Pith. sign in

REVIEW 4 major objections 5 minor 26 references

Enhancing JavaScript Malware Detection through Weighted Behavioral DFAs

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A weighted deterministic finite automaton over JavaScript execution behaviors classifies scripts as benign, partially malicious, or malicious by the degree to which their action sequences match known attack paths.

desk verdict A clear but unevaluated prototype: the weighted DFA idea is new, the match-percentage metric has a load-bearing flaw, and the detection claim rests on recognizing the training set. read the letter →

arxiv 2505.21406 v1 pith:T6DUV24Q submitted 2025-05-27 cs.CR

Pedro Pereira , José Gonçalves , João Vitorino , Eva Maia , Isabel Praça This is my paper
classification cs.CR MSC 68Q4568M25
keywords JavaScriptmalwaredetectiondeterministicfiniteautomatonbehavior-basedclassificationpartialmatchbehaviorweightingdynamicanalysiswebsecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes a JavaScript malware detector that models known malicious execution traces as a weighted deterministic finite automaton, the behavior DFA. New scripts are run through the automaton: reaching a final state marks a full match, while ending elsewhere triggers a breadth-first search to the nearest final state and computes a match percentage from the ratio of matched behavior weight to the weight of the shortest path to that state. The claim is that this percentage separates benign scripts from partially malicious ones and lets the system flag unknown variants that share only part of an attack's behavior. A sympathetic reader would care because the method is transparent and does not depend on large training sets, unlike black-box classifiers, and it can be extended by simply adding new attack sequences.

What carries the argument

The central object is the behavior DFA, a deterministic finite automaton $(Q, \Sigma, \delta, q_0, F)$ whose alphabet is a set of JavaScript runtime behaviors such as "Add Event Handler", "Set Callback", "Find DOM Element(s)", and "Send Data", and whose transitions carry expert-assigned weights. A path from the initial state to a final state encodes a known malicious pattern. For a new sequence that does not end in a final state, breadth-first search finds the nearest final state; the match percentage is the total weight of transitions the sequence actually followed up to its last state divided by the total weight of the shortest path from $q_0$ to that nearest final state, times 100. This ratio is the mechanism that turns automaton membership into graded risk.

What would settle it

Compute precision and recall for the three-way classification by comparing the behavior-DFA predictions against the dataset's labels; if sequences scored 18.75% or 30% are no more likely to be labeled malicious than sequences scored 0%, the match percentage is not a valid maliciousness proxy and the central claim fails.

Watch

Extended reading notes

Core claim

The paper's central claim is that a DFA whose transitions are labeled by weighted JavaScript behaviors, constructed from known malicious sequences, can classify unseen execution traces into benign, partially malicious, and fully malicious categories. Exact matches reach a final state; partial matches end in a non-final state and receive a match percentage equal to the total weight of matched behaviors divided by the total weight of the shortest path from the initial state to the nearest final state, multiplied by 100. On a proprietary dataset of 1,058 sequences, the system classified 10 as malign, 288 as partially malign, and 760 as benign, with partial-match percentages clustered at 18.75%, 30%, 37.5%, and 50%. The authors take the spread of partial scores as evidence that the system measures diverse threat levels from partially matching behaviors and therefore adapts to emerging attacks while keeping decisions transparent.

Load-bearing premise

The load-bearing premise is that the match percentage the system computes, the share of matched behavior weight along the way to the nearest known attack pattern, actually tracks how malicious a script is; the paper never validates this against the dataset's benign and malicious labels for the partial buckets.

