{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,23]],"date-time":"2026-10-23T20:29:24Z","timestamp":1792787364142,"version":"4.5.0"},"reference-count":180,"publisher":"Association for Computing Machinery (ACM)","issue":"3","license":[{"start":{"date-parts":[[2017,6,29]],"date-time":"2017-06-29T00:00:00Z","timestamp":1498694400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"Scientific and Technological Support Project (Society) of Jiangsu","award":["BE2016776"],"award-info":[{"award-number":["BE2016776"]}]},{"DOI":"10.13039\/100000001","name":"U.S. National Science Foundation","doi-asserted-by":"publisher","award":["IIS-1213026, CNS-1461926 and CNS-1618629"],"award-info":[{"award-number":["IIS-1213026, CNS-1461926 and CNS-1618629"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Chinese NSF","award":["91646116"],"award-info":[{"award-number":["91646116"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Comput. Surv."],"published-print":{"date-parts":[[2018,5,31]]},"abstract":"<jats:p>\n                    In the Internet age, malware (such as viruses, trojans, ransomware, and bots) has posed serious and evolving security threats to Internet users. To protect legitimate users from these threats, anti-malware software products from different companies, including Comodo, Kaspersky, Kingsoft, and Symantec, provide the major defense against malware. Unfortunately, driven by the economic benefits, the number of new malware samples has explosively increased: anti-malware vendors are now confronted with millions of potential malware samples per year. In order to keep on combating the increase in malware samples, there is an urgent need to develop intelligent methods for effective and efficient malware detection from the real and large daily sample collection. In this article, we first provide a brief overview on malware as well as the anti-malware industry, and present the industrial needs on malware detection. We then survey intelligent malware detection methods. In these methods, the process of detection is usually divided into two stages:\n                    <jats:italic>feature extraction<\/jats:italic>\n                    and\n                    <jats:italic>classification\/clustering<\/jats:italic>\n                    . The performance of such intelligent malware detection approaches critically depend on the extracted features and the methods for classification\/clustering. We provide a comprehensive investigation on both the feature extraction and the classification\/clustering techniques. We also discuss the additional issues and the challenges of malware detection using data mining techniques and finally forecast the trends of malware development.\n                  <\/jats:p>","DOI":"10.1145\/3073559","type":"journal-article","created":{"date-parts":[[2017,6,30]],"date-time":"2017-06-30T08:36:19Z","timestamp":1498811779000},"page":"1-40","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":478,"title":["A Survey on Malware Detection Using Data Mining Techniques"],"prefix":"10.1145","volume":"50","author":[{"given":"Yanfang","family":"Ye","sequence":"first","affiliation":[{"name":"West Virginia University, Morgantown, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9277-1539","authenticated-orcid":false,"given":"Tao","family":"Li","sequence":"additional","affiliation":[{"name":"Florida International University 8 Nanjing University of Posts and Telecommunications, Nanjing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Donald","family":"Adjeroh","sequence":"additional","affiliation":[{"name":"West Virginia University, Morgantown, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"S. Sitharama","family":"Iyengar","sequence":"additional","affiliation":[{"name":"Florida International University, Miami, FL, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2017,6,29]]},"reference":[{"key":"e_1_2_1_1_1","volume-title":"Proceedings of the 28th Annual International Computer Software and Applications Conference (COMPSAC).","author":"Tony","year":"2004","unstructured":"Tony Abou-As saleh, Nick Cercone , Vlado Keselj , and Ray Sweidan . 2004 . N-gram-based detection of new malicious code . In Proceedings of the 28th Annual International Computer Software and Applications Conference (COMPSAC). Tony Abou-As saleh, Nick Cercone, Vlado Keselj, and Ray Sweidan. 2004. N-gram-based detection of new malicious code. In Proceedings of the 28th Annual International Computer Software and Applications Conference (COMPSAC)."},{"key":"e_1_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1023\/A:1022689900470"},{"key":"e_1_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11416-011-0152-x"},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/2381896.2381900"},{"key":"e_1_2_1_5_1","volume-title":"Anubis: Analyzing Unknown Binaries.","year":"2010","unstructured":"Anubis. 2010 . Anubis: Analyzing Unknown Binaries. Retrieved from http:\/\/anubis.iseclab.org\/. Anubis. 2010. Anubis: Analyzing Unknown Binaries. Retrieved from http:\/\/anubis.iseclab.org\/."},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.5555\/1776434.1776449"},{"key":"e_1_2_1_7_1","volume-title":"Proceedings of the 16th Annual Network and Distributed System Security Symposium.","author":"Bayer Ulrich","year":"2009","unstructured":"Ulrich Bayer , Paolo Milani Comparetti , Clemens Hlauschek , Christopher Kruegel , and Engin Kirda . 2009 . Scalable, behavior-based malware clustering . In Proceedings of the 16th Annual Network and Distributed System Security Symposium. Ulrich Bayer, Paolo Milani Comparetti, Clemens Hlauschek, Christopher Kruegel, and Engin Kirda. 2009. Scalable, behavior-based malware clustering. In Proceedings of the 16th Annual Network and Distributed System Security Symposium."},{"key":"e_1_2_1_8_1","unstructured":"Ulrich Bayer Christopher Kruegel and Engin Kirda. 2006a. TTAnalyze: A tool for analyzing malware. In EICAR.  