{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,8]],"date-time":"2026-05-08T16:10:25Z","timestamp":1778256625333,"version":"3.51.4"},"publisher-location":"New York, NY, USA","reference-count":19,"publisher":"ACM","license":[{"start":{"date-parts":[[2021,4,23]],"date-time":"2021-04-23T00:00:00Z","timestamp":1619136000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2021,4,23]]},"DOI":"10.1145\/3468891.3468893","type":"proceedings-article","created":{"date-parts":[[2021,9,6]],"date-time":"2021-09-06T17:42:54Z","timestamp":1630950174000},"page":"7-11","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":1,"title":["Hunting Malicious Windows Commands with Multi Machine Learning Technologies"],"prefix":"10.1145","author":[{"given":"Yi-Chung","family":"Tseng","sequence":"first","affiliation":[{"name":"Acer Cyber Security Incorporation, Taiwan"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Wei-An","family":"Chen","sequence":"additional","affiliation":[{"name":"Acer Cyber Security Incorporation, Taiwan"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2021,9,6]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"Security Information and Event Management. https:\/\/www.imperva.com\/learn\/application-security\/siem\/  Security Information and Event Management. https:\/\/www.imperva.com\/learn\/application-security\/siem\/"},{"key":"e_1_3_2_1_2_1","unstructured":"R. Silipo. 2019. Index-based Encoding. https:\/\/customerthink.com\/text-encoding-a-review\/  R. Silipo. 2019. Index-based Encoding. https:\/\/customerthink.com\/text-encoding-a-review\/"},{"key":"e_1_3_2_1_3_1","unstructured":"Microsoft. 2020. Sysmon. https:\/\/docs.microsoft.com\/en-us\/sysinternals\/downloads\/sysmon  Microsoft. 2020. Sysmon. https:\/\/docs.microsoft.com\/en-us\/sysinternals\/downloads\/sysmon"},{"key":"e_1_3_2_1_4_1","unstructured":"Elizabeth D. Liddy. 2001. Natural Language Processing. http:\/\/surface.syr.edu\/cgi\/viewcontent.cgi?article=1019&context=cnlp  Elizabeth D. Liddy. 2001. Natural Language Processing. http:\/\/surface.syr.edu\/cgi\/viewcontent.cgi?article=1019&context=cnlp"},{"key":"e_1_3_2_1_5_1","unstructured":"S. Fewer. 2008. Reflective dll injection. Harmony Security Version vol 1. https:\/\/www.exploit-db.com\/docs\/english\/13007-reflective-dll-injection.pdf  S. Fewer. 2008. Reflective dll injection. Harmony Security Version vol 1. https:\/\/www.exploit-db.com\/docs\/english\/13007-reflective-dll-injection.pdf"},{"key":"e_1_3_2_1_6_1","unstructured":"A. Hosseini. 2017. Ten Process Injection Techniques: A technical Survey of Common and Trending Process Injection techniques. https:\/\/www.elastic.co\/blog\/ten-process-injection-techniques-technical-survey-common-and-trending-process  A. Hosseini. 2017. Ten Process Injection Techniques: A technical Survey of Common and Trending Process Injection techniques. https:\/\/www.elastic.co\/blog\/ten-process-injection-techniques-technical-survey-common-and-trending-process"},{"key":"e_1_3_2_1_7_1","unstructured":"Blackhat. 2015. Defending Against Malicious Application Compatibility Shims. https:\/\/www.blackhat.com\/docs\/eu- 15\/materials\/eu- 15- Pierce- Defending- Against- Malicious- Application- Compatibility- Shims- wp.pdf  Blackhat. 2015. Defending Against Malicious Application Compatibility Shims. https:\/\/www.blackhat.com\/docs\/eu- 15\/materials\/eu- 15- Pierce- Defending- Against- Malicious- Application- Compatibility- Shims- wp.pdf"},{"key":"e_1_3_2_1_8_1","unstructured":"MITRE. 2019. Process Hollowing. https:\/\/attack.mitre.org\/techniques\/T1093\/  MITRE. 2019. Process Hollowing. https:\/\/attack.mitre.org\/techniques\/T1093\/"},{"key":"e_1_3_2_1_9_1","unstructured":"Microsoft. 2019. Microsoft Internet Explorer CVE-2019-0514 Remote Code Execution Vulnerability. https:\/\/www.symantec.com\/security- center\/vulnerabilities\/writeup\/106402  Microsoft. 2019. Microsoft Internet Explorer CVE-2019-0514 Remote Code Execution Vulnerability. https:\/\/www.symantec.com\/security- center\/vulnerabilities\/writeup\/106402"},{"key":"e_1_3_2_1_10_1","unstructured":"P. Arntz. 2016. Memory Scan. https:\/\/blog.malwarebytes.com\/cybercrime\/2014\/03\/memory-scan\/  P. Arntz. 