{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,12,4]],"date-time":"2025-12-04T01:50:55Z","timestamp":1764813055236},"reference-count":65,"publisher":"PeerJ","license":[{"start":{"date-parts":[[2023,9,22]],"date-time":"2023-09-22T00:00:00Z","timestamp":1695340800000},"content-version":"unspecified","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Princess Nourah bint Abdulrahman University Researchers","award":["PNURSP2023R40"],"award-info":[{"award-number":["PNURSP2023R40"]}]},{"name":"Princess Nourah bint Abdulrahman University, Riyadh, Saudi Arabia"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"abstract":"<jats:sec>\n               <jats:title>Background<\/jats:title>\n               <jats:p>Malware, malicious software, is the major security concern of the digital realm. Conventional cyber-security solutions are challenged by sophisticated malicious behaviors. Currently, an overlap between malicious and legitimate behaviors causes more difficulties in characterizing those behaviors as malicious or legitimate activities. For instance, evasive malware often mimics legitimate behaviors, and evasion techniques are utilized by legitimate and malicious software.<\/jats:p>\n            <\/jats:sec>\n            <jats:sec>\n               <jats:title>Problem<\/jats:title>\n               <jats:p>Most of the existing solutions use the traditional term of frequency-inverse document frequency (TF-IDF) technique or its concept to represent malware behaviors. However, the traditional TF-IDF and the developed techniques represent the features, especially the shared ones, inaccurately because those techniques calculate a weight for each feature without considering its distribution in each class; instead, the generated weight is generated based on the distribution of the feature among all the documents. Such presumption can reduce the meaning of those features, and when those features are used to classify malware, they lead to a high false alarms.<\/jats:p>\n            <\/jats:sec>\n            <jats:sec>\n               <jats:title>Method<\/jats:title>\n               <jats:p>This study proposes a Kullback-Liebler Divergence-based Term Frequency-Probability Class Distribution (KLD-based TF-PCD) algorithm to represent the extracted features based on the differences between the probability distributions of the terms in malware and benign classes. Unlike the existing solution, the proposed algorithm increases the weights of the important features by using the Kullback-Liebler Divergence tool to measure the differences between their probability distributions in malware and benign classes.<\/jats:p>\n            <\/jats:sec>\n            <jats:sec>\n               <jats:title>Results<\/jats:title>\n               <jats:p>The experimental results show that the proposed KLD-based TF-PCD algorithm achieved an accuracy of 0.972, the false positive rate of 0.037, and the F-measure of 0.978. Such results were significant compared to the related work studies. Thus, the proposed KLD-based TF-PCD algorithm contributes to improving the security of cyberspace.<\/jats:p>\n            <\/jats:sec>\n            <jats:sec>\n               <jats:title>Conclusion<\/jats:title>\n               <jats:p>New meaningful characteristics have been added by the proposed algorithm to promote the learned knowledge of the classifiers, and thus increase their ability to classify malicious behaviors accurately.<\/jats:p>\n            <\/jats:sec>","DOI":"10.7717\/peerj-cs.1492","type":"journal-article","created":{"date-parts":[[2023,9,22]],"date-time":"2023-09-22T07:39:47Z","timestamp":1695368387000},"page":"e1492","source":"Crossref","is-referenced-by-count":2,"title":["A Kullback-Liebler divergence-based representation algorithm for malware detection"],"prefix":"10.7717","volume":"9","author":[{"given":"Faitouri A.","family":"Aboaoja","sequence":"first","affiliation":[{"name":"Faculty of Computing, Universiti Teknologi Malaysia, Johor Baru, Johor, Malaysia"},{"name":"Faculty of Education-Elgobbah, University of Derna, Libya, Elgobbah, Barka, Libya"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Anazida","family":"Zainal","sequence":"additional","affiliation":[{"name":"Department