Editorial extensions

If this is right

  • A script that shares only the opening actions of a known attack, such as adding an event handler, can be scored at 18.75%, giving an analyst a concrete and explainable reason to monitor it.
  • Because the automaton is built from known malicious sequences rather than trained, adding a newly discovered attack pattern is a matter of extending the DFA, not retraining a model.
  • The weighting of behaviors means high-risk actions like dynamic code injection or data exfiltration dominate the score, so a sequence containing a high-risk step can be flagged even if its other actions are common in benign scripts.
  • Partial-match percentages give operators a graded list of suspicious scripts, allowing them to prioritize follow-up analysis before a full attack pattern is reached.
  • The authors point to subpattern detection as the next step, which would let the same DFA find malicious action sequences embedded inside larger benign-looking workflows.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper does not report precision or recall for the partial buckets, so an immediate test would be checking whether the 288 partially malicious sequences are enriched in malicious labels compared with the 760 benign ones; the case study of sequence ID 1058, dataset-labeled benign but scored 18.75% partially malign, shows the score can disagree with ground truth.
  • Because the score depends on expert-assigned behavior weights, a sensitivity analysis varying those weights would reveal whether the observed bucket boundaries are stable or artifacts of the chosen weights.
  • The same automaton could be turned into an alarm system by choosing a match-percentage threshold, but the paper does not specify how such a threshold should be selected or calibrated.
  • A natural extension is to combine the weighted DFA with subsequence mining so that a short malicious fragment inside a long benign trace, rather than only a prefix, drives the score.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes a weighted DFA ('behavior DFA') for JavaScript malware detection. Behavior sequences from a proprietary dataset are encoded as transitions, with expert-assigned weights; a match percentage is computed as the ratio of matched behavior weight to the total weight of the path from the initial state to the nearest final state. Sequences are classified as benign, partially malicious, or malicious based on exact matches and match percentages. The system is evaluated on 1,058 sequences, reporting 10 malign, 288 partially malign, and 760 benign classifications, with a case study for one sequence (ID 1058).

Significance. The motivation is reasonable: an interpretable, deterministic alternative to black-box ML classifiers could be useful in security operations. The paper's stated strengths are transparency, expert-driven weighting, and partial-match analysis for novel threat detection. However, the current manuscript does not provide a valid evaluation of detection performance: the reported '10 malign' detections are the same 10 sequences used to build the DFA, no precision/recall or baseline comparisons are given, and the match-percentage metric is internally inconsistent as a similarity measure. If the metric and evaluation were repaired, the idea of weighted automata for behavioral sequence classification could be a modest contribution, but as presented the central claims are unsupported.

major comments (4)
  1. [§4 (Results and Evaluation)] The evaluation is circular with respect to the central detection claim. The paper states that the behavior DFA was built from 10 malicious sequences and then reports 'classifying 10 as malign' as 'consistent with expectations'. Since the DFA's accepting paths are constructed directly from those 10 sequences, exact-match detection of those sequences is guaranteed by construction and carries no evidential weight for detection ability. No held-out malicious sequences, independent attack families, or cross-validation are used, so the claim that the system 'detects' known malicious patterns is not tested.
  2. [§3 (Match Percentage formula) and §4 (case study)] The match-percentage formula is not a valid similarity measure for the observed sequence. The denominator, 'Total Weight to Nearest Final State', is the total weight of the path from q0 to the nearest final state, which includes the matched prefix plus the remaining attack-specific residual. Consequently, two sequences with identical observed prefixes can receive different percentages if their nearest final states have different total path weights, and a longer matched prefix can receive a lower percentage than a shorter one. For example, in a DFA with attacks [7,5] (total 6) and [7,1,5,1,5,1] (total 15), the prefix [7] scores 50% while [7,1] scores 33%, contradicting the claim that higher percentages indicate greater similarity to known malicious patterns. The partial-similarity classification therefore rests on a metric that does not measure what the central claim asserts.
  3. [§4 (Evaluation criteria and case study)] No accuracy metrics, label-based evaluation, or baseline comparison are provided. The evaluation reports only counts of classifications (10 malign, 288 partially malign, 760 benign) and match-percentage distributions; there is no precision, recall, F1-score, false-positive rate, or comparison against existing detectors such as Xue et al. [26] or ML-based approaches. The case study explicitly notes that sequence ID 1058 is labeled benign in the dataset but is scored at 18.75% and classified as partially malign, so the score does not track ground-truth labels. Without label-based metrics, the abstract's claim that the system 'detect[s] and classify[ies] threats effectively' is unsupported.
  4. [§3 (Classification decision rule)] The decision boundary between 'benign' and 'partially malicious' is not defined. Section 3 states that a sequence is 'benign if there is no strong similarity', but no threshold for 'strong similarity' is given, nor is a cutoff match percentage specified. Section 4 classifies 288 sequences as partially malign with percentages as low as 18.75%, and 760 as benign, but the rule that separates these groups is absent, making the classification non-reproducible and untestable.
minor comments (5)
  1. [§2 Related Work] The text attributes the 'register automata and pushdown systems' work to 'Lemberger et al. [24]', but reference [24] is authored by Touili; the citation/name mismatch should be corrected.
  2. [§3 Methodology] The weight assignments for behaviors are described only by example (weights 2, 3, 1, 4, 5), but the full mapping of behavior identifiers to weights is not provided. Without that table, the worked example for the sequence [7,5] and the later case-study percentages cannot be independently verified.
  3. [§4 Results and Evaluation] The phrase 'to known threats to known threats' appears as a duplicated fragment and should be corrected.
  4. [§5 Conclusion] There are several typographical errors, including 'subquences' (should be 'subsequences') and 'it's capabilities' (should be 'its capabilities').
  5. [§4 Results and Evaluation] The claim that the system achieves 'high precision' is not supported by any precision measure in the paper; this wording should be removed or replaced with a precise, computed metric.

