{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,8]],"date-time":"2026-04-08T16:26:46Z","timestamp":1775665606786,"version":"3.50.1"},"reference-count":139,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"6","license":[{"start":{"date-parts":[[2025,11,1]],"date-time":"2025-11-01T00:00:00Z","timestamp":1761955200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,11,1]],"date-time":"2025-11-01T00:00:00Z","timestamp":1761955200000},"content-version":"am","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,11,1]],"date-time":"2025-11-01T00:00:00Z","timestamp":1761955200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,11,1]],"date-time":"2025-11-01T00:00:00Z","timestamp":1761955200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"NSF","award":["2230609"],"award-info":[{"award-number":["2230609"]}]},{"name":"NSF","award":["2230610"],"award-info":[{"award-number":["2230610"]}]},{"name":"NSF","award":["2416990"],"award-info":[{"award-number":["2416990"]}]},{"name":"NSF","award":["2229876"],"award-info":[{"award-number":["2229876"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Dependable and Secure Comput."],"published-print":{"date-parts":[[2025,11]]},"DOI":"10.1109\/tdsc.2025.3576708","type":"journal-article","created":{"date-parts":[[2025,6,5]],"date-time":"2025-06-05T13:39:35Z","timestamp":1749130775000},"page":"5888-5905","source":"Crossref","is-referenced-by-count":7,"title":["SoK: Leveraging Transformers for Malware Analysis"],"prefix":"10.1109","volume":"22","author":[{"ORCID":"https:\/\/orcid.org\/0009-0004-2583-5925","authenticated-orcid":false,"given":"Pradip","family":"Kunwar","sequence":"first","affiliation":[{"name":"Tennessee Tech University, Cookeville, TN, USA"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8000-1086","authenticated-orcid":false,"given":"Kshitiz","family":"Aryal","sequence":"additional","affiliation":[{"name":"Tennessee Tech University, Cookeville, TN, USA"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9189-2478","authenticated-orcid":false,"given":"Maanak","family":"Gupta","sequence":"additional","affiliation":[{"name":"Tennessee Tech University, Cookeville, TN, USA"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5627-5239","authenticated-orcid":false,"given":"Mahmoud","family":"Abdelsalam","sequence":"additional","affiliation":[{"name":"North Carolina A&T State University, Greensboro, NC, USA"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4029-7051","authenticated-orcid":false,"given":"Elisa","family":"Bertino","sequence":"additional","affiliation":[{"name":"Purdue University, West Lafayette, IN, USA"}]}],"member":"263","reference":[{"key":"ref1","article-title":"Malware statistics","year":"2024"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1016\/j.jcss.2014.02.005"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/access.2024.3519524"},{"key":"ref4","article-title":"A comprehensive survey on deep learning based malware detection techniques","volume":"47","author":"Gopinath","year":"2023","journal-title":"Comput. Sci. Rev."},{"key":"ref5","article-title":"Malware detection by eating a whole exe","volume-title":"Proc. Workshops AAAI Conf. Artif. Intell.","author":"Raff"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-15-4018-9_6"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1007\/s10207-021-00553-8"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/IESYS.2017.8233569"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.03762"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1016\/j.aiopen.2022.10.001"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/IV51561.2020.00051"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.15439\/2020F20"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.acl-short.79"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.1810.04805"},{"key":"ref15","article-title":"GPT-4 technical report","author":"Achiam","year":"2023"},{"key":"ref16","article-title":"An image is worth 16 x 16 words: Transformers for image recognition at scale","author":"Dosovitskiy","year":"2020"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/3505244"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2022.3152247"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58452-8_13"},{"key":"ref20","article-title":"Hierarchical text-conditional image generation with clip latents","author":"Ramesh","year":"2022","journal-title":"2204.06125"},{"key":"ref21","article-title":"Video generation models as world simulators","author":"Brooks","year":"2024"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2018.8462506"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102371"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/3447548.3467168"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.21528\/CBIC2021-32"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.3390\/app12157546"},{"key":"ref27","first-page":"267","article-title":"IoT malware threat hunting method based on improved transformer","volume":"25","author":"Li","year":"2023","journal-title":"Int. J. Netw. Secur."