of Computer Sciences, College of Computer and Information Sciences, Princess Nourah Bint Abdulrahman University, Riyadh, Saudi Arabia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Fuad A.","family":"Ghaleb","sequence":"additional","affiliation":[{"name":"Faculty of Computing, Universiti Teknologi Malaysia, Johor Baru, Johor, Malaysia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Norah Saleh","family":"Alghamdi","sequence":"additional","affiliation":[{"name":"Department of Computer Sciences, College of Computer and Information Sciences, Princess Nourah Bint Abdulrahman University, Riyadh, Saudi Arabia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Faisal","family":"Saeed","sequence":"additional","affiliation":[{"name":"DAAI Research Group, Department of Computing and Data Science, School of Computing and Digital Technology, Birmingham City University, Birmingham, UK"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Husayn","family":"Alhuwayji","sequence":"additional","affiliation":[{"name":"Higher Institute of Science and Technology, Qarabulli, Higher Institute of Science and Technology,  Qarabulli, Tripoli, Libya"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"4443","published-online":{"date-parts":[[2023,9,22]]},"reference":[{"issue":"17","key":"10.7717\/peerj-cs.1492\/ref-1","doi-asserted-by":"publisher","first-page":"8482","DOI":"10.3390\/app12178482","article-title":"Malware detection issues, challenges, and future directions: a survey","volume":"12","author":"Aboaoja","year":"2022","journal-title":"Applied Sciences"},{"issue":"2","key":"10.7717\/peerj-cs.1492\/ref-2","doi-asserted-by":"publisher","first-page":"416","DOI":"10.3390\/math11020416","article-title":"Dynamic Extraction of Initial Behavior for Evasive Malware Detection","volume":"11","author":"Aboaoja","year":"2023","journal-title":"Mathematics"},{"issue":"6","key":"10.7717\/peerj-cs.1492\/ref-3","doi-asserted-by":"publisher","first-page":"126","DOI":"10.1145\/3365001","article-title":"Malware dynamic analysis evasion techniques : a survey","volume":"52","author":"Afianian","year":"2019","journal-title":"ACM Computing Surveys"},{"key":"10.7717\/peerj-cs.1492\/ref-4","doi-asserted-by":"publisher","first-page":"102753","DOI":"10.1016\/j.jnca.2020.102753","article-title":"A system call refinement-based enhanced Minimum Redundancy Maximum Relevance method for ransomware early detection","volume":"167","author":"Ahmed","year":"2020","journal-title":"Journal of Network and Computer Applications"},{"key":"10.7717\/peerj-cs.1492\/ref-5","doi-asserted-by":"publisher","first-page":"140586","DOI":"10.1109\/ACCESS.2020.3012674","article-title":"A pseudo feedback-based annotated TF-IDF technique for dynamic crypto-ransomware pre-encryption boundary delineation and features extraction","volume":"8","author":"Al-Rimy","year":"2020","journal-title":"IEEE Access"},{"key":"10.7717\/peerj-cs.1492\/ref-6","doi-asserted-by":"publisher","first-page":"76","DOI":"10.1016\/j.comcom.2019.01.003","article-title":"Analysis and classification of context-based malware behavior","volume":"136","author":"Alaeiyan","year":"2019","journal-title":"Computer Communications"},{"issue":"11","key":"10.7717\/peerj-cs.1492\/ref-7","doi-asserted-by":"publisher","first-page":"1777","DOI":"10.3390\/electronics9111777","article-title":"MALGRA: machine learning and N-gram malware feature extraction and detection system","volume":"9","author":"Ali","year":"2020","journal-title":"Electronics"},{"issue":"21","key":"10.7717\/peerj-cs.1492\/ref-8","doi-asserted-by":"publisher","first-page":"1","DOI":"10.3390\/app10217673","article-title":"Contextual identification of windows malware through semantic interpretation of API call sequence","volume":"10","author":"Amer","year":"2020","journal-title":"Applied Sciences"},{"key":"10.7717\/peerj-cs.1492\/ref-9","doi-asserted-by":"publisher","first-page":"e533","DOI":"10.7717\/peerj-cs.533","article-title":"Androanalyzer: android malicious software detection based on deep learning","volume":"7","author":"Arslan","year":"2021","journal-title":"PeerJ Computer Science"},{"key":"10.7717\/peerj-cs.1492\/ref-10","doi-asserted-by":"publisher","first-page":"7501894","DOI":"10.1155\/2020\/7501894","article-title":"Using a subtractive center behavioral model to detect malware","volume":"2020","author":"Aslan","year":"2020","journal-title":"Security and Communication Networks"},{"key":"10.7717\/peerj-cs.1492\/ref-11","article-title":"Malware statistics & trends report","author":"AV-TEST MS and TR (nd.)"