{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,10]],"date-time":"2026-09-10T09:10:23Z","timestamp":1789031423926,"version":"build-2803163510"},"reference-count":64,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Computers & Security"],"published-print":{"date-parts":[[2026,11]]},"DOI":"10.1016\/j.cose.2026.105033","type":"journal-article","created":{"date-parts":[[2026,7,6]],"date-time":"2026-07-06T15:45:16Z","timestamp":1783352716000},"page":"105033","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["DSFDU: Detection of unicode modifier letter obfuscated commands in Living-Off-the-Land attacks"],"prefix":"10.1016","volume":"170","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-0440-3638","authenticated-orcid":false,"given":"Xin","family":"Liu","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-2660-3140","authenticated-orcid":false,"given":"Feiyan","family":"Liu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2589-1164","authenticated-orcid":false,"given":"Guanglu","family":"Sun","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"issue":"1","key":"10.1016\/j.cose.2026.105033_b1","doi-asserted-by":"crossref","DOI":"10.1145\/3687300","article-title":"MITRE ATT&CK: State of the art and way forward","volume":"57","author":"Al-Sada","year":"2024","journal-title":"ACM Comput. Surv."},{"key":"10.1016\/j.cose.2026.105033_b2","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2022.102658","article-title":"MPSAutodetect: a malicious powershell script detection model based on stacked denoising auto-encoder","volume":"116","author":"Alahmadi","year":"2022","journal-title":"Comput. Secur."},{"issue":"4","key":"10.1016\/j.cose.2026.105033_b3","doi-asserted-by":"crossref","first-page":"2485","DOI":"10.1109\/JIOT.2021.3086398","article-title":"SHELLCORE: Automating malicious IoT software detection using shell commands representation","volume":"9","author":"Alasmary","year":"2021","journal-title":"IEEE Internet Things J."},{"key":"10.1016\/j.cose.2026.105033_b4","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2024.104222","article-title":"Cyberattack event logs classification using deep learning with semantic feature analysis","volume":"150","author":"Alzu\u2019bi","year":"2025","journal-title":"Comput. Secur."},{"key":"10.1016\/j.cose.2026.105033_b5","series-title":"International Workshop on Recent Advances in Intrusion Detection","first-page":"36","article-title":"Detecting malicious software by monitoring anomalous windows registry accesses","author":"Apap","year":"2002"},{"key":"10.1016\/j.cose.2026.105033_b6","series-title":"2017 IEEE International Conference on Acoustics, Speech and Signal Processing","first-page":"2482","article-title":"Malware classification with LSTM and GRU language models and a character-level CNN","author":"Athiwaratkun","year":"2017"},{"key":"10.1016\/j.cose.2026.105033_b7","series-title":"2021 IEEE Symposium on Security and Privacy","first-page":"1557","article-title":"Survivalism: Systematic analysis of windows malware living-off-the-land","author":"Barr-Smith","year":"2021"},{"key":"10.1016\/j.cose.2026.105033_b8","series-title":"Proceedings of the 2nd USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET 09)","article-title":"A view on current malware behaviors","author":"Bayer","year":"2009"},{"key":"10.1016\/j.cose.2026.105033_b9","series-title":"Proceedings of the 8th ACM Workshop on Artificial Intelligence and Security","first-page":"35","article-title":"Malicious behavior detection using windows audit logs","author":"Berlin","year":"2015"},{"key":"10.1016\/j.cose.2026.105033_b10","series-title":"Windows command-line obfuscation","author":"Beukema","year":"2019"},{"key":"10.1016\/j.cose.2026.105033_b11","series-title":"Bypassing detections with command-line obfuscation","author":"Beukema","year":"2025"},{"key":"10.1016\/j.cose.2026.105033_b12","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2024.103805","article-title":"LogPr\u00e9cis: Unleashing language models for automated malicious log analysis: Pr\u00e9cis: A concise summary of essential points, statements, or facts","volume":"141","author":"Boffa","year":"2024","journal-title":"Comput. Secur."