},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1145\/3609112"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN52387.2021.9533481"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.3390\/bdcc7020060"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN54540.2023.10191550"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/ISI53945.2021.9624787"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.3390\/s22186766"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/TrustCom.2013.25"},{"key":"ref35","first-page":"171","article-title":"Model checking one million lines of C code","volume-title":"Proc. Annu. Netw. Distrib. Syst. Secur. Symp.","volume":"4","author":"Chen"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1007\/s11416-015-0261-z"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.3390\/sym15030677"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.3048319"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2021.3077498"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/SMARTCOMP52413.2021.00046"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2019.102526"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1007\/BF00994018"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1038\/323533a0"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1207\/s15516709cog1402_1"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1142\/S0218488598000094"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1162\/neco.1997.9.8.1735"},{"key":"ref47","first-page":"3104","article-title":"Sequence to sequence learning with neural networks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Sutskever"},{"key":"ref48","article-title":"Neural machine translation by jointly learning to align and translate","author":"Bahdanau","year":"2014"},{"key":"ref49","article-title":"Layer normalization","author":"Ba","year":"2016"},{"key":"ref50","article-title":"Deep learning using rectified linear units (ReLU)","author":"Agarap","year":"2018"},{"key":"ref51","article-title":"Gaussian error linear units (GELUs)","author":"Hendrycks","year":"2016"},{"key":"ref52","article-title":"DistilBERT, a distilled version of BERT: Smaller, faster, cheaper and lighter","author":"Sanh","year":"2019"},{"key":"ref53","article-title":"RoBERTa: A robustly optimized BERT pretraining approach","author":"Liu","year":"2019"},{"key":"ref54","article-title":"ALBERT: A lite BERT for self-supervised learning of language representations","author":"Lan","year":"2019"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1162\/tacl_a_00448"},{"issue":"8","key":"ref56","article-title":"Language models are unsupervised multitask learners","volume":"1","author":"Radford","year":"2019","journal-title":"OpenAI Blog"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/ICS51289.2020.00087"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/TrustCom50675.2020.00124"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/CSP51677.2021.9357569"},{"key":"ref60","article-title":"Malware detection using transformers-based model GPT-2","author":"\u015eahin","year":"2021"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/NaNA53684.2021.00059"},{"key":"ref62","article-title":"Victory: A framework for fast detection of Iot malware","author":"Bellante"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/ICAML57167.2022.00069"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2022.3172432"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2022.3206445"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2022.3211254"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/SVCC56964.2023.10165170"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/TNSE.2023.3292855"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1145\/3600160.3605057"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.3390\/app13116839"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.3233\/JIFS-233556"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3409083"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-91608-4_42"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1109\/SMC52423.2021.9659287"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/HPCC-DSS-SmartCity-DependSys57074.2022.00137"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1109\/ICICN56848.2022.10006552"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2022.102846"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-21753-1_29"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2023.3293530"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.3390\/fi14070209"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1109\/GCON58516.2023.10183602"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1109\/SysCon48628.2021.9447094"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.14445\/22315381\/ijett-v68i5p207s"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2022.3179384"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1109\/TrustCom53373.2021.00130"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2023.119598"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP40776.2020.9053916"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/N19-1133"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1145\/2623330.2623732"},{"key":"ref90","article-title":"Efficient estimation of word representations in vector space","author":"Mikolov","year":"2013"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1016\/j.inffus.2018.12.006"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1145\/3511808.3557533"},{"key":"ref93","article-title":"IoTPOT: Analysing the rise of IoT compromises","volume-title":"Proc. 9th USENIX Workshop Offensive Technol.","author":"Pa"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.2197\/ipsjjip.24.522"},{"key":"ref95","article-title":"IoT-23: