi-asserted-by":"crossref","first-page":"315","DOI":"10.1613\/jair.1199","volume":"19","author":"G Weiss","year":"2003","unstructured":"Weiss, G., & Provost, F. (2003). Learning when training data are costly: The effect of class distribution on tree induction. Journal of Artificial Intelligence Research, 19, 315\u2013354.","journal-title":"Journal of Artificial Intelligence Research"},{"key":"86_CR37","doi-asserted-by":"crossref","unstructured":"Ye, Y., Wang, D., Li, T., & Ye, D. (2007). IMDS: Intelligent malware detection system. In Proceedings of ACM international conference on knowlege discovery and data mining (SIGKDD 2007).","DOI":"10.1145\/1281192.1281308"},{"key":"86_CR38","doi-asserted-by":"crossref","unstructured":"Yin, X., & Han, J. (2003). CPAR: Classification based on predictive association rules. In Proceedings of the third SIAM international conference on data mining (SDM-03) (pp. 331\u2013335).","DOI":"10.1137\/1.9781611972733.40"},{"key":"86_CR39","doi-asserted-by":"crossref","unstructured":"Zadrozny, B. (2004). Learning and evaluating classifiers under sample selection bias. In Proceedings of 21st international conference on machine learning.","DOI":"10.1145\/1015330.1015425"}],"container-title":["Journal of Intelligent Information Systems"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s10844-009-0086-7.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/article\/10.1007\/s10844-009-0086-7\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s10844-009-0086-7","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2019,5,31]],"date-time":"2019-05-31T02:10:47Z","timestamp":1559268647000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/s10844-009-0086-7"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2009,5,6]]},"references-count":39,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2010,8]]}},"alternative-id":["86"],"URL":"https:\/\/doi.org\/10.1007\/s10844-009-0086-7","relation":{},"ISSN":["0925-9902","1573-7675"],"issn-type":[{"value":"0925-9902","type":"print"},{"value":"1573-7675","type":"electronic"}],"subject":[],"published":{"date-parts":[[2009,5,6]]}}}