Ulrich Bayer Christopher Kruegel and Engin Kirda. 2006a. TTAnalyze: A tool for analyzing malware. In EICAR."},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11416-006-0012-2"},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1109\/IKT.2013.6620049"},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11416-006-0029-6"},{"key":"e_1_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1561\/2200000006"},{"key":"e_1_2_1_13_1","volume-title":"Greedy layer-wise training of deep networks. Advances in Neural Information Processing Systems 19","author":"Bengio Yoshua","year":"2007","unstructured":"Yoshua Bengio , Pascal Lamblin , Dan Popovici , and Hugo Larochelle . 2007. Greedy layer-wise training of deep networks. Advances in Neural Information Processing Systems 19 ( 2007 ). Yoshua Bengio, Pascal Lamblin, Dan Popovici, and Hugo Larochelle. 2007. Greedy layer-wise training of deep networks. Advances in Neural Information Processing Systems 19 (2007)."},{"key":"e_1_2_1_14_1","volume-title":"Neural networks for pattern recognition","author":"Bishop Christopher M.","unstructured":"Christopher M. Bishop . 1995. Neural networks for pattern recognition . Oxford, Clarendon Press. Christopher M. Bishop. 1995. Neural networks for pattern recognition. Oxford, Clarendon Press."},{"key":"e_1_2_1_15_1","unstructured":"Bizjournals. 2011. McAfee: Trends in a decade of cybercrime. Retrieved from http:\/\/www.bizjournals.com\/sanjose\/news\/2011\/01\/25\/mcafee-trends-in-a-decade-of-cybercrime.html?page&equals;all.  Bizjournals. 2011. McAfee: Trends in a decade of cybercrime. Retrieved from http:\/\/www.bizjournals.com\/sanjose\/news\/2011\/01\/25\/mcafee-trends-in-a-decade-of-cybercrime.html?page&equals;all."},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1145\/1030083.1030100"},{"key":"e_1_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1023\/A:1018054314350"},{"key":"e_1_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1023\/A:1010933404324"},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/1315245.1315286"},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1137\/1.9781611972818.12"},{"key":"e_1_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-26190-4_28"},{"key":"e_1_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.5555\/1251353.1251365"},{"key":"e_1_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/1287624.1287628"},{"key":"e_1_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2005.20"},{"key":"e_1_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.5555\/3091622.3091637"},{"key":"e_1_2_1_26_1","unstructured":"Peter Coogan. 2010. SpyEye Bot Versus Zeus Bot. Retrieved from http:\/\/www.symantec.com\/connect\/blogs\/spyeye-bot-versus-zeus-bot.  Peter Coogan. 2010. SpyEye Bot Versus Zeus Bot. Retrieved from http:\/\/www.symantec.com\/connect\/blogs\/spyeye-bot-versus-zeus-bot."},{"key":"e_1_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIT.1967.1053964"},{"key":"e_1_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1145\/1102120.1102152"},{"key":"e_1_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1145\/1014052.1014066"},{"key":"e_1_2_1_30_1","unstructured":"Damballa. 2008. 3% to 5% of Enterprise Assets Are Compromised by Bot-Driven Targeted Attack Malware. Retrieved from http:\/\/www.prnewswire.com\/news-releases\/3-to-5-of-enterprise-assets-are-compromised-by-bot-driven-targeted-attack-malware-61634867.html.  Damballa. 2008. 3% to 5% of Enterprise Assets Are Compromised by Bot-Driven Targeted Attack Malware. Retrieved from http:\/\/www.prnewswire.com\/news-releases\/3-to-5-of-enterprise-assets-are-compromised-by-bot-driven-targeted-attack-malware-61634867.html."},{"key":"e_1_2_1_31_1","first-page":"10","article-title":"A survey on malware propagation, analysis, and detection","volume":"2","author":"Damshenas Mohsen","year":"2013","unstructured":"Mohsen Damshenas , Ali Dehghantanha , and Ramlan Mahmoud . 2013 . A survey on malware propagation, analysis, and detection . International Journal of Cyber-Security and Digital Forensics (IJCSDF) 2 , 4 (2013), 10 -- 29 . Mohsen Damshenas, Ali Dehghantanha, and Ramlan Mahmoud. 2013. A survey on malware propagation, analysis, and detection. International Journal of Cyber-Security and Digital Forensics (IJCSDF) 2, 4 (2013), 10--29.","journal-title":"International Journal of Cyber-Security and Digital Forensics (IJCSDF)"},{"key":"e_1_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2015.2491300"},{"key":"e_1_2_1_33_1","first-page":"97","article-title":"Machine learning research: Four current directions","volume":"18","author":"Dietterich Thomas","year":"1997","unstructured":"Thomas Dietterich . 1997 . Machine learning research: Four current directions . Artificial Intelligence Magzine 18 , 4 (1997), 97 -- 36 . Thomas Dietterich. 1997. Machine learning research: Four current directions. Artificial Intelligence Magzine 18, 4 (1997), 97--36.","journal-title":"Artificial Intelligence Magzine"},{"key":"e_1_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.5555\/648054.743935"},{"key":"e_1_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/1455770.1455779"},{"key":"e_1_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1023\/A:1007413511361"},{"key":"e_1_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1145\/2089125.2089126"},{"key":"e_1_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-74565-5_5"},{"key":"e_1_2_1_39_1","unstructured":"EMarketer. 2014. Global B2C Ecommerce Sales to Hit &dollar;1.5 Trillion This Year Driven by Growth in Emerging Markets. Retrieved from http:\/\/www.emarketer.com\/Article\/Global-B2C-Ecommerce-Sales-Hit-15-Trillion-This-Year-Driven-by-Growth-Emerging-Markets\/1010575.  EMarketer. 2014. Global B2C Ecommerce Sales to Hit &dollar;1.5 Trillion This Year Driven by Growth in Emerging Markets. Retrieved from http:\/\/www.emarketer.com\/Article\/Global-B2C-Ecommerce-Sales-Hit-15-Trillion-This-Year-Driven-by-Growth-Emerging-Markets\/1010575."