2016. Memory Scan. https:\/\/blog.malwarebytes.com\/cybercrime\/2014\/03\/memory-scan\/"},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24167"},{"key":"e_1_3_2_1_12_1","volume-title":"Proc. of the Symposium on Network and Distributed System Security (NDSS). https:\/\/sites.cs.ucsb.edu\/\u223cchris\/research\/doc\/ndss11_exposure.pdf","author":"Bilge E.","unstructured":"L. Bilge , E. Kirda , C. Kruegel and M. Balduzzi . 2011. EXPOSURE: Finding malicious domains using passive DNS analysis . in Proc. of the Symposium on Network and Distributed System Security (NDSS). https:\/\/sites.cs.ucsb.edu\/\u223cchris\/research\/doc\/ndss11_exposure.pdf L. Bilge, E. Kirda, C. Kruegel and M. Balduzzi. 2011. EXPOSURE: Finding malicious domains using passive DNS analysis. in Proc. of the Symposium on Network and Distributed System Security (NDSS). https:\/\/sites.cs.ucsb.edu\/\u223cchris\/research\/doc\/ndss11_exposure.pdf"},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"crossref","unstructured":"C. D. Xuan H. D. Nguyen and T. V. Nikolaevic. 2020. Malicious URL Detection based on Machine Learning. https:\/\/thesai.org\/Downloads\/Volume11No1\/Paper_19-Malicious_URL_Detection_based_on_Machine_Learning.pdf  C. D. Xuan H. D. Nguyen and T. V. Nikolaevic. 2020. Malicious URL Detection based on Machine Learning. https:\/\/thesai.org\/Downloads\/Volume11No1\/Paper_19-Malicious_URL_Detection_based_on_Machine_Learning.pdf","DOI":"10.14569\/IJACSA.2020.0110119"},{"issue":"1","key":"e_1_3_2_1_14_1","first-page":"148","article-title":"Session-Based Web shell Detection Using Machine Learning in Web Logs","volume":"11","author":"Wu Y","year":"2019","unstructured":"Wu Y , Sun Y , Huang C , Jia P , Liu L. 2019 . Session-Based Web shell Detection Using Machine Learning in Web Logs . International Journal of Advanced Computer Science and Applications , vol. 11 , no. 1 , pp. 148 - 153 Wu Y, Sun Y, Huang C, Jia P, Liu L. 2019. Session-Based Web shell Detection Using Machine Learning in Web Logs. International Journal of Advanced Computer Science and Applications, vol. 11, no. 1, pp. 148-153","journal-title":"International Journal of Advanced Computer Science and Applications"},{"key":"e_1_3_2_1_15_1","volume-title":"Proceedings of the 2008 International Conference on Data Mining, DMIN.","author":"Koufakou M.","year":"2008","unstructured":"A. Koufakou , M. Georgiopoulos , G. Anagnostopoulos . 2008 . Detecting Outliers in High-Dimensional Datasets with Mixed Attributes . Proceedings of the 2008 International Conference on Data Mining, DMIN. A. Koufakou, M. Georgiopoulos, G. Anagnostopoulos. 2008. Detecting Outliers in High-Dimensional Datasets with Mixed Attributes. Proceedings of the 2008 International Conference on Data Mining, DMIN."},{"key":"e_1_3_2_1_16_1","unstructured":"Elizabeth D. Liddy. 2001. Natural Language Processing. http:\/\/surface.syr.edu\/cgi\/viewcontent.cgi?article=1019&context=cnlp  Elizabeth D. Liddy. 2001. Natural Language Processing. http:\/\/surface.syr.edu\/cgi\/viewcontent.cgi?article=1019&context=cnlp"},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1016\/S0306-4573(02)00021-3"},{"key":"e_1_3_2_1_18_1","unstructured":"Gensim https:\/\/pypi.org\/project\/gensim\/  Gensim https:\/\/pypi.org\/project\/gensim\/"},{"key":"e_1_3_2_1_19_1","unstructured":"SwiftOnSecurity. 2020. Benign Profile. https:\/\/github.com\/SwiftOnSecurity\/sysmon-config\/blob\/master\/sysmonconfig-export.xml  SwiftOnSecurity. 2020. Benign Profile. https:\/\/github.com\/SwiftOnSecurity\/sysmon-config\/blob\/master\/sysmonconfig-export.xml"}],"event":{"name":"ICMLT 2021: 2021 6th International Conference on Machine Learning Technologies","location":"Jeju Island Republic of Korea","acronym":"ICMLT 2021"},"container-title":["2021 6th International Conference on Machine Learning Technologies"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3468891.3468893","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3468891.3468893","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T20:17:22Z","timestamp":1750191442000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3468891.3468893"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,4,23]]},"references-count":19,"alternative-id":["10.1145\/3468891.3468893","10.1145\/3468891"],"URL":"https:\/\/doi.org\/10.1145\/3468891.3468893","relation":{},"subject":[],"published":{"date-parts":[[2021,4,23]]},"assertion":[{"value":"2021-09-06","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}