{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,9,4]],"date-time":"2024-09-04T22:54:45Z","timestamp":1725490485266},"reference-count":33,"publisher":"IEEE","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2015,9]]},"DOI":"10.1109\/cns.2015.7346820","type":"proceedings-article","created":{"date-parts":[[2015,12,8]],"date-time":"2015-12-08T17:19:48Z","timestamp":1449595188000},"page":"125-133","source":"Crossref","is-referenced-by-count":6,"title":["Separation of benign and malicious network events for accurate malware family classification"],"prefix":"10.1109","author":[{"given":"Hesham","family":"Mekky","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Aziz","family":"Mohaisen","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"family":"Zhi-Li Zhang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2010.25"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/SECPRI.1996.502675"},{"key":"ref31","article-title":"Behavioral clustering of http-based malware and signature generation using malicious network traces","author":"perdisci","year":"2010","journal-title":"NSDI"},{"key":"ref30","article-title":"Botminer: clustering analysis of network traffic for protocol-and structure-independent botnet detection","author":"gu","year":"2008","journal-title":"Usenix Security"},{"key":"ref10","article-title":"Chatter: Exploring classification of malware based on the order of events","author":"mohaisen","year":"2014","journal-title":"CNS"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1162\/neco.1995.7.6.1129"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/CNS.2013.6682751"},{"journal-title":"operation shady RAT McAfee","year":"2011","author":"alperovitch","key":"ref13"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1145\/2487788.2488056"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-04898-2_327"},{"key":"ref16","article-title":"Gene Selection for Cancer Classification using Support Vector Machines","author":"guyon","year":"2002","journal-title":"Machine Learning"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/72.761722"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1148\/radiology.143.1.7063747"},{"key":"ref19","article-title":"Botsniffer: Detecting botnet command and control channels in network traffic","author":"gu","year":"2008","journal-title":"NDSS"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1007\/978-0-387-68768-1_1"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1145\/2517312.2517316"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/SECPRI.2001.924286"},{"key":"ref3","doi-asserted-by":"crossref","DOI":"10.3233\/JCS-2010-0410","article-title":"Automatic analysis of malware behavior using machine learning","author":"rieck","year":"2011","journal-title":"Computer Security"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/2487575.2488219"},{"key":"ref29","article-title":"Bothunter: Detecting malware infection through ids-driven dialog correlation","author":"gu","year":"2007","journal-title":"Usenix Security"},{"key":"ref5","article-title":"Learning and Classification of Malware Behavior","author":"rieck","year":"2008","journal-title":"DIMVA"},{"journal-title":"N-gram Models","year":"2014","key":"ref8"},{"article-title":"Independent Component Analysis","year":"1998","author":"lee","key":"ref7"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1145\/1852666.1852716"},{"key":"ref9","article-title":"Random Forests","author":"breiman","year":"2001","journal-title":"Machine Learning"},{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-08509-8_7"},{"key":"ref20","article-title":"Measuring and detecting fast-flux service networks","author":"holz","year":"2008","journal-title":"NDSS"},{"key":"ref22","article-title":"Exposure: Finding malicious domains using passive dns analysis","author":"bilge","year":"2011","journal-title":"NDSS"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/MALWARE.2008.4690854"},{"key":"ref24","article-title":"Detecting malware domains at the upper dns hierarchy","author":"antonakakis","year":"2011","journal-title":"Usenix Security"},{"key":"ref23","article-title":"Building a dynamic reputation system for dns","author":"antonakakis","year":"2010","journal-title":"Usenix Security"},{"key":"ref26","article-title":"Learning to detect and classify malicious executables in the wild","author":"kolter","year":"2006","journal-title":"Machine Learning Research"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2008.22"}],"event":{"name":"2015 IEEE Conference on Communications and Network Security (CNS)","start":{"date-parts":[[2015,9,28]]},"location":"Florence, Italy","end":{"date-parts":[[2015,9,30]]}},"container-title":["2015 IEEE Conference on Communications and Network Security (CNS)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/7336674\/7346791\/07346820.pdf?arnumber=7346820","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2017,6,23]],"date-time":"2017-06-23T21:10:46Z","timestamp":1498252246000},"score":1,"resource":{"primary":{"URL":"http:\/\/ieeexplore.ieee.org\/document\/7346820\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2015,9]]},"references-count":33,"URL":"https:\/\/doi.org\/10.1109\/cns.2015.7346820","relation":{},"subject":[],"published":{"date-parts":[[2015,9]]}}}