},{"key":"e_1_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.5555\/2627435.2697065"},{"key":"e_1_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11416-006-0026-9"},{"key":"e_1_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACT.2010.33"},{"key":"e_1_2_1_43_1","first-page":"5","article-title":"Discriminatory analysis-nonparametric discrimination: Consistency properties. US Air Force, School of Avaiation Medicine","volume":"4","author":"Fix Evelyn","year":"1951","unstructured":"Evelyn Fix and Joseph L. Hodges Jr . 1951 . Discriminatory analysis-nonparametric discrimination: Consistency properties. US Air Force, School of Avaiation Medicine , Tech. Rep 4 (1951), 5 -- 32 . Evelyn Fix and Joseph L. Hodges Jr. 1951. Discriminatory analysis-nonparametric discrimination: Consistency properties. US Air Force, School of Avaiation Medicine, Tech. Rep 4 (1951), 5--32.","journal-title":"Tech. Rep"},{"key":"e_1_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2010.11"},{"key":"e_1_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1006\/jcss.1997.1504"},{"key":"e_1_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.4236\/jis.2014.52006"},{"key":"e_1_2_1_47_1","volume-title":"Kaspersky Security Bulletin","author":"Garnaeva Maria","year":"2014","unstructured":"Maria Garnaeva , Victor Chebyshev , Denis Makrushin , Roman Unuchek , and Anton Ivanov . 2014. Kaspersky Security Bulletin 2014 . Retrieved from http:\/\/securelist.com\/analysis\/kaspersky-security-bulletin\/68010\/kaspersky-security-bulletin-2014-overall-statistics-for-2014\/. Maria Garnaeva, Victor Chebyshev, Denis Makrushin, Roman Unuchek, and Anton Ivanov. 2014. Kaspersky Security Bulletin 2014. Retrieved from http:\/\/securelist.com\/analysis\/kaspersky-security-bulletin\/68010\/kaspersky-security-bulletin-2014-overall-statistics-for-2014\/."},{"key":"e_1_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1126\/science.286.5439.531"},{"key":"e_1_2_1_49_1","volume-title":"An introduction to variable and feature selection. Jouranl of Machine Learning Research 3 (March","author":"Guyon Isabelle","year":"2003","unstructured":"Isabelle Guyon and Andr Elisseeff . 2003. An introduction to variable and feature selection. Jouranl of Machine Learning Research 3 (March 2003 ), 1157--1182. Isabelle Guyon and Andr Elisseeff. 2003. An introduction to variable and feature selection. Jouranl of Machine Learning Research 3 (March 2003), 1157--1182."},{"key":"e_1_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1145\/1656274.1656278"},{"key":"e_1_2_1_51_1","volume-title":"Proceedings of the International Conference on Data Mining (DMIN).","author":"Hardy William","year":"2016","unstructured":"William Hardy , Lingwei Chen , Shifu Hou , Yanfang Ye , and Xin Li . 2016 . DL4MD: A deep learning framework for intelligent malware detection . In Proceedings of the International Conference on Data Mining (DMIN). William Hardy, Lingwei Chen, Shifu Hou, Yanfang Ye, and Xin Li. 2016. DL4MD: A deep learning framework for intelligent malware detection. In Proceedings of the International Conference on Data Mining (DMIN)."},{"key":"e_1_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM.2006.4"},{"key":"e_1_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM.2006.4"},{"key":"e_1_2_1_54_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-47121-1_5"},{"key":"e_1_2_1_56_1","volume-title":"Proceedings of the 3rd USENIX Windows NT Symposium.","author":"Hunt Galen","year":"1998","unstructured":"Galen Hunt and Doug Brubacher . 1998 . Detours: Binary interception of win32 functions . In Proceedings of the 3rd USENIX Windows NT Symposium. Galen Hunt and Doug Brubacher. 1998. Detours: Binary interception of win32 functions. In Proceedings of the 3rd USENIX Windows NT Symposium."},{"key":"e_1_2_1_57_1","unstructured":"IDAPro. 2016. The Interactive Disassembler. Retrieved from https:\/\/www.hex-rays.com\/products\/ida\/support\/download_freeware.shtml.  IDAPro. 2016. The Interactive Disassembler. Retrieved from https:\/\/www.hex-rays.com\/products\/ida\/support\/download_freeware.shtml."},{"key":"e_1_2_1_58_1","volume-title":"Mathur","author":"Idika Nwokedi","year":"2007","unstructured":"Nwokedi Idika and Aditya P . Mathur . 2007 . A survey of malware detection techniques. Research Report in Purdue University ( 2007). Nwokedi Idika and Aditya P. Mathur. 2007. A survey of malware detection techniques. Research Report in Purdue University (2007)."},{"key":"e_1_2_1_59_1","doi-asserted-by":"publisher","DOI":"10.1145\/276698.276876"},{"key":"e_1_2_1_60_1","unstructured":"Virtualization Technology Intel. 2013. Retrieved from http:\/\/www.intel.com\/technology\/virtualization.  Virtualization Technology Intel. 2013. Retrieved from http:\/\/www.intel.com\/technology\/virtualization."},{"key":"e_1_2_1_61_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2012.10.004"},{"key":"e_1_2_1_62_1","unstructured":"ITU. 2014. ITU releases 2014 ICT figures. Retrieved from https:\/\/www.itu.int\/net\/pressoffice\/press_releases\/2014\/23.aspx.  ITU. 2014. ITU releases 2014 ICT figures. Retrieved from https:\/\/www.itu.int\/net\/pressoffice\/press_releases\/2014\/23.aspx."},{"key":"e_1_2_1_63_1","doi-asserted-by":"publisher","DOI":"10.1109\/34.824819"},{"key":"e_1_2_1_64_1","doi-asserted-by":"publisher","DOI":"10.1007\/11663812_1"},{"key":"e_1_2_1_65_1","volume-title":"Making large-scale support vector machine learning practical. Advances in Kernel Methods: Support Vector Machines","author":"Joachims Thorsten","year":"1998","unstructured":"Thorsten Joachims . 1998. Making large-scale support vector machine learning practical. Advances in Kernel Methods: Support Vector Machines ( 1998 ). Thorsten Joachims. 1998. Making large-scale support vector machine learning practical. Advances in Kernel Methods: Support Vector Machines (1998)."