{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,1]],"date-time":"2026-09-01T15:37:00Z","timestamp":1788277020508,"version":"build-2803163510"},"reference-count":103,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"6","license":[{"start":{"date-parts":[[2022,6,1]],"date-time":"2022-06-01T00:00:00Z","timestamp":1654041600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2022,6,1]],"date-time":"2022-06-01T00:00:00Z","timestamp":1654041600000},"content-version":"am","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2022,6,1]],"date-time":"2022-06-01T00:00:00Z","timestamp":1654041600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2022,6,1]],"date-time":"2022-06-01T00:00:00Z","timestamp":1654041600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["1801599"],"award-info":[{"award-number":["1801599"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Neural Netw. Learning Syst."],"published-print":{"date-parts":[[2022,6]]},"DOI":"10.1109\/tnnls.2021.3121248","type":"journal-article","created":{"date-parts":[[2021,11,1]],"date-time":"2021-11-01T16:09:48Z","timestamp":1635782988000},"page":"2518-2529","source":"Crossref","is-referenced-by-count":14,"title":["Learning Fast and Slow: Propedeutica for Real-Time Malware Detection"],"prefix":"10.1109","volume":"33","author":[{"given":"Ruimin","family":"Sun","sequence":"first","affiliation":[{"name":"Khoury College of Computer Sciences, Northeastern University, Boston, MA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0782-4187","authenticated-orcid":false,"given":"Xiaoyong","family":"Yuan","sequence":"additional","affiliation":[{"name":"College of Computing, Michigan Technological University, Houghton, MI, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6525-6299","authenticated-orcid":false,"given":"Pan","family":"He","sequence":"additional","affiliation":[{"name":"Department of Computer and Information Science and Engineering, University of Florida, Gainesville, FL, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8703-7425","authenticated-orcid":false,"given":"Qile","family":"Zhu","sequence":"additional","affiliation":[{"name":"Department of Computer and Information Science and Engineering, University of Florida, Gainesville, FL, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Aokun","family":"Chen","sequence":"additional","affiliation":[{"name":"Department of Electrical and Computer Engineering, University of Florida, Gainesville, FL, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1766-5757","authenticated-orcid":false,"given":"Andr\u00e9","family":"Gr\u00e9gio","sequence":"additional","affiliation":[{"name":"Department of Informatics, Federal University of Parana, Curitiba, Brazil"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3488-0053","authenticated-orcid":false,"given":"Daniela","family":"Oliveira","sequence":"additional","affiliation":[{"name":"Department of Electrical and Computer Engineering, University of Florida, Gainesville, FL, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xiaolin","family":"Li","sequence":"additional","affiliation":[{"name":"Cognization Lab, Palo Alto, CA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-45719-2_15"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.30"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/CSAC.1998.738566"},{"key":"ref4","volume-title":"Bromium End Point Protection","year":"2010"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2005.20"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/1342211.1342215"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1007\/11506881_11"},{"key":"ref8","first-page":"351","article-title":"Effective and efficient malware detection at the end host","volume-title":"Proc. 18th Conf. USENIX Secur. Symp. (SSYM)","author":"Kolbitsch"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/2338965.2336768"},{"key":"ref10","first-page":"180","article-title":"TTAnalyze: A tool for analyzing malware","volume-title":"Proc. 15th Eur. Inst. Comput. Antivirus Res. (EICAR)","author":"Bayer"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.3233\/JCS-980109"},{"key":"ref12","first-page":"8","article-title":"Scalable, behavior-based malware clustering","volume-title":"Proc. NDSS","volume":"9","author":"Bayer"},{"issue":"12","key":"ref13","first-page":"1","article-title":"A detailed analysis on NSL-KDD dataset using various machine learning techniques for intrusion detection","volume":"2","author":"Revathi","year":"2013","journal-title":"Int. J. Eng. Res. Technol."},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.3233\/JCS-2010-0410"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1145\/1866307.1866353"},{"key":"ref16","volume-title":"The Modern Malware Review","year":"2013"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1007\/bf00116900"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1023\/A:I0I0933404324"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.7551\/mitpress\/7496.003.0016"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1038\/Nature14539"},{"key":"ref21","first-page":"61","article-title":"Dl4MD: A deep learning framework for intelligent malware detection","volume-title":"Proc. Int. Conf. Data Mining (DMIN)","author":"Hardy"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1145\/3097983.3098158"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-50127-7_11"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2018.2886017"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2019.2933524"},{"key":"ref26","volume-title":"Windows 7 Most Hit by Wannacry Ransomware","author":"Arghire","year":"2017"},{"key":"ref27","volume-title":"Process Monitor V3.40","author":"Russinovich","year":"2017"},{"key":"ref28","volume-title":"Drstrace","year":"2017"},{"key":"ref29","volume-title":"CoreOS Tools","year":"2009"},{"key":"ref30","volume-title":"Windbg Logger","year":"2017"},{"key":"ref31","volume-title":"Ntapi","author":"Jurczyk","year":"2017"},{"key":"ref32","volume-title":"Propedeutica Driver Publicly","year":"2018"},{"key":"ref33","volume-title":"DbgPrint Logger","author":"Telyatnikov","year":"2016"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/SECPRI.1996.502675"},{"key":"ref35","volume-title":"Foundations of Statistical Natural Language Processing","author":"Manning","year":"1999"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/1315245.1315261"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/HPCC-CSS-ICESS.2015.297"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1162\/neco.1997.9.8.1735"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.634"},{"issue":"1","key":"ref40","first-page":"1929","article-title":"Dropout: A simple way to prevent neural networks from overfitting","volume":"15","author":"Srivastava","year":"2014","journal-title":"J. Mach. Learn. Res."