},{"key":"10.1016\/j.cose.2026.105033_b13","series-title":"Invoke-obfuscation: PowerShell obfuscator","author":"Bohannon","year":"2016"},{"key":"10.1016\/j.cose.2026.105033_b14","series-title":"Invoke-dosfuscation: Cmd.exe command obfuscation generator & detection test harness","author":"Bohannon","year":"2018"},{"key":"10.1016\/j.cose.2026.105033_b15","series-title":"IoTBDS","first-page":"194","article-title":"Deep dive into hunting for lotls using machine learning and feature engineering","author":"Boros","year":"2023"},{"key":"10.1016\/j.cose.2026.105033_b16","series-title":"IoTBDS","first-page":"133","article-title":"Machine learning and feature engineering for detecting living off the land attacks","author":"Boros","year":"2022"},{"key":"10.1016\/j.cose.2026.105033_b17","series-title":"2022 52nd Annual IEEE\/IFIP International Conference on Dependable Systems and Networks","first-page":"295","article-title":"Invoke-deobfuscation: AST-based and semantics-preserving deobfuscation for PowerShell scripts","author":"Chai","year":"2022"},{"key":"10.1016\/j.cose.2026.105033_b18","series-title":"International Conference on Information Security","first-page":"59","article-title":"SIFAST: An efficient unix shell embedding framework for malicious detection","author":"Chen","year":"2023"},{"key":"10.1016\/j.cose.2026.105033_b19","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2025.104397","article-title":"APIARY: An API-based automatic rule generator for yara to enhance malware detection","volume":"153","author":"Coscia","year":"2025","journal-title":"Comput. Secur."},{"key":"10.1016\/j.cose.2026.105033_b20","doi-asserted-by":"crossref","first-page":"30","DOI":"10.1016\/j.neucom.2021.03.117","article-title":"Effective method for detecting malicious PowerShell scripts based on hybrid features","volume":"448","author":"Fang","year":"2021","journal-title":"Neurocomputing"},{"key":"10.1016\/j.cose.2026.105033_b21","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2021.102550","article-title":"A systematical and longitudinal study of evasive behaviors in windows malware","volume":"113","author":"Galloro","year":"2022","journal-title":"Comput. Secur."},{"key":"10.1016\/j.cose.2026.105033_b22","series-title":"2025 IEEE Annual Computer Security Applications Conference (ACSAC)","first-page":"1288","article-title":"Fooling machine\u2019s eyes: unicode modifier letter evasion attack","author":"Gao","year":"2025"},{"key":"10.1016\/j.cose.2026.105033_b23","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2021.102366","article-title":"Handling webshell attacks: A systematic mapping and survey","volume":"108","author":"Hannousse","year":"2021","journal-title":"Comput. Secur."},{"key":"10.1016\/j.cose.2026.105033_b24","series-title":"Proceedings of the 2018 on Asia Conference on Computer and Communications Security","first-page":"187","article-title":"Detecting malicious powershell commands using deep neural networks","author":"Hendler","year":"2018"},{"key":"10.1016\/j.cose.2026.105033_b25","series-title":"Proceedings of the 15th ACM Asia Conference on Computer and Communications Security","first-page":"679","article-title":"Amsi-based detection of malicious powershell code using contextual embeddings","author":"Hendler","year":"2020"},{"key":"10.1016\/j.cose.2026.105033_b26","doi-asserted-by":"crossref","DOI":"10.1016\/j.dss.2023.113928","article-title":"Cyber threat detection: Unsupervised hunting of anomalous commands (UHAC)","volume":"168","author":"Kayhan","year":"2023","journal-title":"Decis. Support Syst."},{"key":"10.1016\/j.cose.2026.105033_b27","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2022.102789","article-title":"Threat classification model for security information event management focusing on model efficiency","volume":"120","author":"Kim","year":"2022","journal-title":"Comput. Secur."},{"key":"10.1016\/j.cose.2026.105033_b28","doi-asserted-by":"crossref","first-page":"94","DOI":"10.1016\/j.cose.2018.08.009","article-title":"Dynamic log file analysis: An unsupervised cluster evolution approach for anomaly detection","volume":"79","author":"Landauer","year":"2018","journal-title":"Comput. Secur."},{"key":"10.1016\/j.cose.2026.105033_b29","article-title":"A machine learning-enhanced endpoint detection and response framework for fast and proactive defense against advanced cyber attacks.","volume":"28","author":"Lee","year":"2024","journal-title":"Soft Computing-A Fusion Found. Methodol. Appl."},{"key":"10.1016\/j.cose.2026.105033_b30","series-title":"Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security","first-page":"1831","article-title":"Effective and light-weight deobfuscation and semantic-aware attack detection for powershell scripts","author":"Li","year":"2019"},{"key":"10.1016\/j.cose.2026.105033_b31","series-title":"Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security","first-page":"4539","article-title":"PowerPeeler: A precise and general dynamic deobfuscation method for PowerShell scripts","author":"Li","year":"2024"},{"key":"10.1016\/j.cose.2026.105033_b32","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2025.104588","article-title":"MIRDETECTOR: Applying malicious intent representation for enhanced apt anomaly detection","author":"Li","year":"2025","journal-title":"Comput. Secur."