},{"key":"e_1_2_1_66_1","volume-title":"Proceedings of the Conference on Uncertainty in Artificial Intelligence.","author":"George","unstructured":"George H. John and Pat Langley. 1995. Estimating continuous distributions in Bayesian classifiers . In Proceedings of the Conference on Uncertainty in Artificial Intelligence. George H. John and Pat Langley. 1995. Estimating continuous distributions in Bayesian classifiers. In Proceedings of the Conference on Uncertainty in Artificial Intelligence."},{"key":"e_1_2_1_67_1","doi-asserted-by":"publisher","DOI":"10.1145\/1314389.1314399"},{"key":"e_1_2_1_68_1","doi-asserted-by":"publisher","DOI":"10.1145\/1455770.1455774"},{"key":"e_1_2_1_69_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-37300-8_1"},{"key":"e_1_2_1_70_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11416-005-0002-9"},{"key":"e_1_2_1_71_1","unstructured":"Kaspersky. 2015. The Great Bank Robbery. Retrieved from http:\/\/www.kaspersky.com\/about\/news\/virus\/2015\/Carbanak-cybergang-steals-1-bn-USDfrom-100-financial-institutions-worldwide.  Kaspersky. 2015. The Great Bank Robbery. Retrieved from http:\/\/www.kaspersky.com\/about\/news\/virus\/2015\/Carbanak-cybergang-steals-1-bn-USDfrom-100-financial-institutions-worldwide."},{"key":"e_1_2_1_72_1","unstructured":"Kris Kendall and Chad McMillan. 2007. Practical Malware Analysis. Retrieved from https:\/\/www.blackhat.com\/presentations\/bh-dc-07\/Kendall_McMillan\/Presentation\/bh-dc-07-Kendall_McMillan.pdf.  Kris Kendall and Chad McMillan. 2007. Practical Malware Analysis. Retrieved from https:\/\/www.blackhat.com\/presentations\/bh-dc-07\/Kendall_McMillan\/Presentation\/bh-dc-07-Kendall_McMillan.pdf."},{"key":"e_1_2_1_73_1","unstructured":"Kingsoft. 2014. 2013-2014 Internet Security Report in China. Retrieved from http:\/\/www.ijinshan.com\/news\/2014011401.shtml.  Kingsoft. 2014. 2013-2014 Internet Security Report in China. Retrieved from http:\/\/www.ijinshan.com\/news\/2014011401.shtml."},{"key":"e_1_2_1_74_1","unstructured":"Kingsoft. 2015. 2014-2015 Internet Security Research Report in China. Retrieved from http:\/\/www.cssn.cn\/xwcbx\/xwcbx_gcsy\/201501\/P020150122566733317860.pdf.  Kingsoft. 2015. 2014-2015 Internet Security Research Report in China. Retrieved from http:\/\/www.cssn.cn\/xwcbx\/xwcbx_gcsy\/201501\/P020150122566733317860.pdf."},{"key":"e_1_2_1_75_1","unstructured":"Kingsoft. 2016. 2015-2016 Internet Security Research Report in China. Retrieved from http:\/\/cn.cmcm.com\/news\/media\/2016-01-14\/60.html.  Kingsoft. 2016. 2015-2016 Internet Security Research Report in China. Retrieved from http:\/\/cn.cmcm.com\/news\/media\/2016-01-14\/60.html."},{"key":"e_1_2_1_76_1","doi-asserted-by":"publisher","DOI":"10.5555\/1855768.1855790"},{"key":"e_1_2_1_77_1","doi-asserted-by":"publisher","DOI":"10.1145\/1014052.1014105"},{"key":"e_1_2_1_78_1","article-title":"Learning to detect and classify malicious executables in the wild","author":"Zico Kolter J.","year":"2006","unstructured":"J. Zico Kolter and Marcus A. Maloof . 2006 . Learning to detect and classify malicious executables in the wild . Journal of Machine Learning Research 7 ( Dec. 2006), 2721--2744. J. Zico Kolter and Marcus A. Maloof. 2006. Learning to detect and classify malicious executables in the wild. Journal of Machine Learning Research 7 (Dec. 2006), 2721--2744.","journal-title":"Journal of Machine Learning Research 7"},{"key":"e_1_2_1_79_1","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2002.1114861"},{"key":"e_1_2_1_80_1","doi-asserted-by":"publisher","DOI":"10.21236\/ADA292575"},{"key":"e_1_2_1_81_1","volume-title":"Proceedings of the 16th Annual Network and Distributed System Security Symposium (NDSS).","author":"Lanzi Andrea","year":"2009","unstructured":"Andrea Lanzi , Monirul Sharif , and Wenke Lee . 2009 . K-Tracer: A system for extracting kernel malware behavior . In Proceedings of the 16th Annual Network and Distributed System Security Symposium (NDSS). Andrea Lanzi, Monirul Sharif, and Wenke Lee. 2009. K-Tracer: A system for extracting kernel malware behavior. In Proceedings of the 16th Annual Network and Distributed System Security Symposium (NDSS)."},{"key":"e_1_2_1_82_1","volume-title":"Proceedings of the European Institute for Computer Antivirus Research Conference (EICAR).","author":"Lee Tony","unstructured":"Tony Lee and Jigar J. Mody . 2006. Behavioral classification . In Proceedings of the European Institute for Computer Antivirus Research Conference (EICAR). Tony Lee and Jigar J. Mody. 2006. Behavioral classification. In Proceedings of the European Institute for Computer Antivirus Research Conference (EICAR)."},{"key":"e_1_2_1_83_1","doi-asserted-by":"publisher","DOI":"10.5555\/188490.188495"},{"key":"e_1_2_1_84_1","doi-asserted-by":"publisher","DOI":"10.1186\/1471-2105-12-450"},{"key":"e_1_2_1_85_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICDMW.2014.112"},{"key":"e_1_2_1_86_1","doi-asserted-by":"publisher","DOI":"10.5555\/2994430"},{"key":"e_1_2_1_87_1","unstructured":"LordPE. 2013. PE Tools - LordPE. Retrieved from http:\/\/www.malware-analyzer.com\/pe-tools.  LordPE. 2013. PE Tools - LordPE. Retrieved from http:\/\/www.malware-analyzer.com\/pe-tools."},{"key":"e_1_2_1_88_1","volume-title":"Getting to know gdb. Linux Journal","author":"Loukides Mike","year":"1996","unstructured":"Mike Loukides and Andy Oram . 1996. Getting to know gdb. Linux Journal ( 1996 ). Mike Loukides and Andy Oram. 1996. Getting to know gdb. Linux Journal (1996)."},{"key":"e_1_2_1_89_1","volume-title":"Security threat trends","author":"Lyne James","year":"2015","unstructured":"James Lyne . 2014. Security threat trends 2015 . Retrieved from https:\/\/www.sophos.com\/threat-center\/medialibrary\/PDFs\/other\/sophos-trends-and-predictions-2015.pdf. James Lyne. 2014. Security threat trends 2015. Retrieved from https:\/\/www.sophos.com\/threat-center\/medialibrary\/PDFs\/other\/sophos-trends-and-predictions-2015.pdf."