},{"key":"10.7717\/peerj-cs.1492\/ref-12","article-title":"Memory access patterns for malware detection","author":"Banin","year":"2016"},{"issue":"11","key":"10.7717\/peerj-cs.1492\/ref-13","doi-asserted-by":"publisher","DOI":"10.1177\/1550147719889907","article-title":"Combined dynamic multi-feature and rule-based behavior for accurate malware detection","volume":"15","author":"Belaoued","year":"2019","journal-title":"International Journal of Distributed Sensor Networks"},{"key":"10.7717\/peerj-cs.1492\/ref-14","doi-asserted-by":"publisher","DOI":"10.1145\/3150376.3150378","article-title":"A survey on automated dynamic malware analysis evasion and counter-evasion: PC, mobile, and web","author":"Bulazel","year":"2017"},{"key":"10.7717\/peerj-cs.1492\/ref-15","doi-asserted-by":"publisher","first-page":"399","DOI":"10.1016\/j.cose.2017.11.016","article-title":"Malware classification using self organising feature maps and machine activity data","volume":"73","author":"Burnap","year":"2018","journal-title":"Computers & Security"},{"key":"10.7717\/peerj-cs.1492\/ref-16","doi-asserted-by":"publisher","first-page":"e346","DOI":"10.7717\/peerj-cs.346","article-title":"Data augmentation based malware detection using convolutional neural networks","volume":"7","author":"Catak","year":"2021","journal-title":"PeerJ Computer Science"},{"key":"10.7717\/peerj-cs.1492\/ref-17","doi-asserted-by":"publisher","first-page":"e285","DOI":"10.7717\/peerj-cs.285","article-title":"Deep learning based sequential model for malware analysis using Windows exe API calls","volume":"6","author":"Catak","year":"2020","journal-title":"PeerJ Computer Science"},{"issue":"2","key":"10.7717\/peerj-cs.1492\/ref-18","doi-asserted-by":"publisher","first-page":"127","DOI":"10.1007\/s11416-018-0327-9","article-title":"Windows malware detection system based on LSVC recommended hybrid features","volume":"15","author":"Darshan","year":"2019","journal-title":"Journal of Computer Virology and Hacking Techniques"},{"issue":"2","key":"10.7717\/peerj-cs.1492\/ref-19","doi-asserted-by":"publisher","first-page":"339","DOI":"10.1007\/s13042-019-00978-7","article-title":"An empirical study to estimate the stability of random forest classifier on the hybrid features recommended by filter based feature selection technique","volume":"11","author":"Darshan","year":"2020","journal-title":"International Journal of Machine Learning and Cybernetics"},{"key":"10.7717\/peerj-cs.1492\/ref-20","doi-asserted-by":"publisher","first-page":"100317","DOI":"10.1016\/j.cosrev.2020.100317","article-title":"Deep learning algorithms for cybersecurity applications: a technological and status review","volume":"39","author":"Dixit","year":"2021","journal-title":"Computer Science Review"},{"key":"10.7717\/peerj-cs.1492\/ref-21","doi-asserted-by":"publisher","first-page":"e907","DOI":"10.7717\/peerj-cs.907","article-title":"The rise of obfuscated Android malware and impacts on detection methods","volume":"8","author":"Elsersy","year":"2022","journal-title":"PeerJ Computer Science"},{"key":"10.7717\/peerj-cs.1492\/ref-22","article-title":"Malware detection in cloud computing using an image visualization technique","author":"Fargana","year":"2019"},{"key":"10.7717\/peerj-cs.1492\/ref-23","doi-asserted-by":"publisher","first-page":"108266","DOI":"10.1016\/j.knosys.2022.108266","article-title":"Time-interval temporal patterns can beat and explain the malware","volume":"241","author":"Finder","year":"2022","journal-title":"Knowledge-Based Systems"},{"key":"10.7717\/peerj-cs.1492\/ref-24","doi-asserted-by":"publisher","first-page":"793","DOI":"10.1109\/CSE-EUC.2017.157","article-title":"Malware detection and classification based on N-grams attribute similarity","author":"Fuyong","year":"2017"},{"issue":"2","key":"10.7717\/peerj-cs.1492\/ref-25","doi-asserted-by":"publisher","first-page":"59","DOI":"10.1007\/s11416-015-0244-0","article-title":"Behavior-based