A labeled dataset with malicious and benign IoT network traffic","author":"Garcia","year":"2020"},{"key":"ref96","article-title":"Android malware genome project \u2014 Malgenomeproject.org","year":"2024"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.1109\/CCST.2019.8888430"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.1016\/j.adhoc.2021.102621"},{"key":"ref99","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2021.3085194"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2022.3165809"},{"key":"ref101","article-title":"EMBER: An open dataset for training static pe malware machine learning models","author":"Anderson","year":"2018"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.3390\/s19051114"},{"key":"ref103","article-title":"IOT_Malware_dataset_for classification","year":"2021"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2014.23247"},{"key":"ref105","first-page":"468","article-title":"AndroZoo: Collecting millions of android apps for the research community","volume-title":"Proc. 13th Int. Conf. Mining Softw. Repositories","author":"Allix"},{"key":"ref106","doi-asserted-by":"publisher","DOI":"10.1109\/DASC-PICom-CBDCom-CyberSciTech49142.2020.00094"},{"key":"ref107","article-title":"A benchmark API call dataset for windows PE malware classification","author":"Catak","year":"2019"},{"key":"ref108","article-title":"","author":"Harang","year":"2020"},{"key":"ref109","article-title":"Behavioral malware detection using deep graph convolutional neural networks","author":"de Oliveira","year":"2023","journal-title":"Authorea Preprints"},{"key":"ref110","doi-asserted-by":"publisher","DOI":"10.1145\/2016904.2016908"},{"key":"ref111","article-title":"Malware analysis datasets: Top-1000 PE imports","author":"Oliveira","year":"2019"},{"key":"ref112","article-title":"Speakeasy: Portable, modular, binary emulator designed to emulate windows kernel and user mode malware","year":"2021"},{"key":"ref113","article-title":"Avast-CTU public CAPE dataset","author":"Bosansky","year":"2022"},{"key":"ref114","article-title":"Malicious code dataset","year":"2019"},{"key":"ref115","article-title":"Alexa top 1 million sites","author":"Ghodke","year":"2024"},{"key":"ref116","article-title":"Alexa top websites","year":"2024"},{"key":"ref117","article-title":"DGA dataset","year":"2021"},{"key":"ref118","article-title":"Stratosphere laboratory datasets","year":"2015"},{"key":"ref119","doi-asserted-by":"publisher","DOI":"10.5220\/0006639801080116"},{"key":"ref120","article-title":"Home - Netlab OpenData project","year":"2022"},{"key":"ref121","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/S18-1113"},{"key":"ref122","article-title":"VirusTotal","year":"2024"},{"key":"ref123","article-title":"VirusShare","year":"2024"},{"key":"ref124","article-title":"MalwareBazaar \u2013 Malware sample exchange","year":"2024"},{"key":"ref125","article-title":"Malpedia","author":"Fkie","year":"2024"},{"key":"ref126","article-title":"Microsoft malware classification challenge","author":"Ronen","year":"2018"},{"key":"ref127","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2018.03.007"},{"key":"ref128","doi-asserted-by":"publisher","DOI":"10.1109\/CCST.2017.8167792"},{"key":"ref129","article-title":"Android apps on Google play","year":"2024"},{"key":"ref130","doi-asserted-by":"crossref","DOI":"10.31979\/etd.q3dd-gp9u","article-title":"PE header analysis for malware detection","author":"Kim","year":"2018"},{"key":"ref131","article-title":"Attention bottlenecks for multimodal fusion","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Nagrani"},{"key":"ref132","doi-asserted-by":"publisher","DOI":"10.1109\/TCSVT.2023.3243725"},{"key":"ref133","first-page":"15084","article-title":"Decision transformer: Reinforcement learning via sequence modeling","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Chen"},{"key":"ref134","article-title":"Transdreamer: Reinforcement learning with transformer world models","author":"Chen","year":"2022"},{"key":"ref135","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.emnlp-main.498"},{"key":"ref136","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.464"},{"key":"ref137","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.emnlp-main.522"},{"key":"ref138","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v36i3.20169"},{"key":"ref139","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3442617"}],"container-title":["IEEE Transactions on Dependable and Secure Computing"],"original-title":[],"link":[{"URL":"https:\/\/ieeexplore.ieee.org\/ielam\/8858\/11242243\/11026080-aam.pdf","content-type":"application\/pdf","content-version":"am","intended-application":"syndication"},{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/8858\/11242243\/11026080.pdf?arnumber=11026080","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,11,14]],"date-time":"2025-11-14T21:01:06Z","timestamp":1763154066000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11026080\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,11]]},"references-count":139,"journal-issue":{"issue":"6"},"URL":"https:\/\/doi.org\/10.1109\/tdsc.2025.3576708","relation":{},"ISSN":["1545-5971","1941-0018","2160-9209"],"issn-type":[{"value":"1545-5971","type":"print"},{"value":"1941-0018","type":"electronic"},{"value":"2160-9209","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,11]]}}}