},{"key":"e_1_2_1_90_1","doi-asserted-by":"publisher","DOI":"10.1145\/2019618.2019622"},{"key":"e_1_2_1_91_1","volume-title":"Mining concept-drifting data stream to detect peer to peer botnet traffic. Tech. rep. UTDCS-05-08","author":"Masud Mohammad M.","year":"2008","unstructured":"Mohammad M. Masud , Jing Gao , Latifur Khan , Jiawei Han , and Bhavani Thuraisingham . 2008. Mining concept-drifting data stream to detect peer to peer botnet traffic. Tech. rep. UTDCS-05-08 , The University of Texas at Dallas, Richardson ( 2008 ). Mohammad M. Masud, Jing Gao, Latifur Khan, Jiawei Han, and Bhavani Thuraisingham. 2008. Mining concept-drifting data stream to detect peer to peer botnet traffic. Tech. rep. UTDCS-05-08, The University of Texas at Dallas, Richardson (2008)."},{"key":"e_1_2_1_92_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10796-007-9054-3"},{"key":"e_1_2_1_93_1","first-page":"422","article-title":"A survey on techniques in detection and analyzing malware executables","volume":"3","author":"Mathur Kirti","year":"2013","unstructured":"Kirti Mathur and Saroj Hiranwal . 2013 . A survey on techniques in detection and analyzing malware executables . International Journal of Advanced Research in Computer Science and Software Engineering 3 , 4 (2013), 422 -- 428 . Kirti Mathur and Saroj Hiranwal. 2013. A survey on techniques in detection and analyzing malware executables. International Journal of Advanced Research in Computer Science and Software Engineering 3, 4 (2013), 422--428.","journal-title":"International Journal of Advanced Research in Computer Science and Software Engineering"},{"key":"e_1_2_1_94_1","unstructured":"Micropoint. 2008. Micropoint Antivirus. Retrieved from http:\/\/www.micropoint.com.cn\/Channel\/\/20080626114608.html.  Micropoint. 2008. Micropoint Antivirus. Retrieved from http:\/\/www.micropoint.com.cn\/Channel\/\/20080626114608.html."},{"key":"e_1_2_1_95_1","doi-asserted-by":"publisher","DOI":"10.1145\/637201.637244"},{"key":"e_1_2_1_96_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2007.21"},{"key":"e_1_2_1_97_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-01393-5_12"},{"key":"e_1_2_1_98_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-89900-6_21"},{"key":"e_1_2_1_99_1","doi-asserted-by":"crossref","unstructured":"Robert Moskovitch Nir Nissim and Yuval Elovici. 2008b. Acquisition of malicious code using active learning. In PinKDD.  Robert Moskovitch Nir Nissim and Yuval Elovici. 2008b. Acquisition of malicious code using active learning. In PinKDD.","DOI":"10.1007\/978-3-642-01718-6_6"},{"key":"e_1_2_1_100_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-89900-6_21"},{"key":"e_1_2_1_101_1","volume-title":"Machine learning: A probabilistic perspective","author":"Murphy Kevin P.","unstructured":"Kevin P. Murphy . 2012. Machine learning: A probabilistic perspective . In The MIT Press , Cambridge, Massachusetts . Kevin P. Murphy. 2012. Machine learning: A probabilistic perspective. In The MIT Press, Cambridge, Massachusetts."},{"key":"e_1_2_1_102_1","doi-asserted-by":"publisher","DOI":"10.5555\/1622572.1622579"},{"key":"e_1_2_1_103_1","volume-title":"Proceedings of the Virus Bulletin Conference (VB).","author":"Nachenberg Carey","year":"2010","unstructured":"Carey Nachenberg and Vijay Seshadri . 2010 . An analysis of real-world effectiveness of reputation-based security . In Proceedings of the Virus Bulletin Conference (VB). Carey Nachenberg and Vijay Seshadri. 2010. An analysis of real-world effectiveness of reputation-based security. In Proceedings of the Virus Bulletin Conference (VB)."},{"key":"e_1_2_1_104_1","doi-asserted-by":"publisher","DOI":"10.1145\/1250734.1250746"},{"key":"e_1_2_1_105_1","doi-asserted-by":"publisher","DOI":"10.1145\/1015330.1015349"},{"key":"e_1_2_1_106_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.knosys.2016.09.004"},{"key":"e_1_2_1_107_1","volume-title":"Debugging blue screens. Technical Paper (September","author":"Corporation of Compuware. 1999.","year":"1999","unstructured":"Corporation of Compuware. 1999. Debugging blue screens. Technical Paper (September 1999 ). Corporation of Compuware. 1999. Debugging blue screens. Technical Paper (September 1999)."},{"key":"e_1_2_1_108_1","unstructured":"Gunter Ollmann. 2010. Serial variant evasion tactics techniques used to automatically bypass antivirus technologies. Retrieved from http:\/\/www.damballa.com\/downloads\/rpubs\/WPSerialVariantEvasionTactics.pdf.  Gunter Ollmann. 2010. Serial variant evasion tactics techniques used to automatically bypass antivirus technologies. Retrieved from http:\/\/www.damballa.com\/downloads\/rpubs\/WPSerialVariantEvasionTactics.pdf."},{"key":"e_1_2_1_109_1","unstructured":"OllyDump. 2006. PE Tools - OllyDump. Retrieved from http:\/\/www.openrce.org\/downloads\/details\/108\/OllyDump.  OllyDump. 2006. PE Tools - OllyDump. Retrieved from http:\/\/www.openrce.org\/downloads\/details\/108\/OllyDump."},{"key":"e_1_2_1_110_1","unstructured":"David Orenstein. 2000. Application programming interface (API). In Quick Study: Application Programming Interface (API).  David Orenstein. 2000. Application programming interface (API). In Quick Study: Application Programming Interface (API)."},{"key":"e_1_2_1_111_1","doi-asserted-by":"publisher","DOI":"10.1145\/502512.502565"},{"key":"e_1_2_1_112_1","doi-asserted-by":"publisher","DOI":"10.1016\/0004-3702(87)90012-9"},{"key":"e_1_2_1_113_1","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2005.159"},{"key":"e_1_2_1_114_1","volume-title":"Grafting: Fast incremental feature selection by gradient descent in function space. JMLR 3 (March","author":"Perkins Simon","year":"2003","unstructured":"Simon Perkins , Kevin Lacker , and James Theiler . 2003 . Grafting: Fast incremental feature selection by gradient descent in function space. JMLR 3 (March 2003), 1333--1356. Simon Perkins, Kevin Lacker, and James Theiler. 