features model for malware detection","volume":"12","author":"Galal","year":"2016","journal-title":"Journal of Computer Virology and Hacking Techniques"},{"key":"10.7717\/peerj-cs.1492\/ref-26","doi-asserted-by":"publisher","first-page":"102550","DOI":"10.1016\/j.cose.2021.102550","article-title":"A Systematical and longitudinal study of evasive behaviors in windows malware","volume":"113","author":"Galloro","year":"2022","journal-title":"Computers and Security"},{"key":"10.7717\/peerj-cs.1492\/ref-27","doi-asserted-by":"publisher","first-page":"e988","DOI":"10.7717\/peerj-cs.988","article-title":"Malware detection framework based on graph variational autoencoder extracted embeddings from API-call graphs","volume":"8","author":"Gunduz","year":"2022","journal-title":"PeerJ Computer Science"},{"key":"10.7717\/peerj-cs.1492\/ref-28","doi-asserted-by":"publisher","first-page":"106729","DOI":"10.1016\/j.compeleceng.2020.106729","article-title":"Improving malware detection using big data and ensemble learning","volume":"86","author":"Gupta","year":"2020","journal-title":"Computers & Electrical Engineering"},{"key":"10.7717\/peerj-cs.1492\/ref-29","doi-asserted-by":"publisher","first-page":"271","DOI":"10.1007\/s11416-022-00445-y","article-title":"IFMD: image fusion for malware detection","volume":"19","author":"Hashemi","year":"2022","journal-title":"Journal of Computer Virology and Hacking Techniques"},{"key":"10.7717\/peerj-cs.1492\/ref-30","doi-asserted-by":"publisher","first-page":"103443","DOI":"10.1016\/j.csi.2020.103443","article-title":"Metamorphic malware identification using engine-specific patterns based on co-opcode graphs","volume":"71","author":"Kakisim","year":"2020","journal-title":"Computer Standards & Interfaces"},{"key":"10.7717\/peerj-cs.1492\/ref-31","doi-asserted-by":"publisher","first-page":"75802","DOI":"10.1109\/ACCESS.2022.3190978","article-title":"Large-scale analysis on anti-analysis techniques in real-world malware","volume":"10","author":"Kim","year":"2022","journal-title":"IEEE Access"},{"issue":"3","key":"10.7717\/peerj-cs.1492\/ref-32","doi-asserted-by":"publisher","first-page":"1891","DOI":"10.32604\/cmc.2020.010933","article-title":"Analysis of feature importance and interpretation for malware classification","volume":"65","author":"Kim","year":"2020","journal-title":"Computers, Materials and Continua"},{"key":"10.7717\/peerj-cs.1492\/ref-33","doi-asserted-by":"publisher","first-page":"769","DOI":"10.1145\/2810103.2813642","article-title":"MalGene: Automatic Extraction of Malware Analysis Evasion Signature","author":"Kirat","year":"2015","journal-title":"Proceedings of the ACM Conference on Computer and Communications"},{"key":"10.7717\/peerj-cs.1492\/ref-34","doi-asserted-by":"publisher","first-page":"380","DOI":"10.1109\/DSC50466.2020.00066","article-title":"An adversarial machine learning method based on OpCode N-grams feature in malware detection","author":"Li","year":"2020"},{"key":"10.7717\/peerj-cs.1492\/ref-35","doi-asserted-by":"publisher","first-page":"194","DOI":"10.1109\/TrustCom50675.2020.00037","article-title":"Malware detection based on term frequency analysis of GPRs features","author":"Li","year":"2020"},{"key":"10.7717\/peerj-cs.1492\/ref-36","doi-asserted-by":"publisher","first-page":"359","DOI":"10.1016\/j.cose.2017.11.010","article-title":"Efficient dynamic malware analysis using virtual time control mechanics","volume":"73","author":"Lin","year":"2018","journal-title":"Computers and Security"},{"key":"10.7717\/peerj-cs.1492\/ref-37","article-title":"Longitudinal study of the prevalence of malware evasive techniques","author":"Maffia","year":"2021"},{"issue":"1","key":"10.7717\/peerj-cs.1492\/ref-38","doi-asserted-by":"publisher","first-page":"19","DOI":"10.3390\/jcp1010003","article-title":"Investigating anti-evasion malware triggers using automated sandbox reconfiguration techniques","volume":"1","author":"Mills","year":"2020","journal-title":"Journal of Cybersecurity and Privacy"},{"key":"10.7717\/peerj-cs.1492\/ref-39","doi-asserted-by":"crossref","DOI":"10.1109\/ICCKE.2015.7365862","article-title":"Metamorphic malware detection using linear