Pith. sign in

REVIEW 5 major objections 6 minor 66 references

Relation-aware based Siamese Denoising Autoencoder for Malware Few-shot Classification

T0 review · 5 major / 6 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that a Siamese denoising autoencoder trained on entropy images, with a learned relation module instead of a fixed distance metric, can classify previously unseen malware families from one or five labelled examples and…

desk verdict Sensible incremental method, but the zero-day robustness claim is undercut by an ambiguous episode-construction protocol and single-obfuscation testing. read the letter →

arxiv 2411.14029 v1 pith:4IJO2I2A submitted 2024-11-21 cs.CR

Jinting Zhu , Julian Jang-Jaccard , Ian Welch , Harith AI-Sahaf , Seyit Camtepe , Aeryn Dunmore , Cybersecurity Lab This is my paper · ORCID
classification cs.CR
keywords malwareclassificationfew-shotlearningSiameseneuralnetworkdenoisingautoencoderentropyimageNOPobfuscationzero-dayrelation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Using only static analysis, the paper seeks to establish that newly seen malware families can be classified from one or five labelled examples even after junk-code obfuscation, provided the classifier combines entropy images, a Siamese denoising autoencoder, and a learned relation module. The authors argue that existing autoencoder-based detectors treat each sample independently and therefore miss the semantic relationships between malware samples, while fixed distance metrics are too rigid for obfuscated inputs. Their model compares pairs of entropy images through shared-weight branches, reconstructs the clean image from the NOP-obfuscated version in each branch, and scores similarity with a trained relation network. On the Malimage dataset it reports 96.1% accuracy for 2-way 1-shot and 97.3% for 2-way 5-shot, and under NOP insertion its accuracy drops less than the Prototypical Networks baseline, which the paper reads as evidence that the approach helps with anti-obfuscation.

What carries the argument

The central machinery is a Siamese denoising autoencoder with a relation module on top. Each branch is a convolutional encoder-decoder; the encoder compresses an input entropy image into a latent vector while the decoder reconstructs the clean version, and the reconstruction loss is what is meant to strip the noise added by NOP obfuscation. The relation module is a small network that takes the concatenation of two latent embeddings (after mean pooling of support samples) and outputs a similarity score, so the model learns the comparison instead of using a fixed metric. The input representation is the entropy image, a $105\times105$ grayscale image obtained by computing Shannon entropy over bytecode blocks, which the paper argues preserves structural information and subtle differences that survive junk-code insertion. The total objective is $L = L_r + 0.7\,L_{mse}$, tying similarity scoring to denoising in a single training episode.

What would settle it

Run the same 2-way and 5-way few-shot evaluation with other obfuscation techniques, such as packing, XOR, or register reassignment, on Malimage and VUW: if accuracy drops as much as or more than the Prototypical baseline's, the anti-obfuscation claim is specific to NOP insertion rather than general. A complementary check is to train the model on obfuscated images but decode to clean images, then verify on a held-out family that the reconstructed entropy image actually diverges from the obfuscated input at the inserted NOP positions.

Watch

Extended reading notes

Core claim

The central claim is that the relations between malware samples, learned from pairs of entropy images, are a more reliable basis for few-shot classification of unseen and obfuscated malware than matching independent feature vectors. The network is a Siamese denoising autoencoder: two branches with shared weights each contain a convolutional encoder and a decoder, and the decoder is trained to reconstruct the clean entropy image from an input that has had NOP instructions inserted into its bytecode. The latent embeddings produced by the encoders are concatenated and passed through a relation module that outputs a similarity probability, replacing a hand-chosen distance with a learnable comparator; the training loss combines the relation loss with the reconstruction loss using weight $\lambda=0.7$. The paper reports that on Malimage this reaches 96.1% in 2-way 1-shot and 97.3% in 2-way 5-shot, and that under NOP obfuscation the accuracy drops by 1.8 and 1.6 percentage points compared with drops of 3.7 and 2.0 for Prototypical Networks. It concludes from these results that the model can predict previously unseen malware classes and is more robust to NOP insertion than the baseline.

Load-bearing premise

The load-bearing premise is that the decoder learns to reconstruct a clean entropy image from a NOP-obfuscated one, so that the latent representation stays stable under obfuscation; only NOP insertion is tested, and the paper itself lists packing, XOR, register reassignment, and code transposition as untested future work.