Circularity Check

2 steps flagged · score 7.0 of 10

Exact-match 'detection' and partial-match 'threat levels' both reduce to the 10 training sequences by construction, so the evaluation restates the DFA's inputs.

  1. fitted input called prediction [Section 4, first and second paragraphs of Results and Evaluation]
    "The behavior DFA was initially built using known malicious sequences and subsequently tested on a proprietary dataset. ... The system evaluated 1058 sequences, classifying 10 as malign, 288 as partially malign and 760 as benign. The results are consistent with expectations, since the behavior DFA was built from 10 malicious sequences. This design guarantees that the behavior DFA can detect known malicious patterns with high precision..."

    The DFA was built from 10 malicious sequences, and any exact path stored in the DFA reaches a final state by construction. Section 4 reports 10 malign detections and says this is guaranteed by the DFA's design. Whether or not the 10 detections are item-for-item identical to the training sequences, the exact-match capability is a logical consequence of recording those training paths as accepting states, not an empirical discovery. No held-out or independently labeled malicious sequence is evaluated, so the exact-match 'detection' is the training input restated as a prediction.

  2. self definitional [Section 3, 'Match Percentage' formula and example; Section 4, partial-match bucket analysis]
    "Match Percentage = (Total Matched Behavior Weight / Total Weight to Nearest Final State) × 100 ... 'Total Matched Behavior Weight' represents the sum of transition weights that lead to the current state. ... 'Total Weight to Nearest Final State' represents the sum of transition weights which directly lead to the nearest known malicious state, starting on the initial state. ... Further categorization of the partially malign sequences found match percentages of 18.75%, 30%, 37.5% and 50% ... demonstrating that the system can capture partial matches."

    Both terms of the match percentage are defined by the known malicious training paths: the numerator is the weight of the observed prefix along a training path, and the denominator is the full weight of that same training path from q0 to its final state. Therefore the 'partially malicious' class is, by definition, the class of sequences that share a prefix with one of the 10 training attacks. The claim that the resulting buckets demonstrate the system can capture partial matches is a restatement of the metric's definition, not an empirical validation against labels or held-out attacks; the paper's own case study labels sequence 1058 benign while scoring it 18.75% and calling it partially malign.

full rationale

The paper's derivation chain is self-contained regarding its method: there are no load-bearing self-citations or imported uniqueness theorems. However, the central evaluation is circular in two linked ways. First, the behavior DFA is built from 10 malicious sequences, and Section 4 reports exactly 10 malign detections, explicitly attributing this to the construction; exact-match detection is therefore guaranteed by the input rather than demonstrated. Second, the match percentage is defined entirely by overlap with those training paths (matched prefix weight over full training-path weight), so the partial-malicious buckets are arithmetic consequences of the training data and weights, not measured threat levels. The paper presents these buckets as evidence of capturing partial matches, but no precision, recall, or held-out malicious sequences support that interpretation; the case study even labels a detected sequence benign. The score of 7 reflects that both the exact-match and partial-match claims reduce to the training inputs by construction, while the broader claim about detecting emerging threats remains an unvalidated assertion rather than a derived result.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The central claim depends on expert-selected weights, correct labels, and the premise that prefix similarity to 10 training traces measures maliciousness. The exact-match detections are the same 10 training sequences, so the system's output has not been validated against independent malicious data.

