{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,19]],"date-time":"2026-05-19T05:12:05Z","timestamp":1779167525003,"version":"3.51.4"},"reference-count":86,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"name":"Horizon Europe PERUN Project"},{"name":"European Union\u2019s Horizon Europe Research and Innovation Programme","award":["101225653"],"award-info":[{"award-number":["101225653"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Access"],"published-print":{"date-parts":[[2026]]},"DOI":"10.1109\/access.2026.3691124","type":"journal-article","created":{"date-parts":[[2026,5,7]],"date-time":"2026-05-07T19:54:26Z","timestamp":1778183666000},"page":"73006-73028","source":"Crossref","is-referenced-by-count":0,"title":["Malware Detection and Encryption: A Meta-Survey With a Unified Analytical Framework"],"prefix":"10.1109","volume":"14","author":[{"given":"Aleksandra","family":"Pawlicka","sequence":"first","affiliation":[{"name":"ITTI, Poznań, Poland"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Marek","family":"Pawlicki","sequence":"additional","affiliation":[{"name":"ITTI, Poznań, Poland"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Pawe\u0142","family":"Rajba","sequence":"additional","affiliation":[{"name":"FernUniversität in Hagen, Hagen, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Rafa\u0142","family":"Kozik","sequence":"additional","affiliation":[{"name":"ITTI, Poznań, Poland"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Wojciech","family":"Mazurczyk","sequence":"additional","affiliation":[{"name":"FernUniversität in Hagen, Hagen, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6466-3354","authenticated-orcid":false,"given":"Luca","family":"Caviglione","sequence":"additional","affiliation":[{"name":"Consiglio Nazionale delle Ricerche, Rome, Italy"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1405-9911","authenticated-orcid":false,"given":"Micha\u0142","family":"Chora\u015b","sequence":"additional","affiliation":[{"name":"Bydgoszcz University of Science and Technology, Bydgoszcz, Poland"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","article-title":"Malware resistant data protection in hyper-connected networks: A survey","author":"Ferdous","year":"2023","journal-title":"arXiv:2307.13164"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1145\/3647444.3647830"},{"issue":"6","key":"ref3","doi-asserted-by":"crossref","first-page":"729","DOI":"10.1016\/j.bushor.2021.07.010","article-title":"A $10 million question and other cybersecurity-related ethical dilemmas amid the COVID-19 pandemic","volume":"64","author":"Pawlicka","year":"2021","journal-title":"Bus. Horizons"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1186\/s40537-025-01157-y"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1155\/2018\/8753870"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1016\/j.cosrev.2022.100529"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1007\/s10462-024-10972-3"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.55662\/JST.2024.5401"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1016\/j.mlwa.2024.100546"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2023.103595"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1155\/2023\/8227751"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1136\/bmj.n71"},{"key":"ref13","doi-asserted-by":"crossref","DOI":"10.1016\/j.neucom.2023.126533","article-title":"The survey and meta-analysis of the attacks, transgressions, countermeasures and security aspects common to the cloud, edge and IoT","volume":"551","author":"Pawlicki","year":"2023","journal-title":"Neurocomputing"},{"issue":"3","key":"ref14","first-page":"1","article-title":"PICO search strategies","volume":"17","author":"Yensen","year":"2013","journal-title":"Online J. Nursing Informat."},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1016\/j.icte.2024.03.005"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2023.122255"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2023.3323396"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.32604\/cmes.2025.064926"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.32629\/jai.v7i5.1287"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2023.3235389"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2024.3397921"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.62019\/abbdm.v4i4.252"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.62527\/joiv.8.2.2725"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/msec.2022.3178205"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2023.3268535"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2023.103134"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.3390\/info14070374"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.52589\/bjcnit-fcedoomy"},{"key":"ref29","article-title":"Generative adversarial networks for malware detection: A survey","author":"Dunmore","year":"2023","journal-title":"arXiv:2302.08558"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1016\/j.knosys.2025.114032"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2025.111638"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1016\/j.compeleceng.2024.109233"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1016\/j.asej.2024.103134"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2025.104724"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1016\/j.jisa.2025.104009"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1016\/j.cosrev.2026.100914"},{"key":"ref37","article-title":"Recent advances in malware detection: Graph learning and explainability","author":"Shokouhinejad","year":"2025","journal-title":"arXiv:2502.10556"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/ICDMW69685.2025.00126"},{"issue":"1","key":"ref39","first-page":"1","article-title":"Advances in android malware detection: Integrating static, dynamic, and hybrid techniques","volume":"58","author":"Dwivedi","year":"2024","journal-title":"Shodh Sarita"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2023.3335187"},{"key":"ref41","article-title":"A