Editorial extensions

If this is right

  • Unseen malware families can be recognised from one or five labelled examples using entropy images alone, without feature retraining on the new family.
  • NOP-inserted junk code can be partially absorbed by the denoising branch, since on Malimage the model's obfuscated-versus-clean accuracy drop is smaller than the Prototypical baseline's.
  • Entropy images carry more discriminative structure than grayscale byte images for few-shot malware classification; the Prototypical baseline also improves when switched to entropy features.
  • Using a learned relation module and mean pooling of support embeddings outperforms both the Relation Network baseline and the model without data augmentation.
  • The architecture's accuracy is sensitive to the weight of the reconstruction loss (best at $\lambda=0.7$) and to the linear embedding width (256 better than 128), giving concrete design guidance.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper: if the entropy representation is as invariant as claimed, the same architecture may transfer to other byte-level obfuscations such as packing or XOR, but the paper does not test this.
  • Beyond the paper: the denoising-plus-relation design is not malware-specific, so it could be tried on other few-shot image tasks where noise is structured rather than Gaussian, such as occluded or watermarked images.
  • Beyond the paper: the 5-way results on the VUW dataset are substantially lower than the 2-way results, so the advantage may shrink as the number of candidate families grows; testing at 10-way or 20-way episodes would clarify practical zero-day conditions.
  • Beyond the paper: the reported comparisons do not separately ablate the decoder and the relation module under obfuscation, so an experiment isolating each component would show which one actually carries the anti-obfuscation gain.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The manuscript proposes a few-shot malware-family classifier that combines entropy-image representations, a Siamese denoising autoencoder, and a relation module. The model takes pairs of malware entropy images (one support, one query), encodes them with shared-weight convolutional encoders, reconstructs them with decoders, and computes a relation score for the pair. The authors evaluate on the VUW ransomware dataset (11 families) and the Malimage dataset (25 families) under 2-way/5-way, 1-shot/5-shot episodes, with and without NOP-insertion obfuscation. They report strong results on Malimage (96.1% and 97.3% for 2-way 1-shot and 5-shot) and claim that the model generalizes to previously unseen malware families and is more robust to NOP obfuscation than Prototypical Networks. The paper also includes ablations on the reconstruction-loss weight, linear-layer dimension, pooling method, and the presence of the decoder.

Significance. If the central claims were established, the paper would offer a practically relevant architecture: the use of entropy images as input, a Siamese relation module for few-shot comparison, and a decoder intended to strip obfuscation noise are all sensible building blocks, and the comparison against Prototypical Networks on a well-known public dataset (Malimage) is a useful reference point. The paper also contains some positive experimental elements: it tests two datasets, reports multiple few-shot configurations, and includes an ablation isolating the decoder's contribution. However, the evaluation protocol has serious gaps: the episode-generation description appears to allow training classes in evaluation episodes, the augmentation-before-split ordering is not justified, and only NOP insertion at a single frequency is used for the obfuscation claim. These gaps mean that the paper's headline claims are not yet supported, and the current results should be interpreted with caution.

major comments (5)
  1. [V-B, V-C] The sentence in Section V-B stating that accuracy is measured 'on random datasets drawn from the total set of training and test sets in each of 20,000 episodes' is, taken literally, an invalid evaluation of few-shot generalization: if an episode can contain classes from the training split, the model has already seen those classes, so the reported accuracies do not measure classification of previously unseen malware families. The split description in Section V-C ('9/6 classes and 2/5 classes') is also ambiguous. Please specify unambiguously that support and query sets are drawn only from held-out classes in every test episode, and if that is not what was done, rerun the experiments with class-disjoint episodes. Given the small VUW test sets (2 classes for 2-way, 5 classes for 5-way), also explain how 20,000 non-overlapping episodes are constructed or why repeated sampling does not bias the estimates.
  2. [V-B] The augmentation step (rotations of 90, 180, 270 degrees and rescaling) is described before the random class split, but the paper does not state whether the split unit is the original binary or the augmented image. If augmented views of the same original file can appear on both sides of the split, the test accuracy is inflated by near-duplicate images. Please state explicitly that all augmented variants of a single original sample are assigned to the same split, and ideally provide sample-level identifiers so that disjointness can be verified.
  3. [V-B, VI, Table IV] The robustness claim is supported only by NOP insertion at frequency 200, and the model is trained and evaluated on the same obfuscation procedure. This evaluates the model's ability to fit a specific noise pattern, not its robustness to obfuscation in general. The conclusion's statement that other obfuscation techniques (Packers/XOR/Base64, register reassignment, code transposition) are future work is an explicit acknowledgment of this limitation, but the abstract and contributions use the broader phrase 'obfuscation techniques.' Please narrow the claims to NOP insertion or add experiments with held-out obfuscation types, including at least one type not seen during training.
  4. [Algorithm 1, Eq. (5)] The denoising objective is not implemented as described. Algorithm 1 lists original samples x1_o, x2_o as inputs but never uses them; the reconstruction loss is computed as RC([dn1, en1], [dn2, en2]), which appears to compare the decoder output with the encoder input (the obfuscated sample). Eq. (5), by contrast, states that the target is the original (uncorrupted) sample. If the decoder is trained only to reconstruct the obfuscated input, then the model is not a denoising autoencoder, and the ablation in Section V-F.3 cannot be interpreted as evidence that denoising improves robustness. Please clarify the exact input/target pair used in the reconstruction loss and, if necessary, retrain with clean targets.
  5. [Table IV, V-D, V-E] The claimed advantage over Prototypical Networks is not consistent across the reported results. On VUW with obfuscation, the proposed model is worse than Prototypical in 5-way 1-shot (53.2% vs 65.2%) and 5-way 5-shot (57.3% vs 68.3%). On Malimage without obfuscation, the proposed model is below Prototypical in all 5-way settings (e.g., 83.8% vs 92.3% in 5-way 1-shot), and with obfuscation it is below in 5-way 1-shot (82.9% vs 85.4%). The paper emphasizes the smaller accuracy drops rather than the absolute accuracies, and no significance tests are reported. Please provide a statistical comparison (e.g., paired tests across episodes or repeated splits) and discuss the configurations where the proposed model does not improve over the baseline.
minor comments (6)
  1. [V-A, V-B] The text in Section V-B refers to classes 'Blocal' and 'Newbak' as having very few samples, but these names do not appear in Table I; the table's minimum is Petya with 6 samples. Please correct the inconsistency.
  2. [IV-D, Eq. (7)] Equation (7) is incomplete: the summation sign and the contrastive-loss terms L_s and L_d in Eq. (8) are not defined. Please provide the full forms and definitions.
  3. [V-C, Table III] The learning rate is given as 1e-02 in Table III but as 0.02 in the text, and the batch size entry '19/10-15' in Table III is unclear. Please harmonize the notation.
  4. [V-B, V-C] The text uses 'epochs' and 'episodes' interchangeably (20,000 epochs in V-C vs 20,000 episodes in V-B); since the training is episode-based, please use consistent terminology.
  5. [IV-A] The description of how entropy sequences are converted into a 105x105 image is vague ('concatenated with the full entropy sequences sequentially'); please specify the block size, stride, and normalization used to form the image.
  6. [V] No code, random seeds, or sample-level split definitions are provided, which makes the ambiguities in the episode-generation protocol impossible to resolve from the manuscript; releasing these artifacts would substantially strengthen the paper.