free parameters (2)
  • Behavior weights = e.g., Add Event Handler=3, Set Callback=3, Find DOM Element(s)=2, Send Data=5
    Chosen by experts rather than learned; every match percentage depends on these values, and no sensitivity analysis or full weight table is provided.
  • Benign vs partially malicious cutoff = not specified
    The paper says partially malicious sequences have 'no strong similarity' to known patterns and are called benign, but no numeric threshold is defined; the boundary is a hand-waved choice.
assumptions (4)
  • domain assumption Ordered sequences of behavior identifiers are sufficient to characterize maliciousness
    The DFA is built only over the behavior label alphabet, ignoring argument values, execution contexts, and concurrency; Section 3 constructs the behavior DFA from behavior sequences.
  • domain assumption Labels in the proprietary dataset are correct
    The label of each sequence is 'derived directly from the dataset' (Section 3) with no audit or independent verification described.
  • domain assumption Expert-assigned behavior weights reflect real-world threat dynamics
    The weighting system is asserted to be developed with JavaScript experts, but no evidence, ablation, or sensitivity analysis is provided.
  • domain assumption Partial behavioral overlap with known attacks generalizes to novel threats
    Section 3 cites Ravi et al. to argue shared behavior patterns let the system detect unknown attacks; this is an assumption about attack clustering, not an empirical result in this paper.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Enhancing JavaScript Malware Detection through Weighted Behavioral DFAs." pith.science (2026). https://pith.science/paper/T6DUV24Q

@misc{pith2026250521406,
  author       = {Pith},
  title        = {Pith review of: Enhancing JavaScript Malware Detection through Weighted Behavioral DFAs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/T6DUV24Q}},
  note         = {Machine review of arXiv:2505.21406}
}
read the original abstract

This work addresses JavaScript malware detection to enhance client-side web application security with a behavior-based system. The ability to detect malicious JavaScript execution sequences is a critical problem in modern web security as attack techniques become more sophisticated. This study introduces a new system for detecting JavaScript malware using a Deterministic Finite Automaton (DFA) along with a weighted-behavior system, which we call behavior DFA. This system captures malicious patterns and provides a dynamic mechanism to classify new sequences that exhibit partial similarity to known attacks, differentiating them between benign, partially malicious, and fully malicious behaviors. Experimental evaluation on a dataset of 1,058 sequences captured in a real-world environment demonstrates the capability of the system to detect and classify threats effectively, with the behavior DFA successfully identifying exact matches and partial similarities to known malicious behaviors. The results highlight the adaptability of the system in detecting emerging threats while maintaining transparency in decision making.

Figures

Figures reproduced from arXiv: 2505.21406 by the authors.

Figure 1
Figure 1. Behavior DFA example. To classify a new set of behaviors, the behavior DFA evaluates the sequence of actions performed during the JavaScript execution. The behavior DFA receives sequences of states as transitions that begin from its initial state q0. During sequence processing, the behavior DFA advances through states according to input behaviors which follow the behavior DFA defined transitions. The behavior DFA de… view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

26 extracted references · 17 canonical work pages

  1. [7]

    In: 2018 25th Asia-Pacific Software Engineering Conference (APSEC)

    He, X., Xu, L., Cha, C.: Malicious javascript code detection based on hybrid anal- ysis. In: 2018 25th Asia-Pacific Software Engineering Conference (APSEC). pp. 365–374 (12 2018).https://doi.org/10.1109/APSEC.2018.00051

    arXiv 2018

  2. [26]

    In: Proceedings of the 2015 International Symposium on Software Testing and Analysis

    Xue, Y., Wang, J., Liu, Y., Xiao, H., Sun, J., Chandramohan, M.: Detection and classification of malicious javascript via attack behavior modelling. In: Proceedings of the 2015 International Symposium on Software Testing and Analysis. p. 48–59. ISSTA 2015, Association for Computing Machinery, New York, NY, USA (2015). https://doi.org/10.1145/2771783.2771814

    arXiv 2015

  3. [1]

    In: Proceedings of the 20th International Conference on World Wide Web

    Canali, D., Cova, M., Vigna, G., Kruegel, C.: Prophiler: a fast filter for the large- scale detection of malicious web pages. In: Proceedings of the 20th International Conference on World Wide Web. p. 197–206. WWW ’11, Association for Comput- ing Machinery, New York, NY, USA (2011).https://doi.org/10.1145/1963405. 1963436

    doi:10.1145/1963405 2011

  4. [2]