},{"key":"10.1016\/j.cose.2026.105033_b33","doi-asserted-by":"crossref","first-page":"168","DOI":"10.1016\/j.comcom.2020.03.048","article-title":"HMMs based masquerade detection for network security on with parallel computing","volume":"156","author":"Liu","year":"2020","journal-title":"Comput. Commun."},{"key":"10.1016\/j.cose.2026.105033_b34","series-title":"LOLBAS (living off the land binaries and scripts)","author":"LOLBAS Project Contributors","year":"2024"},{"key":"10.1016\/j.cose.2026.105033_b35","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1016\/j.future.2021.11.030","article-title":"A study on malicious software behaviour analysis and detection techniques: Taxonomy, current trends and challenges","volume":"130","author":"Maniriho","year":"2022","journal-title":"Future Gener. Comput. Syst."},{"key":"10.1016\/j.cose.2026.105033_b36","series-title":"Reg commands","author":"Microsoft","year":"2025"},{"key":"10.1016\/j.cose.2026.105033_b37","series-title":"RunOnce registry key - windows drivers","author":"Microsoft","year":"2025"},{"key":"10.1016\/j.cose.2026.105033_b38","series-title":"File system redirector","author":"Microsoft Corporation","year":"2023"},{"key":"10.1016\/j.cose.2026.105033_b39","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2024.104040","article-title":"HEOD: Human-assisted ensemble outlier detection for cybersecurity","volume":"146","author":"Najafi","year":"2024","journal-title":"Comput. Secur."},{"key":"10.1016\/j.cose.2026.105033_b40","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2023.103519","article-title":"You are your friends: Detecting malware via guilt-by-association and exempt-by-reputation","volume":"136","author":"Najafi","year":"2024","journal-title":"Comput. Secur."},{"key":"10.1016\/j.cose.2026.105033_b41","series-title":"2023 IEEE International Conference on Sensors, Electronics and Computer Engineering","first-page":"159","article-title":"A survey of detection methods research on living-off-the-land techniques","author":"Ning","year":"2023"},{"key":"10.1016\/j.cose.2026.105033_b42","series-title":"Proceedings of the 24th International Symposium on Research in Attacks, Intrusions and Defenses","first-page":"442","article-title":"Living-off-the-land command detection using active learning","author":"Ongun","year":"2021"},{"key":"10.1016\/j.cose.2026.105033_b43","series-title":"2023 7th Cyber Security in Networking Conference (CSNet)","first-page":"192","article-title":"Unveiling stealth attack paths in windows environments using AWARE","author":"Poisson","year":"2023"},{"key":"10.1016\/j.cose.2026.105033_b44","article-title":"Obfuscation detection using matrix complexity features of binary grayscale images","author":"Raubitzek","year":"2025","journal-title":"Comput. Secur."},{"key":"10.1016\/j.cose.2026.105033_b45","article-title":"MAGIC: Malware behaviour analysis and impact quantification through signature co-occurrence and regression","volume":"139","author":"Rohini","year":"2024","journal-title":"Comput. Secur."},{"key":"10.1016\/j.cose.2026.105033_b46","series-title":"2022 IEEE Symposium on Security and Privacy","first-page":"1574","article-title":"Wobfuscator: Obfuscating javascript malware via opportunistic translation to webassembly","author":"Romano","year":"2022"},{"key":"10.1016\/j.cose.2026.105033_b47","series-title":"28th USENIX Security Symposium (USENIX Security 19)","first-page":"303","article-title":"ALOHA: Auxiliary loss optimization for hypothesis augmentation","author":"Rudd","year":"2019"},{"key":"10.1016\/j.cose.2026.105033_b48","series-title":"Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security","first-page":"2276","article-title":"Ast-based deep learning for detecting malicious powershell","author":"Rusak","year":"2018"},{"key":"10.1016\/j.cose.2026.105033_b49","series-title":"Proceedings of the 25th International Conference on World Wide Web","first-page":"1021","article-title":"No honor among thieves: A large-scale analysis of malicious web shells","author":"Starov","year":"2016"},{"key":"10.1016\/j.cose.2026.105033_b50","series-title":"International Workshop on