discriminant analysis and graph similarity","author":"Mirzazadeh","year":"2015"},{"key":"10.7717\/peerj-cs.1492\/ref-40","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1109\/ICCCNT45670.2019.8944796","article-title":"Review of machine learning methods for windows malware detection","author":"Naz","year":"2019"},{"key":"10.7717\/peerj-cs.1492\/ref-41","doi-asserted-by":"publisher","first-page":"102365","DOI":"10.1016\/j.jisa.2019.102365","article-title":"Getting to the root of the problem: a detailed comparison of kernel and user level data for dynamic malware analysis","volume":"48","author":"Nunes","year":"2019","journal-title":"Journal of Information Security and Applications"},{"key":"10.7717\/peerj-cs.1492\/ref-42","doi-asserted-by":"crossref","first-page":"103202","DOI":"10.1016\/j.jisa.2022.103202","article-title":"Measuring the effect of evasive malware on system call classifiers","volume":"67","author":"Nunes","year":"2022","journal-title":"Journal of Information Security and Applications"},{"issue":"5","key":"10.7717\/peerj-cs.1492\/ref-43","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3329786","article-title":"Dynamic malware analysis in the modern era\u2014a state of the art survey","volume":"52","author":"Or-Meir","year":"2019","journal-title":"ACM Computing Surveys"},{"key":"10.7717\/peerj-cs.1492\/ref-44","doi-asserted-by":"publisher","first-page":"91","DOI":"10.1016\/j.jisa.2017.10.005","article-title":"Classification of malware families based on runtime behaviors","volume":"37","author":"Pekta\u015f","year":"2017","journal-title":"Journal of Information Security and Applications"},{"issue":"1","key":"10.7717\/peerj-cs.1492\/ref-45","doi-asserted-by":"publisher","first-page":"012030","DOI":"10.1088\/1742-6596\/2024\/1\/012030","article-title":"Malware detection based on TF-(IDF & ICF) method","volume":"2024","author":"Qin","year":"2021","journal-title":"Journal of Physics: Conference Series"},{"issue":"2","key":"10.7717\/peerj-cs.1492\/ref-46","doi-asserted-by":"publisher","first-page":"194","DOI":"10.1504\/IJOR.2015.067344","article-title":"Fuzzy AHP models for the evaluation of IT capability, data quality, knowledge management systems implementation and data security dimensions","volume":"22","author":"Rostamy","year":"2015","journal-title":"International Journal of Operational Research"},{"key":"10.7717\/peerj-cs.1492\/ref-47","first-page":"1206","article-title":"Bayesian active malware analysis","author":"Sartea","year":"2020"},{"issue":"2","key":"10.7717\/peerj-cs.1492\/ref-48","doi-asserted-by":"publisher","first-page":"7","DOI":"10.5120\/15544-4098","article-title":"Evolution and detection of polymorphic and metamorphic malwares: a survey","volume":"90","author":"Sharma","year":"2014","journal-title":"International Journal of Computer Applications"},{"key":"10.7717\/peerj-cs.1492\/ref-49","doi-asserted-by":"publisher","first-page":"804","DOI":"10.1016\/j.procs.2015.02.149","article-title":"Integrated static and dynamic analysis for malware detection","volume":"46","author":"Shijo","year":"2015","journal-title":"Procedia Computer Science"},{"issue":"18","key":"10.7717\/peerj-cs.1492\/ref-50","doi-asserted-by":"publisher","first-page":"3680","DOI":"10.3390\/app9183680","article-title":"Malware detection approach based on artifacts in memory image and dynamic analysis","volume":"9","author":"Sihwail","year":"2019","journal-title":"Applied Sciences"},{"issue":"3","key":"10.7717\/peerj-cs.1492\/ref-51","first-page":"100","article-title":"Challenges of malware analysis: obfuscation techniques","volume":"7","author":"Singh","year":"2018","journal-title":"International Journal of Information Security Science"},{"key":"10.7717\/peerj-cs.1492\/ref-52","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1109\/CONIT55038.2022.9848152","article-title":"Opcode and API Based Machine Learning Framework For Malware Classification","author":"Soni","year":"2022"},{"key":"10.7717\/peerj-cs.1492\/ref-53","doi-asserted-by":"publisher","first-page":"335","DOI":"10.1109\/CSCWD49262.2021.9437887","article-title":"DeepMIT: a novel malicious insider threat detection framework based on recurrent neural