Circularity Check

1 steps flagged · score 6.0 of 10

The central anti-obfuscation claim is evaluated on the same NOP obfuscation distribution used to train the denoiser, making the reported robustness partly a fitted result rather than an independent prediction.

  1. fitted input called prediction [Section IV-E and Section V-B (Algorithm 1)]
    "The extracted features have are robust against the NOP obfuscation as they have been training with autoencoder module. ... We performed NOP insertion on the original image at frequencies 200 times each. ... We conducted experiments on the 200-frequency dataset to evaluate the performance of our model."

    The autoencoder is trained with obfuscated inputs and clean original targets, as shown in Algorithm 1 ('obfuscated samples x1_b, x2_b and original samples x1_o, x2_o'; 'Loss = 0.7* Loss1 + Loss2'), and Section IV-E credits the robustness to 'training with autoencoder module'. The evaluation then measures accuracy on the same 200-frequency NOP-obfuscated dataset used to construct those training pairs. High accuracy under NOP obfuscation therefore tests the denoiser on its own training noise distribution, not an independent prediction about obfuscation robustness.

full rationale

The few-shot classification machinery itself is not circular: the relation loss Lr and reconstruction loss Lmse are combined in L = Lr + λLmse and trained on class-split episodes, and the method is benchmarked against Prototypical Networks and Relation Networks on two datasets. The entropy-image preprocessing is specified by Equations (1)-(2) rather than imported as an unexamined premise, and the self-citation [2] for entropy features is not load-bearing. The significant circularity is confined to the anti-obfuscation claim: the denoising autoencoder is explicitly trained to reconstruct clean entropy images from NOP-obfuscated inputs and is then evaluated on 200-frequency NOP-obfuscated images, so the small accuracy drop under NOP is by construction a measure of the fitted denoiser, not a prediction about unseen obfuscation types. The conclusion itself acknowledges that packers/XOR/Base64, register reassignment, and code transposition remain future work. A separate protocol concern, that episodes are described as 'drawn from the total set of training and test sets', could further undermine the 'unseen malware' claim, but because the paper also states a class-level split, I treat that as an evaluation-validity ambiguity rather than a demonstrated circular reduction. Overall score 6: one central 'prediction' (robustness to NOP obfuscation) is partially forced by the training objective.

Assumptions & free parameters 4 free parameters · 3 assumptions · 0 invented entities

The paper introduces no new physical or conceptual entities. Its model components are standard (Siamese branches, denoising autoencoder, relation module, entropy images). The auxiliary assumptions are about the usefulness of entropy images and the representativeness of NOP obfuscation.

free parameters (4)
  • lambda (reconstruction loss weight) = 0.7
    Chosen by ablation on the Malimage dataset (Table V). The paper states the hyperparameter is 'settled as 0.7', and the ablation shows a performance peak near that value. The choice is data-dependent and could overfit the evaluation setting.
  • linear layer output dimension = 256 (first linear layer)
    Selected by comparing 128 versus 256 dimensions in the ablation. Chosen because it performs better on the Malimage dataset.
  • NOP insertion frequency = 200
    The validation and test set uses images with 200 NOP insertions. The paper shows images with 200, 400, and 600 frequencies but only evaluates at 200. Choosing the level most similar to training is a form of tuning.
  • entropy block parameters / image size = 105 x 105
    The entropy image size is fixed to 105 x 105; the block size and width settings are not fully specified. This choice affects the input representation but is not treated as a tunable parameter in the analysis.
assumptions (3)
  • domain assumption Denoising autoencoders can reconstruct un-obfuscated entropy images from NOP-obfuscated inputs.
    Assumed in Section IV-B and IV-C; the model relies on reconstruction loss to learn robust features. No direct evidence is provided that the decoder actually removes NOP noise.
  • domain assumption Entropy images preserve enough semantic structure for malware family classification.
    Motivated by prior work (Vidya et al. [51], Gibert et al. [52]). The paper does not provide a formal or empirical justification beyond its own experiments.
  • domain assumption NOP insertion is a representative obfuscation for evaluating anti-obfuscation robustness.
    The paper evaluates only NOP insertion and generalizes the conclusion to obfuscation more broadly. This is a domain assumption that is not supported by the experiments.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Relation-aware based Siamese Denoising Autoencoder for Malware Few-shot Classification." pith.science (2026). https://pith.science/paper/4IJO2I2A