2003. Grafting: Fast incremental feature selection by gradient descent in function space. JMLR 3 (March 2003), 1333--1356."},{"key":"e_1_2_1_115_1","unstructured":"Qemu. 2016. (2016). http:\/\/www.qemu-project.org\/index.html.  Qemu. 2016. (2016). http:\/\/www.qemu-project.org\/index.html."},{"key":"e_1_2_1_116_1","unstructured":"Internet Security Center Qihoo. 2015. 2014 Internet Security Research Report in China. Retrieved from http:\/\/zt.360.cn\/report\/.  Internet Security Center Qihoo. 2015. 2014 Internet Security Research Report in China. Retrieved from http:\/\/zt.360.cn\/report\/."},{"key":"e_1_2_1_117_1","doi-asserted-by":"publisher","DOI":"10.1023\/A:1022643204877"},{"key":"e_1_2_1_118_1","doi-asserted-by":"publisher","DOI":"10.5555\/152181"},{"key":"e_1_2_1_119_1","volume-title":"Variable selection using SVM-based criteria. JMLR 3 (March","author":"Rakotomamonjy Alain","year":"2003","unstructured":"Alain Rakotomamonjy . 2003. Variable selection using SVM-based criteria. JMLR 3 (March 2003 ), 1357--1370. Alain Rakotomamonjy. 2003. Variable selection using SVM-based criteria. JMLR 3 (March 2003), 1357--1370."},{"key":"e_1_2_1_120_1","unstructured":"Zulfikar Ramzan Vijay Seshadri and Carey Nachenberg. 2013. Reputation-based security: An analysis of real world effectiveness. In Symantec Security Response.  Zulfikar Ramzan Vijay Seshadri and Carey Nachenberg. 2013. Reputation-based security: An analysis of real world effectiveness. In Symantec Security Response."},{"key":"e_1_2_1_121_1","first-page":"69","article-title":"Malware threats and mitigation strategies: A Survey","volume":"29","author":"Rehmani Rizwan","year":"2011","unstructured":"Rizwan Rehmani , G. C. Hazarika , and Gunadeep Chetia . 2011 . Malware threats and mitigation strategies: A Survey . Journal of Theoretical and Applied Information Technology 29 , 2 (2011), 69 -- 73 . Rizwan Rehmani, G. C. Hazarika, and Gunadeep Chetia. 2011. Malware threats and mitigation strategies: A Survey. Journal of Theoretical and Applied Information Technology 29, 2 (2011), 69--73.","journal-title":"Journal of Theoretical and Applied Information Technology"},{"key":"e_1_2_1_122_1","volume-title":"Debugging windows based applications using windbg. Microsoft Systems Journal","author":"Robbins John","year":"1999","unstructured":"John Robbins . 1999. Debugging windows based applications using windbg. Microsoft Systems Journal ( 1999 ). John Robbins. 1999. Debugging windows based applications using windbg. Microsoft Systems Journal (1999)."},{"key":"e_1_2_1_123_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10462-009-9124-7"},{"key":"e_1_2_1_124_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2006.38"},{"key":"e_1_2_1_125_1","doi-asserted-by":"publisher","DOI":"10.1093\/bioinformatics\/btm344"},{"key":"e_1_2_1_126_1","doi-asserted-by":"publisher","DOI":"10.1145\/361219.361220"},{"key":"e_1_2_1_127_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-33018-6_28"},{"key":"e_1_2_1_128_1","volume-title":"Proceedings of the International Conference on Security and Cryptography.","author":"Santos Igor","unstructured":"Igor Santos , Carlos Laorden , and Pablo G. Bringas . 2011a. Collective classification for unknown malware detection . In Proceedings of the International Conference on Security and Cryptography. Igor Santos, Carlos Laorden, and Pablo G. Bringas. 2011a. Collective classification for unknown malware detection. In Proceedings of the International Conference on Security and Cryptography."},{"key":"e_1_2_1_129_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-19934-9_53"},{"key":"e_1_2_1_130_1","doi-asserted-by":"publisher","DOI":"10.1109\/MALWARE.2015.7413680"},{"key":"e_1_2_1_131_1","doi-asserted-by":"publisher","DOI":"10.5555\/882495.884439"},{"key":"e_1_2_1_132_1","doi-asserted-by":"publisher","DOI":"10.1145\/505282.505283"},{"key":"e_1_2_1_133_1","doi-asserted-by":"publisher","DOI":"10.1145\/130385.130417"},{"key":"e_1_2_1_135_1","doi-asserted-by":"publisher","DOI":"10.1145\/1593105.1593239"},{"key":"e_1_2_1_136_1","first-page":"48","article-title":"Detecting internet worms using data mining techniques","volume":"6","author":"Siddiqui Muazzam","year":"2009","unstructured":"Muazzam Siddiqui , Morgan C. Wang , and Joohan Lee . 2009 . Detecting internet worms using data mining techniques . Journal of Systemics, Cybernetics and Informatics 6 , 6 (2009), 48 -- 53 . Muazzam Siddiqui, Morgan C. Wang, and Joohan Lee. 2009. Detecting internet worms using data mining techniques. Journal of Systemics, Cybernetics and Informatics 6, 6 (2009), 48--53.","journal-title":"Journal of Systemics, Cybernetics and Informatics"},{"key":"e_1_2_1_137_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-89862-7_1"},{"key":"e_1_2_1_138_1","doi-asserted-by":"publisher","DOI":"10.5555\/645382.651657"},{"key":"e_1_2_1_139_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-73614-1_6"},{"key":"e_1_2_1_140_1","volume-title":"Scalable telemetry classification for automated malware detection. Computer Security - ESORICS","author":"Stokes Jack W.","year":"2012","unstructured":"Jack W. Stokes , John C. Platt , Helen J. Wang , Joe Faulhaber , Jonathan Keller , Mady Marinescu , Anil Thomas , and Marius Gheorghescu . 2012. Scalable telemetry classification for automated malware detection. Computer Security - ESORICS ( 2012 ). Jack W. Stokes, John C. Platt, Helen J. Wang, Joe Faulhaber, Jonathan Keller, Mady Marinescu, Anil Thomas, and Marius Gheorghescu. 2012. Scalable telemetry classification for automated malware detection. Computer Security - ESORICS (2012)."},{"key":"e_1_2_1_141_1","doi-asserted-by":"publisher","DOI":"10.1109\/CSAC.2004.37"},{"key":"e_1_2_1_142_1","unstructured":"Symantec. 2008. Symantec global internet security threat report. Retrieved from http:\/\/eval.symantec.com\/mktginfo\/enterprise\/white_papers\/b-whitepaper_internet_security_threat_report_xiii_04-2008.en-us.pdf.  