malware classification survey on adversarial attacks and defences","author":"Ponnuru","year":"2023","journal-title":"arXiv:2312.09636"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/OJVT.2022.3219898"},{"key":"ref43","article-title":"Unraveling the key of machine learning solutions for Android malware detection","author":"Liu","year":"2024","journal-title":"arXiv:2402.02953"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1145\/3769676"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1016\/j.compeleceng.2024.109544"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1287\/mnsc.2023.03691"},{"key":"ref47","volume-title":"Data Theft From Salesforce Instances via Salesloft and Drift","year":"2025"},{"key":"ref48","volume-title":"User Manual: Akira Decryptor","year":"2024"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.5220\/0011265300003283"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/ecrime66972.2025.11327742"},{"key":"ref51","article-title":"Evaluation of live forensic techniques, towards Salsa20-based cryptographic ransomware mitigation","volume":"46","author":"Fernandez de Loaysa Babiano","year":"2023","journal-title":"Forensic Sci. Int., Digit. Invest."},{"key":"ref52","volume-title":"Ransomware Threat Report 2021","year":"2021"},{"key":"ref53","volume-title":"Reverse Engineering Dridex and Automating IOC Extraction","year":"2021"},{"key":"ref54","article-title":"Intermittent file encryption in ransomware: Measurement, modeling, and detection","author":"Ineza","year":"2025","journal-title":"arXiv:2510.15133"},{"key":"ref55","volume-title":"Demystifying BlackMatter Ransomware","year":"2025"},{"key":"ref56","volume-title":"Malware Analysis Report: Rhythmic Parry","year":"2023"},{"key":"ref57","volume-title":"Highway to Conti: Analysis of BazarLoader","author":"Eriksson","year":"2021"},{"key":"ref58","volume-title":"DPRK Adopts EtherHiding Technique","year":"2023"},{"key":"ref59","volume-title":"Weekly Intelligence Report 31 October 2025","year":"2025"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-68671-1_2"},{"key":"ref61","article-title":"Strong cryptography armoured computer viruses forbidding code analysis: The Bradley virus","author":"Filiol","year":"2004"},{"key":"ref62","first-page":"1","article-title":"Impeding malware analysis using conditional code obfuscation","volume-title":"Proc. NDSS","author":"Sharif"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1145\/1127345.1127349"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.3390\/fi4040971"},{"key":"ref65","volume-title":"Genetic Malware: Designing Payloads for Specific Targets","author":"Morrow","year":"2016"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-24660-2_14"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-61273-7_12"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2021.3112750"},{"key":"ref69","doi-asserted-by":"crossref","first-page":"204","DOI":"10.1007\/978-3-642-33448-1_28","article-title":"Cybercrime: The case of obfuscated malware","volume":"99","author":"Mamoun","year":"2012","journal-title":"Global Security, Safety and Sustainability & e-Democracy (ICGS3\/e-Democracy 2011)"},{"issue":"3","key":"ref70","first-page":"100","article-title":"Challenge of malware analysis: Malware obfuscation techniques","volume":"7","author":"Singh","year":"2018","journal-title":"Int. J. Inf. Secur. Sci."},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/BWCCA.2010.85"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1109\/MALWARE.2012.6461002"},{"key":"ref73","volume-title":"Whitespace: A Different Approach to Javascript Obfuscation","author":"Kolisar","year":"2026"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1145\/2133375.2133377"},{"key":"ref75","article-title":"ROPInjector: Using return oriented programming for polymorphism and antivirus evasion","volume-title":"Black Hat USA","author":"Poulios"},{"key":"ref76","first-page":"77","article-title":"Frankenstein: Stitching malware from benign binaries","volume":"12","author":"Mohan","year":"2012","journal-title":"WOOT"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1109\/ITNEC.2016.7560382"},{"key":"ref78","volume-title":"Threat Actor Usage of AI Tools","year":"2025"},{"key":"ref79","article-title":"Next-gen metamorphism: Analyzing the potential of LLM-driven","author":"Coppolino","year":"2025","journal-title":"SSRN Electron. J."},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-96-0573-6_14"},{"key":"ref81","article-title":"From text to mitre techniques: Exploring the malicious use of large language models for generating cyber attack payloads","author":"Charan","year":"2023","journal-title":"arXiv:2305.15336"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1016\/j.hcc.2024.100211"},{"key":"ref83","article-title":"Large language models in cybersecurity: State-of-the-art","author":"Motlagh","year":"2024","journal-title":"arXiv:2402.00891"},{"key":"ref84","first-page":"4693","article-title":"Malla: Demystifying real-world large language model integrated malicious services","volume-title":"Proc. 33rd USENIX Secur. Symp. (USENIX Secur.)","author":"Lin"},{"key":"ref85","first-page":"1","article-title":"Being a bad influence on the kids: Malware generation in less than five minutes using ChatGPT","volume-title":"Proc. The 18th Int. Conf. Availability, Rel. Secur. (ARES)","author":"Monje"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1007\/BFb0052229"}],"container-title":["IEEE Access"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/6287639\/11323511\/11511678.pdf?arnumber=11511678","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,5,19]],"date-time":"2026-05-19T04:39:21Z","timestamp":1779165561000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11511678\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"references-count":86,"URL":"https:\/\/doi.org\/10.1109\/access.2026.3691124","relation":{},"ISSN":["2169-3536"],"issn-type":[{"value":"2169-3536","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]}}}