@misc{pith2026241114029,
  author       = {Pith},
  title        = {Pith review of: Relation-aware based Siamese Denoising Autoencoder for Malware Few-shot Classification},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4IJO2I2A}},
  note         = {Machine review of arXiv:2411.14029}
}
read the original abstract

When malware employs an unseen zero-day exploit, traditional security measures such as vulnerability scanners and antivirus software can fail to detect them. This is because these tools rely on known patches and signatures, which do not exist for new zero-day attacks. Furthermore, existing machine learning methods, which are trained on specific and occasionally outdated malware samples, may struggle to adapt to features in new malware. To address this issue, there is a need for a more robust machine learning model that can identify relationships between malware samples without being trained on a particular malware feature set. This is particularly crucial in the field of cybersecurity, where the number of malware samples is limited and obfuscation techniques are widely used. Current approaches using stacked autoencoders aim to remove the noise introduced by obfuscation techniques through reconstruction of the input. However, this approach ignores the semantic relationships between features across different malware samples. To overcome this limitation, we propose a novel Siamese Neural Network (SNN) that uses relation-aware embeddings to calculate more accurate similarity probabilities based on semantic details of different malware samples. In addition, by using entropy images as inputs, our model can extract better structural information and subtle differences in malware signatures, even in the presence of obfuscation techniques. Evaluations on two large malware sample sets using the N-shot and N-way methods show that our proposed model is highly effective in predicting previously unseen malware, even in the presence of obfuscation techniques.

Figures

Figures reproduced from arXiv: 2411.14029 by the authors.

Figure 1
Figure 1. Feature Processing for Entropy Image 2) Malware classification with the feature extraction: The cybersecurity community has explored automated malware behavior analysis in the last decade. Many detection mech￾anisms have been proposed to prevent attacks on individual and national data. The cognitive mechanism to understand the malware characteristics in the semantic information involves the dynamic and static featur… view at source ↗
Figure 2
Figure 2. Obfuscated Code of No Operation (NOP) Insertion [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Entropy pattern corresponding to entropy image [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: The diagram of Few-shot learning This is especially true for the interaction of functions of coding between malware samples. We propose a relation-aware Siamese denoising autoencoder that enhances the conventional SNN with relational semantic information. We jointly le…
Figure 5
Figure 5. Figure 5: The diagram of our model architecture is too large it means that there are too many layers, and the risk of network overfitting will increase. Meanwhile, the entire network is difficult to converge. Algorithm1 By considering the Siamese theory of conception, the en￾cod…
Figure 6
Figure 6. Figure 6: The appearance comparison between original images and obfuscated images [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: t-distributed stochastic neighbor embedding (t-SNE) visualisation of embeddings generated using our model [PITH_FULL_IMAGE:figures/full_fig_p010_7.png]
Figure 8
Figure 8. Figure 8: t-distributed stochastic neighbor embedding (t-SNE) visualization of embeddings generated using our model [PITH_FULL_IMAGE:figures/full_fig_p010_8.png]
Figure 9
Figure 9. Figure 9: The comparison with or without autoencoder [PITH_FULL_IMAGE:figures/full_fig_p011_9.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

66 extracted references · 61 canonical work pages

  1. [2]

    A few-shot meta-learning based siamese neural network using entropy features for ransomware classification,

    J. Zhu, J. Jang-Jaccard, A. Singh, I. Welch, A.-S. Harith, and S. Camtepe, “A few-shot meta-learning based siamese neural network using entropy features for ransomware classification,” Computers & Security, vol. 117, p. 102691, 2022

    work page 2022

  2. [1]

    Dtmic: Deep transfer learning for malware image classification,

    S. Kumar and B. Janet, “Dtmic: Deep transfer learning for malware image classification,” Journal of Information Security and Applications , vol. 64, p. 103063, 2022

    work page 2022

  3. [3]

    From data and model levels: Improve the performance of few-shot malware classification,

    Y . Chai, J. Qiu, L. Yin, L. Zhang, B. B. Gupta, and Z. Tian, “From data and model levels: Improve the performance of few-shot malware classification,” IEEE Transactions on Network and Service Management, 2022

    work page 2022

  4. [4]

    Attention-based multidimensional deep learning approach for cross-architecture iomt malware detection and classification in healthcare cyber-physical systems,

    V . Ravi, T. D. Pham, and M. Alazab, “Attention-based multidimensional deep learning approach for cross-architecture iomt malware detection and classification in healthcare cyber-physical systems,” IEEE Transac- tions on Computational Social Systems , pp. 1–10, 2022

    work page 2022

  5. [5]

    Denoising ad- versarial autoencoder for obfuscated traffic detection and recovery,