    In: Proceedings of the 25th International Conference Companion on World Wide Web

    Chen, P., Desmet, L., Huygens, C., Joosen, W.: Longitudinal study of the use of client-side security mechanisms on the european web. In: Proceedings of the 25th International Conference Companion on World Wide Web. p. 457–462. WWW ’16 Companion, International World Wide Web Conferences Steering Committee, Re- public and Canton of Geneva, CHE (2016).https:...

    doi:10.1145/2872518 2016

  5. [3]

    In: Proceedings of the 19th International Con- ference on World Wide Web

    Cova, M., Krügel, C., Vigna, G.: Detection and analysis of drive-by-download at- tacks and malicious javascript code. In: Proceedings of the 19th International Con- ference on World Wide Web. pp. 281–290 (04 2010).https://doi.org/10.1145/ 1772690.1772720

    arXiv 2010

  6. [4]

    In: Proceedings of the 20th USENIX Conference on Security

    Curtsinger, C., Livshits, B., Zorn, B., Seifert, C.: Zozzle: fast and precise in-browser javascript malware detection. In: Proceedings of the 20th USENIX Conference on Security. p. 3. SEC’11, USENIX Association, USA (2011)

    work page 2011

  7. [5]

    In: Proceedings of the 2014 ACM Southeast Conference

    Gorji, A., Abadi, M.: Detecting obfuscated javascript malware using sequences of internal function calls. In: Proceedings of the 2014 ACM Southeast Conference. ACMSE ’14, Association for Computing Machinery, New York, NY, USA (2014). https://doi.org/10.1145/2638404.2737181 Title Suppressed Due to Excessive Length 13

    work page arXiv 2014

  8. [6]

    Computer Communications198(11 2022).https://doi

    Guo, Y.: A review of machine learning-based zero-day attack detection: Challenges and future directions. Computer Communications198(11 2022).https://doi. org/10.1016/j.comcom.2022.11.001

    doi:10.1016/j.comcom.2022.11.001 2022

Show all 26 references
  1. [8]

    Future Generation Computer Systems130, 193–206 (2022)

    Jing, C., Wu, Y., Cui, C.: Ensemble dynamic behavior detection method for ad- versarial malware. Future Generation Computer Systems130, 193–206 (2022). https://doi.org/https://doi.org/10.1016/j.future.2021.12.013

    2022 doi

  2. [9]

    2015 The International Symposium on Artificial Intelligence and Signal Processing (AISP) pp

    Jodavi,M.,Abadi,M.,Parhizkar,E.:Jsobfusdetector:Abinarypso-basedone-class classifier ensemble to detect obfuscated javascript code. 2015 The International Symposium on Artificial Intelligence and Signal Processing (AISP) pp. 322–327 (2015),https://api.semanticscholar.org/Corpu...

    2015

  3. [10]

    it - Information Technology53, 256– (09 2011).https://doi.org/ 10.1524/itit.2011.0651

    Johns, M.: Code injection vulnerabilities in web applications - exemplified at cross- site scripting. it - Information Technology53, 256– (09 2011).https://doi.org/ 10.1524/itit.2011.0651

    2011

  4. [11]

    IEEE Soft- ware14(5), 35–42 (1997).https://doi.org/10.1109/52.605929

    Kosoresow, A., Hofmeyer, S.: Intrusion detection via system call traces. IEEE Soft- ware14(5), 35–42 (1997).https://doi.org/10.1109/52.605929

    1997 doi

  5. [12]

    Journal in Computer Virology8(1), 1–13 (May 2012).https://doi.org/10.1007/s11416-011-0157-5

    Ma,W.,Duan,P.,Liu,S.,Gu,G.,Liu,J.C.:Shadowattacks:automaticallyevading system-call-behavior based malware detection. Journal in Computer Virology8(1), 1–13 (May 2012).https://doi.org/10.1007/s11416-011-0157-5

    2012 doi

  6. [13]

    In: Proceedings of the 11th Interna- tional Symposium on Recent Advances in Intrusion Detection

    Martignoni, L., Stinson, E., Fredrikson, M., Jha, S., Mitchell, J.C.: A layered ar- chitecture for detecting malicious behaviors. In: Proceedings of the 11th Interna- tional Symposium on Recent Advances in Intrusion Detection. p. 78–97. RAID ’08, Springer-Verlag, Berlin, Heide...