Symantec. 2008. Symantec global internet security threat report. Retrieved from http:\/\/eval.symantec.com\/mktginfo\/enterprise\/white_papers\/b-whitepaper_internet_security_threat_report_xiii_04-2008.en-us.pdf."},{"key":"e_1_2_1_143_1","volume-title":"Threat Report","year":"2014","unstructured":"Symantec. 2014a. Internet Security Threat Report 2014 . Retrieved from http:\/\/www.symantec.com\/security_response\/publications\/threatreport.jsp. Symantec. 2014a. Internet Security Threat Report 2014. Retrieved from http:\/\/www.symantec.com\/security_response\/publications\/threatreport.jsp."},{"key":"e_1_2_1_144_1","volume-title":"The Threat Landscape in 2014 and Beyond: Symantec and Norton Predictions for","year":"2015","unstructured":"Symantec. 2014b. The Threat Landscape in 2014 and Beyond: Symantec and Norton Predictions for 2015 , Asia Pacific and Japan. Retrieved from http:\/\/www.symantec.com\/connect\/blogs\/threat-landscape-2014-and-beyond-symantec-and-norton-predictions-2015-asia-pacific-japan. Symantec. 2014b. The Threat Landscape in 2014 and Beyond: Symantec and Norton Predictions for 2015, Asia Pacific and Japan. Retrieved from http:\/\/www.symantec.com\/connect\/blogs\/threat-landscape-2014-and-beyond-symantec-and-norton-predictions-2015-asia-pacific-japan."},{"key":"e_1_2_1_145_1","unstructured":"Symantec. 2016. Internet Security Threat Report. Retrieved from https:\/\/www.symantec.com\/content\/dam\/symantec\/docs\/reports\/istr-21-2016-en.pdf.  Symantec. 2016. Internet Security Threat Report. Retrieved from https:\/\/www.symantec.com\/content\/dam\/symantec\/docs\/reports\/istr-21-2016-en.pdf."},{"key":"e_1_2_1_146_1","doi-asserted-by":"publisher","DOI":"10.1145\/3017427"},{"key":"e_1_2_1_147_1","doi-asserted-by":"publisher","DOI":"10.1145\/2623330.2623342"},{"key":"e_1_2_1_148_1","doi-asserted-by":"publisher","DOI":"10.1017\/S0269888907001026"},{"key":"e_1_2_1_149_1","volume-title":"Proceedings of 5th International Conference on Malicious and Unwanted Software (Malware).","author":"Tian Ronghua","year":"2010","unstructured":"Ronghua Tian , Rafiqul Islam , Lynn Batten , and Steve Versteeg . 2010 . Differentiating malware from cleanwares using behavioral analysis . In Proceedings of 5th International Conference on Malicious and Unwanted Software (Malware). Ronghua Tian, Rafiqul Islam, Lynn Batten, and Steve Versteeg. 2010. Differentiating malware from cleanwares using behavioral analysis. In Proceedings of 5th International Conference on Malicious and Unwanted Software (Malware)."},{"key":"e_1_2_1_150_1","unstructured":"TrendLabs. 2014. The invisible becomes visible: Trend micro security predictions for 2015 and beyond. (2014). http:\/\/www.trendmicro.com\/cloud-content\/us\/pdfs\/security-intelligence\/reports\/rpt-the-invisible-becomes-visible.pdf.  TrendLabs. 2014. The invisible becomes visible: Trend micro security predictions for 2015 and beyond. (2014). http:\/\/www.trendmicro.com\/cloud-content\/us\/pdfs\/security-intelligence\/reports\/rpt-the-invisible-becomes-visible.pdf."},{"key":"e_1_2_1_151_1","volume-title":"Zeus: A Persistent Criminal Enterprise.","author":"Research Team TrendMicro Trend Threat","year":"2010","unstructured":"Trend Threat Research Team TrendMicro . 2010 . Zeus: A Persistent Criminal Enterprise. Retrieved from http:\/\/www.trendmicro.com\/cloud-content\/us\/pdfs\/security-intelligence\/white-papers\/wp_zeuspersistent-criminal-enterprise.pdf. Trend Threat Research Team TrendMicro. 2010. Zeus: A Persistent Criminal Enterprise. Retrieved from http:\/\/www.trendmicro.com\/cloud-content\/us\/pdfs\/security-intelligence\/white-papers\/wp_zeuspersistent-criminal-enterprise.pdf."},{"key":"e_1_2_1_152_1","doi-asserted-by":"publisher","DOI":"10.1109\/CSAC.2005.52"},{"key":"e_1_2_1_153_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2006.9"},{"key":"e_1_2_1_154_1","unstructured":"Shobha Venkataraman Avrim Blum and Dawn Song. 2008. Limits of learning-based signature generation with adversaries. In NDSS.  Shobha Venkataraman Avrim Blum and Dawn Song. 2008. Limits of learning-based signature generation with adversaries. In NDSS."},{"key":"e_1_2_1_155_1","doi-asserted-by":"publisher","DOI":"10.1145\/2487788.2488136"},{"key":"e_1_2_1_156_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLA.2013.162"},{"key":"e_1_2_1_157_1","volume-title":"A surveillance spyware detection system based on data mining methods. Evolutionary Computation","author":"Wang Tzu-Yen","year":"2006","unstructured":"Tzu-Yen Wang , Shi-Jinn Horng , Ming-Yang Su , Chin-Hsiung Wu , Peng-Chu Wang , and Wei-Zen Su. 2006b. A surveillance spyware detection system based on data mining methods. Evolutionary Computation ( 2006 ), 3236--3241. Tzu-Yen Wang, Shi-Jinn Horng, Ming-Yang Su, Chin-Hsiung Wu, Peng-Chu Wang, and Wei-Zen Su. 2006b. A surveillance spyware detection system based on data mining methods. Evolutionary Computation (2006), 3236--3241."},{"key":"e_1_2_1_158_1","unstructured":"Yi-Min Wang Doug Beck Xuxian Jiang and Roussi Roussev. 2006a. Automated web patrol with strider honeymonkeys: Finding web sites that exploit browser vulnerabilities. In NDSS.  Yi-Min Wang Doug Beck Xuxian Jiang and Roussi Roussev. 2006a. Automated web patrol with strider honeymonkeys: Finding web sites that exploit browser vulnerabilities. In NDSS."},{"key":"e_1_2_1_159_1","unstructured":"SECURITY LABS WEBSENSE. 2014. 2015 Security Predictions. Retrieved from http:\/\/www.websense.com\/assets\/reports\/report-2015-security-predictions-en.pdf.  SECURITY LABS WEBSENSE. 2014. 2015 Security Predictions. Retrieved from http:\/\/www.websense.com\/assets\/reports\/report-2015-security-predictions-en.pdf."},{"key":"e_1_2_1_161_1","unstructured":"Wikipedia. 2016. Scareware. Retrieved from https:\/\/en.wikipedia.org\/wiki\/Scareware.  Wikipedia. 