    O. Salman, I. H. Elhajj, A. Kayssi, and A. Chehab, “Denoising ad- versarial autoencoder for obfuscated traffic detection and recovery,” in International conference on machine learning for networking. Springer, 2019, pp. 99–116

    work page 2019

  6. [6]

    Ae-dcnn: Autoen- coder enhanced deep convolutional neural network for malware classi- fication,

    S. Kumar, S. Meena, S. Khosla, and A. S. Parihar, “Ae-dcnn: Autoen- coder enhanced deep convolutional neural network for malware classi- fication,” in 2021 International Conference on Intelligent Technologies (CONIT). IEEE, 2021, pp. 1–5

    work page 2021

  7. [7]

    Zero-day ransomware attack detection using deep contractive autoencoder and voting based ensemble classifier,

    U. Zahoora, M. Rajarajan, Z. Pan, and A. Khan, “Zero-day ransomware attack detection using deep contractive autoencoder and voting based ensemble classifier,” Applied Intelligence , vol. 52, no. 12, pp. 13 941– 13 960, 2022

    work page 2022

  8. [8]

    Effective and efficient hybrid android malware classification using pseudo-label stacked auto- encoder,

    S. Mahdavifar, D. Alhadidi, and A. A. Ghorbani, “Effective and efficient hybrid android malware classification using pseudo-label stacked auto- encoder,” Journal of network and systems management , vol. 30, pp. 1–34, 2022

    work page 2022

Show all 66 references
  1. [9]

    Deep neural network based malware detection using two dimensional binary program features,

    J. Saxe and K. Berlin, “Deep neural network based malware detection using two dimensional binary program features,” in 2015 10th inter- national conference on malicious and unwanted software (MALWARE) . IEEE, 2015, pp. 11–20

    2015

  2. [10]

    Malware detection using static analysis in android: a review of feco (features, classification, and obfuscation),

    R. Jusoh, A. Firdaus, S. Anwar, M. Z. Osman, M. F. Darmawan, and M. F. Ab Razak, “Malware detection using static analysis in android: a review of feco (features, classification, and obfuscation),” PeerJ Computer Science, vol. 7, p. e522, 2021

    2021

  3. [11]

    Efficacy of nonlinear manifold learning in malware image pattern analysis,

    P. Sharma and A. Raglin, “Efficacy of nonlinear manifold learning in malware image pattern analysis,” in 2018 17th IEEE International Conference on Machine Learning and Applications (ICMLA) . IEEE, 2018, pp. 1095–1102

    2018

  4. [12]

    An adaptive hybrid pattern for noise-robust texture analysis,

    Z. Zhu, X. You, C. P. Chen, D. Tao, W. Ou, X. Jiang, and J. Zou, “An adaptive hybrid pattern for noise-robust texture analysis,” Pattern Recognition, vol. 48, no. 8, pp. 2592–2608, 2015

    2015

  5. [13]

    Relation networks for object detection,

    H. Hu, J. Gu, Z. Zhang, J. Dai, and Y . Wei, “Relation networks for object detection,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2018, pp. 3588–3597

    2018

  6. [14]

    A strings- based similarity analysis approach for characterizing iot malware and in- ferring their underlying relationships,

    S. Torabi, M. Dib, E. Bou-Harb, C. Assi, and M. Debbabi, “A strings- based similarity analysis approach for characterizing iot malware and in- ferring their underlying relationships,” IEEE Networking Letters, vol. 3, no. 3, pp. 161–165, 2021

    2021

  7. [15]

    Hadm: Hybrid analysis for detection of malware,

    L. Xu, D. Zhang, N. Jayasena, and J. Cavazos, “Hadm: Hybrid analysis for detection of malware,” in Proceedings of SAI Intelligent Systems Conference. Springer, 2016, pp. 702–724. 11

    2016

  8. [16]

    Obfuscated malware detection using deep generative model based on global/local features,

    J.-Y . Kim and S.-B. Cho, “Obfuscated malware detection using deep generative model based on global/local features,” Computers & Security, vol. 112, p. 102501, 2022

    2022

  9. [17]

    Siamese neural network based few-shot learning for anomaly detection in industrial cyber-physical systems,

    X. Zhou, W. Liang, S. Shimizu, J. Ma, and Q. Jin, “Siamese neural network based few-shot learning for anomaly detection in industrial cyber-physical systems,” IEEE Transactions on Industrial Informatics , vol. 17, no. 8, pp. 5790–5798, 2020

    2020

  10. [18]

    Dynamic prototype network based on sample adaptation for few-shot malware detection,

    Y . Chai, L. Du, J. Qiu, L. Yin, and Z. Tian, “Dynamic prototype network based on sample adaptation for few-shot malware detection,” IEEE Transactions on Knowledge and Data Engineering , 2022

    2022

  11. [19]

    Android malware obfuscation variants detection method based on multi-granularity opcode features,

    J. Tang, R. Li, Y . Jiang, X. Gu, and Y . Li, “Android malware obfuscation variants detection method based on multi-granularity opcode features,” Future Generation Computer Systems , vol. 129, pp. 141–151, 2022

    2022

  12. [20]

    A malicious android malware detection system based on implicit relationship mining,

    Z. Xu, M. Li, Y . Hei, P. Li, and J. Liu, “A malicious android malware detection system based on implicit relationship mining,” in 2021 8th IEEE International Conference on Cyber Security and Cloud Computing (CSCloud)/2021 7th IEEE International Conference on Edge Computing an...