Security","first-page":"39","article-title":"Detection of malicious powershell using word-level language models","author":"Tajiri","year":"2020"},{"key":"10.1016\/j.cose.2026.105033_b51","series-title":"Latest astaroth living-off-the-land attacks are even more invisible but not less observable","author":"Team","year":"2020"},{"key":"10.1016\/j.cose.2026.105033_b52","series-title":"MITRE ATT&CK","author":"The MITRE Corporation","year":"2017"},{"key":"10.1016\/j.cose.2026.105033_b53","series-title":"Unicode chart: Spacing modifier letters","author":"The Unicode Consortium","year":"2022"},{"key":"10.1016\/j.cose.2026.105033_b54","doi-asserted-by":"crossref","first-page":"256","DOI":"10.1109\/ACCESS.2022.3232505","article-title":"PowerDP: De-obfuscating and profiling malicious PowerShell commands with multi-label classifiers","volume":"11","author":"Tsai","year":"2022","journal-title":"IEEE Access"},{"key":"10.1016\/j.cose.2026.105033_b55","series-title":"33rd USENIX Security Symposium (USENIX Security 24)","first-page":"5179","article-title":"You cannot escape me: Detecting evasions of SIEM rules in enterprise networks","author":"Uetz","year":"2024"},{"key":"10.1016\/j.cose.2026.105033_b56","series-title":"Unicode Standard Annex #15: Unicode Normalization Forms","author":"Unicode Consortium","year":"2023"},{"key":"10.1016\/j.cose.2026.105033_b57","series-title":"ArgFuscator: Online command line obfuscation tool","author":"Wietze","year":"2024"},{"key":"10.1016\/j.cose.2026.105033_b58","series-title":"Living off the Land and Fileless Attack Techniques","author":"Wueest","year":"2017"},{"key":"10.1016\/j.cose.2026.105033_b59","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2023.103631","article-title":"Analysis of statistical properties of variables in log data for advanced anomaly detection in cyber security","volume":"137","author":"Wurzenberger","year":"2024","journal-title":"Comput. Secur."},{"key":"10.1016\/j.cose.2026.105033_b60","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2024.104049","article-title":"PHP-based malicious webshell detection based on abstract syntax tree simplification and explicit duration recurrent networks","volume":"146","author":"Xie","year":"2024","journal-title":"Comput. Secur."},{"issue":"3","key":"10.1016\/j.cose.2026.105033_b61","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3073559","article-title":"A survey on malware detection using data mining techniques","volume":"50","author":"Ye","year":"2017","journal-title":"ACM Comput. Surv."},{"key":"10.1016\/j.cose.2026.105033_b62","series-title":"NDSS","article-title":"Alchemist: Fusing application and audit logs for precise attack provenance without instrumentation","author":"Yu","year":"2021"},{"key":"10.1016\/j.cose.2026.105033_b63","series-title":"2022 IEEE 25th International Conference on Computer Supported Cooperative Work in Design","first-page":"305","article-title":"Masquerade detection based on temporal convolutional network","author":"Zhai","year":"2022"},{"key":"10.1016\/j.cose.2026.105033_b64","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2025.104441","article-title":"Power-ASTNN: A deobfuscation and AST neural network enabled effective detection method for malicious PowerShell scripts","volume":"154","author":"Zhang","year":"2025","journal-title":"Comput. Secur."}],"container-title":["Computers & Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0167404826002099?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0167404826002099?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,9,10]],"date-time":"2026-09-10T08:48:19Z","timestamp":1789030099000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0167404826002099"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,11]]},"references-count":64,"alternative-id":["S0167404826002099"],"URL":"https:\/\/doi.org\/10.1016\/j.cose.2026.105033","relation":{},"ISSN":["0167-4048"],"issn-type":[{"value":"0167-4048","type":"print"}],"subject":[],"published":{"date-parts":[[2026,11]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"DSFDU: Detection of unicode modifier letter obfuscated commands in Living-Off-the-Land attacks","name":"articletitle","label":"Article Title"},{"value":"Computers & Security","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.cose.2026.105033","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 Elsevier Ltd. All rights are reserved, including those for text and data mining, AI training, and similar technologies.","name":"copyright","label":"Copyright"}],"article-number":"105033"}}