network","author":"Sun","year":"2021"},{"key":"10.7717\/peerj-cs.1492\/ref-54","article-title":"Internet Security Threat Report. Vol. 20","author":"Symantec","year":"2015"},{"key":"10.7717\/peerj-cs.1492\/ref-55","volume-title":"Kullback-Leibler divergence","author":"University of Illinois","year":"2021"},{"issue":"2","key":"10.7717\/peerj-cs.1492\/ref-56","first-page":"209","article-title":"Inverse-category-frequency based supervised term weighting schemes for text categorization","volume":"29","author":"Wang","year":"2013","journal-title":"Journal of Information Science and Engineering"},{"key":"10.7717\/peerj-cs.1492\/ref-57","doi-asserted-by":"publisher","first-page":"8077220","DOI":"10.1155\/2021\/8077220","article-title":"Toward Identifying APT Malware through API System Calls","volume":"2001","author":"Wei","year":"2021","journal-title":"Security and Communication Networks"},{"key":"10.7717\/peerj-cs.1492\/ref-58","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1155\/2020\/6804290","article-title":"A novel malware classification method based on crucial behavior","volume":"2020","author":"Xiao","year":"2020","journal-title":"Mathematical Problems in Engineering"},{"key":"10.7717\/peerj-cs.1492\/ref-59","doi-asserted-by":"publisher","first-page":"91641","DOI":"10.1109\/ACCESS.2019.2927552","article-title":"Malware classification using probability scoring and machine learning","volume":"7","author":"Xue","year":"2019","journal-title":"IEEE Access"},{"key":"10.7717\/peerj-cs.1492\/ref-60","doi-asserted-by":"publisher","first-page":"39229","DOI":"10.1109\/ACCESS.2021.3064561","article-title":"Deep learning approach for detecting malicious activities over encrypted secure channels","volume":"9","author":"Yang","year":"2021","journal-title":"IEEE Access"},{"key":"10.7717\/peerj-cs.1492\/ref-61","doi-asserted-by":"publisher","first-page":"140915","DOI":"10.1109\/ACCESS.2020.3014245","article-title":"TuningMalconv: malware detection with not just raw bytes","volume":"8","author":"Yang","year":"2020","journal-title":"IEEE Access"},{"key":"10.7717\/peerj-cs.1492\/ref-62","doi-asserted-by":"publisher","first-page":"646","DOI":"10.1109\/ICACCCT.2016.7831719","article-title":"Malware detection based on opcode frequency","author":"Yewale","year":"2017"},{"key":"10.7717\/peerj-cs.1492\/ref-63","doi-asserted-by":"publisher","first-page":"420","DOI":"10.1016\/j.ins.2020.08.082","article-title":"AI-HydRa: advanced hybrid approach using random forest and deep learning for malware classification","volume":"546","author":"Yoo","year":"2021","journal-title":"Information Sciences"},{"key":"10.7717\/peerj-cs.1492\/ref-64","doi-asserted-by":"publisher","first-page":"211","DOI":"10.1016\/j.future.2018.07.052","article-title":"Classification of ransomware families with machine learning based on N-gram of opcodes","volume":"90","author":"Zhang","year":"2019","journal-title":"Future Generation Computer Systems"},{"issue":"1","key":"10.7717\/peerj-cs.1492\/ref-65","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1186\/s42400-018-0010-y","article-title":"Sensitive system calls based packed malware variants detection using principal component initialized MultiLayers neural networks","volume":"1","author":"Zhang","year":"2018","journal-title":"Cybersecurity"}],"container-title":["PeerJ Computer Science"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/peerj.com\/articles\/cs-1492.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/peerj.com\/articles\/cs-1492.xml","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/peerj.com\/articles\/cs-1492.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/peerj.com\/articles\/cs-1492.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,9,22]],"date-time":"2023-09-22T07:40:10Z","timestamp":1695368410000},"score":1,"resource":{"primary":{"URL":"https:\/\/peerj.com\/articles\/cs-1492"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,9,22]]},"references-count":65,"alternative-id":["10.7717\/peerj-cs.1492"],"URL":"https:\/\/doi.org\/10.7717\/peerj-cs.1492","archive":["CLOCKSS","LOCKSS","Portico"],"relation":{},"ISSN":["2376-5992"],"issn-type":[{"value":"2376-5992","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,9,22]]},"article-number":"e1492"}}