    2021

  13. [21]

    Learning to classify: A flow- based relation network for encrypted traffic classification,

    W. Zheng, C. Gou, L. Yan, and S. Mo, “Learning to classify: A flow- based relation network for encrypted traffic classification,” in Proceed- ings of The Web Conference 2020 , 2020, pp. 13–22

    2020

  14. [22]

    Maldae: Detecting and explaining malware based on correlation and fusion of static and dynamic characteristics,

    W. Han, J. Xue, Y . Wang, L. Huang, Z. Kong, and L. Mao, “Maldae: Detecting and explaining malware based on correlation and fusion of static and dynamic characteristics,” computers & security , vol. 83, pp. 208–233, 2019

    2019

  15. [23]

    Behavior-based detection and classification of malicious software utilizing structural characteristics of group sequence graphs,

    S. D. Nikolopoulos and I. Polenakis, “Behavior-based detection and classification of malicious software utilizing structural characteristics of group sequence graphs,” Journal of Computer Virology and Hacking Techniques, pp. 1–24, 2022

    2022

  16. [24]

    A graph-based model for malicious software detection exploiting domination relations between system-call groups,

    A. Mpanti, S. D. Nikolopoulos, and I. Polenakis, “A graph-based model for malicious software detection exploiting domination relations between system-call groups,” in Proceedings of the 19th International Conference on Computer Systems and Technologies , 2018, pp. 20–26

    2018

  17. [25]

    Malinsight: A systematic profiling based malware detection framework,

    W. Han, J. Xue, Y . Wang, Z. Liu, and Z. Kong, “Malinsight: A systematic profiling based malware detection framework,” Journal of Network and Computer Applications, vol. 125, pp. 236–250, 2019

    2019

  18. [26]

    A hybrid machine learning approach for malicious behaviour detection and recognition in cloud computing,

    M. Rabbani, Y . L. Wang, R. Khoshkangini, H. Jelodar, R. Zhao, and P. Hu, “A hybrid machine learning approach for malicious behaviour detection and recognition in cloud computing,” Journal of Network and Computer Applications, vol. 151, p. 102507, 2020

    2020

  19. [27]

    Countering cyber threats for industrial applications: An automated approach for malware evasion detection and analysis,

    M. Noor, H. Abbas, and W. B. Shahid, “Countering cyber threats for industrial applications: An automated approach for malware evasion detection and analysis,” Journal of Network and Computer Applications, vol. 103, pp. 249–261, 2018

    2018

  20. [28]

    Ransomware early detection by the analysis of file sharing traffic,

    D. Morato, E. Berrueta, E. Maga ˜na, and M. Izal, “Ransomware early detection by the analysis of file sharing traffic,” Journal of Network and Computer Applications, vol. 124, pp. 14–32, 2018

    2018

  21. [29]

    A mobile malware detection method using behavior features in network traffic,

    S. Wang, Z. Chen, Q. Yan, B. Yang, L. Peng, and Z. Jia, “A mobile malware detection method using behavior features in network traffic,” Journal of Network and Computer Applications , vol. 133, pp. 15–25, 2019

    2019

  22. [30]

    A hybrid approach of mobile malware detection in android,

    F. Tong and Z. Yan, “A hybrid approach of mobile malware detection in android,” Journal of Parallel and Distributed computing , vol. 103, pp. 22–31, 2017

    2017

  23. [31]

    A comparison of static, dynamic, and hybrid analysis for malware detection,

    A. Damodaran, F. D. Troia, C. A. Visaggio, T. H. Austin, and M. Stamp, “A comparison of static, dynamic, and hybrid analysis for malware detection,” Journal of Computer Virology and Hacking Techniques , vol. 13, no. 1, pp. 1–12, 2017

    2017

  24. [32]

    Ai-hydra: Advanced hybrid approach using random forest and deep learning for malware classification,

    S. Yoo, S. Kim, S. Kim, and B. B. Kang, “Ai-hydra: Advanced hybrid approach using random forest and deep learning for malware classification,” Information Sciences, vol. 546, pp. 420–435, 2021

    2021

  25. [33]

    An investigation of byte n-gram features for malware classification,

    E. Raff, R. Zak, R. Cox, J. Sylvester, P. Yacci, R. Ward, A. Tracy, M. McLean, and C. Nicholas, “An investigation of byte n-gram features for malware classification,” Journal of Computer Virology and Hacking Techniques, vol. 14, no. 1, pp. 1–20, 2018

    2018

  26. [34]

    Ensemble model ransomware classification: A static analysis-based approach,

    S. Johnson, R. Gowtham, and A. R. Nair, “Ensemble model ransomware classification: A static analysis-based approach,” in Inventive Computa- tion and Information Technologies . Springer, 2022, pp. 153–167

    2022

  27. [35]