},{"key":"ref41","article-title":"Batch normalization: Accelerating deep network training by reducing internal covariate shift","author":"Ioffe","year":"2015","journal-title":"arXiv:1502.03167"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1145\/2939672.2939785"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-59119-2_166"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1145\/1390156.1390169"},{"key":"ref45","first-page":"61","article-title":"Probabilistic outputs for support vector machines and comparisons to regularized likelihood methods","volume-title":"Advances in Large Margin Classifiers","author":"Platt","year":"1999"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1111\/1467-9868.00338"},{"key":"ref47","volume-title":"PyTorch","year":"2018"},{"key":"ref48","volume-title":"Security Through Insecurity","year":"2018"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-45719-2_11"},{"key":"ref50","volume-title":"Powerful Desktop Automation Software","year":"2017"},{"key":"ref51","volume-title":"Pattern Recognition and Machine Learning","author":"Christopher","year":"2016"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref53","article-title":"Adversarial perturbations against deep neural networks for malware classification","author":"Grosse","year":"2016","journal-title":"arXiv:1606.04435"},{"key":"ref54","article-title":"Deceiving end-to-end deep learning malware detectors using adversarial examples","author":"Kreuk","year":"2018","journal-title":"arXiv:1802.04528"},{"key":"ref55","first-page":"1","article-title":"Black-box attacks against RNN based malware detection algorithms","volume-title":"Proc. Workshops 32nd AAAI Conf. Artif. Intell.","author":"Hu"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1145\/3326285.3329073"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLA.2019.00210"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2913439"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2019.00015"},{"key":"ref60","article-title":"Binary black-box evasion attacks against deep learning-based static malware detectors with adversarial byte-level language model","author":"Ebrahimi","year":"2020","journal-title":"arXiv:2012.07994"},{"key":"ref61","first-page":"2536","article-title":"Black-box adversarial attacks against deep learning based malware binaries detection with GAN","volume-title":"Proc. Eur. Conf. Artif. Intell.","author":"Yuan"},{"key":"ref62","article-title":"Adversarial examples on discrete sequences for beating whole-binary malware detection","author":"Kreuk","year":"2018","journal-title":"arXiv:1802.04528"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1093\/nsr\/nwx106"},{"issue":"12","key":"ref64","first-page":"3371","article-title":"Stacked denoising autoencoders: Learning useful representations in a deep network with a local denoising criterion","volume":"11","author":"Vincent","year":"2010","journal-title":"J. Mach. Learn. Res."},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1137\/1.9781611975673.67"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-59050-9_12"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-20893-6_39"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM.2018.00088"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2021.3086137"},{"key":"ref70","article-title":"Deep weakly-supervised anomaly detection","author":"Pang","year":"2019","journal-title":"arXiv:1910.13601"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1145\/3292500.3330871"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2007.45"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-70542-0_6"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2015.04.001"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-40667-1_21"},{"key":"ref76","volume-title":"Cuckoo Sandbox","author":"Guarnieri","year":"2017"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-74320-0_10"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-40667-1_6"},{"key":"ref79","volume-title":"Analyzing Unknown Binaries","year":"2010"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1145\/2076732.2076790"},{"key":"ref81","first-page":"1","article-title":"Efficient detection of split personalities in malware","volume-title":"Proc. Netw. Distrib. Syst. Secur. Symp.","author":"Balzarotti"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2011.41"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1109\/FSKD.2014.6980972"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1109\/WCNC.2013.6555301"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1145\/2020408.2020448"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1109\/GLOCOMW.2015.7414047"},{"issue":"4","key":"ref87","first-page":"2231","article-title":"K-means clustering approach to analyze NSL-KDD intrusion detection dataset","volume":"3","author":"Kumar","year":"2013","journal-title":"Int. J. Soft"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2016.01.002"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1145\/3091478.3091487"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2017.23353"},{"key":"ref91","first-page":"173","article-title":"Deep speech 2: End-to-end speech recognition in English and Mandarin","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Amodei"},{"key":"ref92","first-page":"3104","article-title":"Sequence to sequence learning with neural networks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Sutskever"},{"key":"ref93","article-title":"WaveNet: A generative model for raw audio","author":"van den Oord","year":"2016","journal-title":"arXiv:1609.03499"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1016\/j.neunet.2014.09.003"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.14257\/ijsia.2015.9.5.21"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2015.7178304"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2015.7280815"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.1109\/MALWARE.2015.7413680"},{"key":"ref99","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-40667-1_20"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2013.6638293"},{"key":"ref101","doi-asserted-by":"publisher","DOI":"10.1109\/SARNOF.2016.7846747"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.1109\/WIW.2016.040"},{"key":"ref103","first-page":"625","article-title":"Transcend: Detecting concept drift in malware classification models","volume-title":"Proc. 26th (USENIX) Secur. Symp.","author":"Jordaney"}],"container-title":["IEEE Transactions on Neural Networks and Learning Systems"],"original-title":[],"link":[{"URL":"https:\/\/ieeexplore.ieee.org\/ielam\/5962385\/9786556\/9596571-aam.pdf","content-type":"application\/pdf","content-version":"am","intended-application":"syndication"},{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/5962385\/9786556\/09596571.pdf?arnumber=9596571","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,4,4]],"date-time":"2025-04-04T16:17:31Z","timestamp":1743783451000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9596571\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,6]]},"references-count":103,"journal-issue":{"issue":"6"},"URL":"https:\/\/doi.org\/10.1109\/tnnls.2021.3121248","relation":{},"ISSN":["2162-237X","2162-2388"],"issn-type":[{"value":"2162-237X","type":"print"},{"value":"2162-2388","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,6]]}}}