2016. Scareware. Retrieved from https:\/\/en.wikipedia.org\/wiki\/Scareware."},{"key":"e_1_2_1_162_1","unstructured":"Wikipedia. 2017a. Assembly Language. Retrieved from http:\/\/en.wikipedia.org\/wiki\/Assembly_language.  Wikipedia. 2017a. Assembly Language. Retrieved from http:\/\/en.wikipedia.org\/wiki\/Assembly_language."},{"key":"e_1_2_1_163_1","unstructured":"Wikipedia. 2017b. Computer Virus. Retrieved from http:\/\/en.wikipedia.org\/wiki\/Computer_virus.  Wikipedia. 2017b. Computer Virus. Retrieved from http:\/\/en.wikipedia.org\/wiki\/Computer_virus."},{"key":"e_1_2_1_164_1","unstructured":"Wikipedia. 2017c. Morris Worm. Retrieved from http:\/\/en.wikipedia.org\/wiki\/Morris_worm.  Wikipedia. 2017c. Morris Worm. Retrieved from http:\/\/en.wikipedia.org\/wiki\/Morris_worm."},{"key":"e_1_2_1_165_1","unstructured":"Wikipedia. 2017d. Ransomware. Retrieved from https:\/\/en.wikipedia.org\/wiki\/Ransomware.  Wikipedia. 2017d. Ransomware. Retrieved from https:\/\/en.wikipedia.org\/wiki\/Ransomware."},{"key":"e_1_2_1_166_1","unstructured":"Wikipedia. 2017e. Rootkit. Retrieved from http:\/\/en.wikipedia.org\/wiki\/Rootkit.  Wikipedia. 2017e. Rootkit. Retrieved from http:\/\/en.wikipedia.org\/wiki\/Rootkit."},{"key":"e_1_2_1_167_1","unstructured":"Wikipedia. 2017f. Zero-day (computing). Retrieved from https:\/\/en.wikipedia.org\/wiki\/Zero-day_(computing).  Wikipedia. 2017f. Zero-day (computing). Retrieved from https:\/\/en.wikipedia.org\/wiki\/Zero-day_(computing)."},{"key":"e_1_2_1_168_1","unstructured":"Wikipedia. 2017g. Zeus (malware). Retrieved from http:\/\/en.wikipedia.org\/wiki\/Zeus_(malware).  Wikipedia. 2017g. Zeus (malware). Retrieved from http:\/\/en.wikipedia.org\/wiki\/Zeus_(malware)."},{"key":"e_1_2_1_169_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2007.45"},{"key":"e_1_2_1_170_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNN.2005.845141"},{"key":"e_1_2_1_172_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11416-008-0108-y"},{"key":"e_1_2_1_173_1","doi-asserted-by":"publisher","DOI":"10.1145\/1835804.1835820"},{"key":"e_1_2_1_174_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10844-009-0086-7"},{"key":"e_1_2_1_175_1","doi-asserted-by":"publisher","DOI":"10.1145\/1557019.1557167"},{"key":"e_1_2_1_176_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSMCC.2009.2037978"},{"key":"e_1_2_1_177_1","doi-asserted-by":"publisher","DOI":"10.1145\/2020408.2020448"},{"key":"e_1_2_1_178_1","doi-asserted-by":"publisher","DOI":"10.1145\/1281192.1281308"},{"key":"e_1_2_1_179_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11416-008-0082-4"},{"key":"e_1_2_1_180_1","unstructured":"Jonathan S. Yedidia William T. Freeman and Yair Weiss. 2001. Understanding belief propagation and its generalizations. In Mitsubishi Electric Research Laboratories.  Jonathan S. Yedidia William T. Freeman and Yair Weiss. 2001. Understanding belief propagation and its generalizations. In Mitsubishi Electric Research Laboratories."},{"key":"e_1_2_1_181_1","doi-asserted-by":"publisher","DOI":"10.1145\/1315245.1315261"},{"key":"e_1_2_1_182_1","volume-title":"An integrated framework for mining temporal logs from fluctuating events","author":"Zeng Chunqiu","year":"2017","unstructured":"Chunqiu Zeng , Liang Tang , Wubai Zhou , Tao Li , Larisa Shwartz , and Genady Ya .Grabarnik. 2017. An integrated framework for mining temporal logs from fluctuating events . IEEE Transactions on Services Computing (TSC) ( 2017 ). In Press . Chunqiu Zeng, Liang Tang, Wubai Zhou, Tao Li, Larisa Shwartz, and Genady Ya.Grabarnik. 2017. An integrated framework for mining temporal logs from fluctuating events. IEEE Transactions on Services Computing (TSC) (2017). In Press."},{"key":"e_1_2_1_183_1","volume-title":"Malicious codes detection based on ensemble learning. Autonomic and Trusted Computing","author":"Zhang Boyun","year":"2007","unstructured":"Boyun Zhang , Jianping Yin , Jingbo Hao , Dingxing Zhang , and Shulin Wang . 2007. Malicious codes detection based on ensemble learning. Autonomic and Trusted Computing ( 2007 ). Boyun Zhang, Jianping Yin, Jingbo Hao, Dingxing Zhang, and Shulin Wang. 2007. Malicious codes detection based on ensemble learning. Autonomic and Trusted Computing (2007)."},{"key":"e_1_2_1_184_1","volume-title":"Proceedings of the 7th Workshop on Economics of Information Security.","author":"Zhuge Jianwei","year":"2008","unstructured":"Jianwei Zhuge , Thorsten Holz , Chengyu Song , Jinpeng Guo , Xinhui Han , and Wei Zou . 2008 . Studying malicious websites and the underground economy on the Chinese web . In Proceedings of the 7th Workshop on Economics of Information Security. Jianwei Zhuge, Thorsten Holz, Chengyu Song, Jinpeng Guo, Xinhui Han, and Wei Zou. 2008. Studying malicious websites and the underground economy on the Chinese web. In Proceedings of the 7th Workshop on Economics of Information Security."}],"container-title":["ACM Computing Surveys"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3073559","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3073559","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3073559","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T15:04:50Z","timestamp":1750259090000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3073559"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2017,6,29]]},"references-count":180,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2018,5,31]]}},"alternative-id":["10.1145\/3073559"],"URL":"https:\/\/doi.org\/10.1145\/3073559","relation":{},"ISSN":["0360-0300","1557-7341"],"issn-type":[{"value":"0360-0300","type":"print"},{"value":"1557-7341","type":"electronic"}],"subject":[],"published":{"date-parts":[[2017,6,29]]},"assertion":[{"value":"2015-08-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2017-03-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2017-06-29","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}