    Android malware classification method: Dalvik bytecode frequency analysis,

    B. Kang, B. Kang, J. Kim, and E. G. Im, “Android malware classification method: Dalvik bytecode frequency analysis,” in Proceedings of the 2013 research in adaptive and convergent systems , 2013, pp. 349–350

    2013

  28. [36]

    Malware images: visualization and automatic classification,

    L. Nataraj, S. Karthikeyan, G. Jacob, and B. S. Manjunath, “Malware images: visualization and automatic classification,” in Proceedings of the 8th international symposium on visualization for cyber security , 2011, pp. 1–7

    2011

  29. [37]

    Visdroid: Android malware classification based on local and global image features, bag of visual words and machine learning techniques,

    K. Bakour and H. M. ¨Unver, “Visdroid: Android malware classification based on local and global image features, bag of visual words and machine learning techniques,” Neural Computing and Applications , vol. 33, no. 8, pp. 3133–3153, 2021

    2021

  30. [38]

    Hybrid malware detection based on bi-lstm and spp-net for smart iot,

    J. Jeon, B. Jeong, S. Baek, and Y .-S. Jeong, “Hybrid malware detection based on bi-lstm and spp-net for smart iot,” IEEE Transactions on Industrial Informatics, vol. 18, no. 7, pp. 4830–4837, 2021

    2021

  31. [39]

    Survey for detection and anal- ysis of android malware (s) through artificial intelligence techniques,

    S. Sharma, K. Khanna, and P. Ahlawat, “Survey for detection and anal- ysis of android malware (s) through artificial intelligence techniques,” in Cyber Security and Digital Forensics. Springer, 2022, pp. 321–337

    2022

  32. [40]

    A cloud- based platform for the emulation of complex cybersecurity scenarios,

    A. Furfaro, A. Piccolo, A. Parise, L. Argento, and D. Sacca, “A cloud- based platform for the emulation of complex cybersecurity scenarios,” Future Generation Computer Systems , vol. 89, pp. 791–803, 2018

    2018

  33. [41]

    Using virtual environments for the assessment of cybersecurity issues in iot scenarios,

    A. Furfaro, L. Argento, A. Parise, and A. Piccolo, “Using virtual environments for the assessment of cybersecurity issues in iot scenarios,” Simulation Modelling Practice and Theory , vol. 73, pp. 43–54, 2017

    2017

  34. [42]

    Malware detection through low-level features and stacked denoising autoencoders

    A. De Paola, S. Favaloro, S. Gaglio, G. L. Re, and M. Morana, “Malware detection through low-level features and stacked denoising autoencoders.” in ITASEC, 2018

    2018

  35. [43]

    Effective android malware detection with a hybrid model based on deep autoencoder and convolutional neural network,

    W. Wang, M. Zhao, and J. Wang, “Effective android malware detection with a hybrid model based on deep autoencoder and convolutional neural network,” Journal of Ambient Intelligence and Humanized Computing , vol. 10, no. 8, pp. 3035–3043, 2019

    2019

  36. [44]

    Zero-day malware detection using transferred generative adversarial networks based on deep autoencoders,

    J.-Y . Kim, S.-J. Bu, and S.-B. Cho, “Zero-day malware detection using transferred generative adversarial networks based on deep autoencoders,” Information Sciences, vol. 460, pp. 83–102, 2018

    2018

  37. [45]

    Mpsautodetect: A malicious powershell script detection model based on stacked denoising auto-encoder,

    A. Alahmadi, N. Alkhraan, and W. BinSaeedan, “Mpsautodetect: A malicious powershell script detection model based on stacked denoising auto-encoder,” Computers & Security , vol. 116, p. 102658, 2022

    2022

  38. [46]

    Bm3d and deep image prior based denoising for the defense against adversarial attacks on malware detection net- works,

    K. Sandra and S.-H. Lee, “Bm3d and deep image prior based denoising for the defense against adversarial attacks on malware detection net- works,” International journal of advanced smart convergence , vol. 10, no. 3, pp. 163–171, 2021

    2021

  39. [47]

    Advanced obfuscation techniques for java bytecode,

    J.-T. Chan and W. Yang, “Advanced obfuscation techniques for java bytecode,” Journal of systems and software , vol. 71, no. 1-2, pp. 1–10, 2004

    2004

  40. [48]

    Evaluation of android anti-malware techniques against dalvik bytecode obfuscation,

    P. Faruki, A. Bharmal, V . Laxmi, M. S. Gaur, M. Conti, and M. Ra- jarajan, “Evaluation of android anti-malware techniques against dalvik bytecode obfuscation,” in 2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications . IEEE, 20...