    2008

  7. [14]

    Pantelaios, N., Kapravelos, A.: Fv8: A forced execution javascript engine for de- tecting evasive techniques (2024),https://arxiv.org/abs/2405.13175

    2024 arXiv

  8. [15]

    2013 International Conference on Security and Cryptography (SECRYPT) pp

    Ravi, S., Balakrishnan, N., Venkatesh, B.: Behavior-based malware analysis us- ing profile hidden markov models. 2013 International Conference on Security and Cryptography (SECRYPT) pp. 1–12 (2013),https://api.semanticscholar.org/ CorpusID:18622802

    2013

  9. [16]

    why should i trust you?

    Ribeiro, M.T., Singh, S., Guestrin, C.: "why should i trust you?": Explaining the predictions of any classifier (2016),https://arxiv.org/abs/1602.04938

    2016 arXiv

  10. [17]

    In: Proceedings of the 26th Annual Computer Secu- rity Applications Conference

    Rieck, K., Krueger, T., Dewald, A.: Cujo: Efficient detection and prevention of drive-by-download attacks. In: Proceedings of the 26th Annual Computer Secu- rity Applications Conference. pp. 31–39 (12 2010).https://doi.org/10.1145/ 1920261.1920267

    2010

  11. [18]

    In: SECRYPT

    Rus, C., Sarmah, D.K., El-Hajj, M.: Defeating magecart attacks in a naiss way. In: SECRYPT. pp. 691–697 (2023)

    2023

  12. [19]

    Sebastio, S., Baranov, E., Biondi, F., Decourbe, O., Given-Wilson, T., Legay, A., Puodzius, C., Quilbeuf, J.: Optimizing symbolic execution for malware behavior classification. Comput. Secur.93, 101775 (2020).https://doi.org/10.1016/j. cose.2020.101775

    2020

  13. [20]

    In: Proceedings 2001 IEEE Sym- posium on Security and Privacy

    Sekar, R., Bendre, M., Dhurjati, D., Bollineni, P.: A fast automaton-based method for detecting anomalous program behaviors. In: Proceedings 2001 IEEE Sym- posium on Security and Privacy. S&P 2001. pp. 144 – 155 (02 2001).https: //doi.org/10.1109/SECPRI.2001.924295

    2001

  14. [21]

    IEEE Access8(10 2020).https://doi.org/10

    Sohan, M.F., Basalamah, A.: A systematic literature review and quality analysis of javascript malware detection. IEEE Access8(10 2020).https://doi.org/10. 1109/ACCESS.2020.3031690 14 P. Pereira et al

    2020

  15. [22]

    In: Proceedings of the 26th USENIX Conference on Security Symposium

    Stock, B., Johns, M., Steffens, M., Backes, M.: How the web tangled itself: uncover- ing the history of client-side web (in)security. In: Proceedings of the 26th USENIX Conference on Security Symposium. p. 971–987. SEC’17, USENIX Association, USA (2017)

    2017

  16. [23]

    org/abs/1905.12951

    Toreini, E., Mehrnezhad, M., Shahandashti, S.F., Hao, F.: Domtegrity: Ensuring web page integrity against malicious browser extensions (2019),https://arxiv. org/abs/1905.12951

    2019 arXiv

  17. [24]

    In: Proceedings of the 17th International Conference on Availability, Reliability and Security

    Touili, T.: Register automata for malware specification. In: Proceedings of the 17th International Conference on Availability, Reliability and Security. ARES ’22, Association for Computing Machinery, New York, NY, USA (2022).https://doi. org/10.1145/3538969.3544442

    2022

  18. [25]

    Scientific Reports14(1), 25487 (Oct 2024).https://doi.org/10.1038/s41598-024-74350-3

    Wang, X., Zhai, J., Yang, H.: Detecting command injection attacks in web applica- tions based on novel deep learning methods. Scientific Reports14(1), 25487 (Oct 2024).https://doi.org/10.1038/s41598-024-74350-3

    2024 doi

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.