    2014

  41. [49]

    A study of detecting computer viruses in real-infected files in the n-gram representation with machine learning methods,

    T. Stibor, “A study of detecting computer viruses in real-infected files in the n-gram representation with machine learning methods,” in Inter- national Conference on Industrial, Engineering and Other Applications of Applied Intelligent Systems . Springer, 2010, pp. 509–519

    2010

  42. [50]

    A comparative study on op- timization, obfuscation, and deobfuscation tools in android

    G. You, G. Kim, S.-j. Cho, and H. Han, “A comparative study on op- timization, obfuscation, and deobfuscation tools in android.” J. Internet Serv. Inf. Secur., vol. 11, no. 1, pp. 2–15, 2021

    2021

  43. [51]

    Entropy based local binary pattern (elbp) feature extraction technique of multimodal biometrics as defence mechanism for cloud storage,

    B. S. Vidya and E. Chandra, “Entropy based local binary pattern (elbp) feature extraction technique of multimodal biometrics as defence mechanism for cloud storage,” Alexandria Engineering Journal, vol. 58, no. 1, pp. 103–114, 2019

    2019

  44. [52]

    Classification of malware by using structural entropy on convolutional neural networks,

    D. Gibert, C. Mateu, J. Planes, and R. Vicens, “Classification of malware by using structural entropy on convolutional neural networks,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 32, no. 1, 2018

    2018

  45. [53]

    An hmm and structural entropy based detector for android malware: An empirical study,

    G. Canfora, F. Mercaldo, and C. A. Visaggio, “An hmm and structural entropy based detector for android malware: An empirical study,” Computers & Security , vol. 61, pp. 1–18, 2016

    2016

  46. [54]

    Trans- forming malware behavioural dataset for deep denoising autoencoders,

    M. R. B. Shamsuddin, F. H. H. M. Ali, and M. S. B. Z. Abidin, “Trans- forming malware behavioural dataset for deep denoising autoencoders,” in IOP Conference Series: Materials Science and Engineering , vol. 769, no. 1. IOP Publishing, 2020, p. 012071

    2020

  47. [55]

    Malware detection in mo- bile environments based on autoencoders and api-images,

    G. D’Angelo, M. Ficco, and F. Palmieri, “Malware detection in mo- bile environments based on autoencoders and api-images,” Journal of Parallel and Distributed Computing , vol. 137, pp. 26–33, 2020

    2020

  48. [56]

    Music removal by convolutional denoising autoencoder in speech recognition,

    M. Zhao, D. Wang, Z. Zhang, and X. Zhang, “Music removal by convolutional denoising autoencoder in speech recognition,” in 2015 Asia-Pacific Signal and Information Processing Association Annual Summit and Conference (APSIPA) . IEEE, 2015, pp. 338–341. 12

    2015

  49. [57]

    Face recognition via deep stacked denoising sparse autoencoders (dsdsa),

    P. G ¨orgel and A. Simsek, “Face recognition via deep stacked denoising sparse autoencoders (dsdsa),” Applied Mathematics and Computation , vol. 355, 2019

    2019

  50. [58]

    Imcfn: Image-based malware classification using fine-tuned convolu- tional neural network architecture,

    D. Vasan, M. Alazab, S. Wassan, H. Naeem, B. Safaei, and Q. Zheng, “Imcfn: Image-based malware classification using fine-tuned convolu- tional neural network architecture,” Computer Networks , vol. 171, p. 107138, 2020

    2020

  51. [59]

    Mcft-cnn: Malware classification with fine-tune convolution neural networks using traditional and transfer learning in internet of things,

    S. Kumar et al. , “Mcft-cnn: Malware classification with fine-tune convolution neural networks using traditional and transfer learning in internet of things,” Future Generation Computer Systems , vol. 125, pp. 334–351, 2021

    2021

  52. [60]

    Malware image classification using one-shot learning with siamese networks,

    S.-C. Hsiao, D.-Y . Kao, Z.-Y . Liu, and R. Tso, “Malware image classification using one-shot learning with siamese networks,” Procedia Computer Science, vol. 159, pp. 1863–1871, 2019

    2019

  53. [61]

    Calculating distances between windows malware using siamese neural network embeddings,

    M. O. T. Sison, “Calculating distances between windows malware using siamese neural network embeddings,” 2021

    2021

  54. [62]

    Learning to compare: Relation network for few-shot learning,

    F. Sung, Y . Yang, L. Zhang, T. Xiang, P. H. Torr, and T. M. Hospedales, “Learning to compare: Relation network for few-shot learning,” in Proceedings of the IEEE conference on computer vision and pattern recognition, 2018, pp. 1199–1208

    2018

  55. [63]

    Reinforced similarity learning: Siamese relation networks for robust object tracking,

    D. Zhang, Z. Zheng, M. Li, X. He, T. Wang, L. Chen, R. Jia, and F. Lin, “Reinforced similarity learning: Siamese relation networks for robust object tracking,” in Proceedings of the 28th ACM International Conference on Multimedia , 2020, pp. 294–303

    2020

  56. [64]

    Learning to filter: Siamese relation network for robust tracking,

    S. Cheng, B. Zhong, G. Li, X. Liu, Z. Tang, X. Li, and J. Wang, “Learning to filter: Siamese relation network for robust tracking,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2021, pp. 4421–4431

    2021

  57. [65]

    Siam-ids: Handling class imbalance problem in intrusion detection systems using siamese neural network,

    P. Bedi, N. Gupta, and V . Jindal, “Siam-ids: Handling class imbalance problem in intrusion detection systems using siamese neural network,” Procedia Computer Science , vol. 171, pp. 780–789, 2020

    2020

  58. [66]

    Prototypical networks for few-shot learning,

    J. Snell, K. Swersky, and R. Zemel, “Prototypical networks for few-shot learning,” Advances in neural information processing systems , vol. 30, 2017. 13

    2017

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.