Pith. sign in

REVIEW 4 major objections 5 minor 129 references

Guarding Organizations Against Malware Risk: A Novel Graph-Based Malware Detection Method

T0 review · 4 major / 5 minor · reviewed 2026-08-01 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read MalGuard detects malware by learning program graphs at the level of operational roles—cohesive groups of basic blocks that only reveal malicious intent when read together.

desk verdict Genuinely new role-coarsening mechanism for graph-based malware detection, but the robustness claims are overreach because static program graphs miss packed/runtime payloads and the cited robustness evidence is actually an evasion attack paper. read the letter →

arxiv 2607.26634 v1 pith:LGKRSMDV submitted 2026-07-29 cs.CR cs.AI

Yinan Gao , Jiarong Xu , Xiaohang Zhao , Xiao Fang This is my paper · ORCID
classification cs.CRcs.AI
keywords malwaredetectionprogramgraphcontrolflowneuralnetworkoperationalrolehierarchicalevasivefalsenegativerate
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper proposes MalGuard, a graph-based malware detector that reads Windows executables as hierarchical program graphs rather than raw bytes. The paper's central claim is that malicious behavior is usually invisible in any single basic block but emerges from cohesive groups of blocks that share a computational objective—what it calls an operational role. MalGuard first infers these latent roles from each control-flow graph using a variational model, then coarsens the graph into operational subgraphs and learns a representation that models interactions among roles, preserves sparse malicious signals through attention and gated pooling, and captures the call-graph hierarchy. On a collected dataset of 1,428 malware and 7,342 benign samples, the paper reports that MalGuard outperforms byte-based and graph-based baselines in F1, AUC, and AUPRC, and lowers the expected cost of undetected malware. If true, this means representing software at the level of shared computational objectives, rather than individual blocks, makes detection both more accurate and more robust to evasion that pads non-executed byte regions.

What carries the argument

The load-bearing object is the operational subgraph: a connected component of basic blocks whose inferred role-affiliation probability exceeds a threshold. The central construction is the coarsened graph, with adjacency Asuper = B^T A B, which compresses a CFG of basic blocks into a graph of operational subgraphs, making roles rather than blocks the nodes. This is surrounded by three mechanisms: a variational role-inference module with a logit-normal posterior; an attention-based message passing layer whose weights are scaled by coarsened edge counts; and gated pooling layers at both the CFG and call-graph levels. The generative gate is what lets the model treat two similar-role blocks that

What would settle it

Build a test set of packed and self-modifying malware whose payload appears only after runtime unpacking, and compare MalGuard's AUC against the same binaries unpacked statically. A large drop would show the robustness claim depends on disassembly completeness.

Watch

Extended reading notes

Core claim

The central discovery is that operational roles—cohesive groups of basic blocks that jointly realize a shared computational objective—can be inferred automatically from a control-flow graph and then used as the unit of analysis for malware detection. MalGuard's first stage treats roles as latent variables with a multivariate logit-normal posterior and learns them by reconstructing the CFG's adjacency structure, using a learnable gate to explain absent edges between similar-role blocks that sit on different branches. Its second stage coarsens each CFG into a graph of operational subgraphs, applies attention-based message passing so interactions among roles are modeled, and uses gated pooling

Load-bearing premise

The method assumes the statically constructed control-flow and call graphs contain all executed malicious code; for packed, self-modifying, or runtime-generated malware the true payload may never appear in the graph.

Editorial extensions

If this is right

  • If the claim holds, detectors can expose malicious behavior that spans several routine-looking basic blocks, not just single blocks or local neighborhoods.
  • Because program graphs exclude non-executed regions, injecting benign-looking bytes into headers or slack space should have limited effect on detection; the paper's evasion experiments report this.
  • Operational roles are learned without manual labels, so the approach can be applied to new binaries without reverse-engineering typical behaviors.
  • Lower false-negative rates translate into lower expected breach costs; the paper estimates replacing strong baselines with MalGuard reduces modeled costs by roughly 37% to 53%.
  • Hierarchical modeling matters: removing the call-graph level drops F1 by 5.8%, and removing role identification drops it by 6.1%.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An extension the paper leaves implicit is testing on packed or self-modifying malware, where static disassembly may miss the executed payload; if robustness is to generalize, role inference would need dynamic traces or unpacking support.
  • The role-level representation may transfer beyond detection—to vulnerability discovery, binary diffing, or malware family attribution—since grouping blocks by shared objective highlights functional modules independent of the detection label.
  • The economic model is a linear proxy tied to false-negative counts; a more direct test would use incident-response cost data per malware family rather than a single average annual cost.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes MalGuard, a two-stage graph-based malware detection method for Windows PE files. Stage 1 treats 'operational roles' as latent variables associated with basic blocks in each function's CFG, trains a variational inference/generative model to reconstruct the CFG adjacency matrix, thresholds the inferred role probabilities to extract connected 'operational subgraphs,' and produces a node-to-subgraph assignment matrix. Stage 2 coarsens each CFG into a graph of operational subgraphs, applies attention-based message passing and gated pooling to obtain function representations, then applies message passing and gated pooling over the call graph to obtain a software representation for binary malware classification. The authors evaluate MalGuard on a self-collected dataset of 1,428 malware and 7,342 benign Windows PE files, comparing against byte-based (MalConv, NonNeg, DRSM) and graph-based (GCN, GAT, GIN, MAGIC, DeepCall, Mal2GCN, MalGraph) baselines. They report consistent improvements in F1, AUC, and AUPRC, ablation results supporting each component, a case study on an unpacking/decoding routine, and an economic value analysis using false-negative rates. The central claim is that operational-role identification plus role-aware hierarchical graph representation learning yields a more accurate and economically valuable graph-based PE malware detector.

Significance. If the evaluation is sound, MalGuard would be a meaningful contribution to graph-based malware detection and to the IS computational design science literature. The architecture is clearly specified, the main benchmark comparison in Table 2 is internally consistent and significance-tested, and the ablation study indicates that the role/coarsening and hierarchical components contribute to the reported gains. The two-stage training procedure and the explicit modeling of cohesive basic-block groups address a real limitation of prior CFG/CG GNN methods. However, the paper's central robustness claim is broader than what the evidence supports: program graphs are built by static disassembly (angr), which cannot capture packed, self-modifying, or runtime-generated code, and the evasion experiments only perturb non-executed byte regions. The economic value section is likewise a deterministic rescaling of the same test-set FNRs rather than an independent economic validation. These issues are fixable with additional experiments and a more careful framing, but they affect load-bearing claims.

major comments (4)
  1. [§3.2, §5.1, §5.4, Appendix C] The robustness claim that program graphs 'filter out' evasive byte injections assumes the static graph contains all executed malicious code. Section 5.1 states that graphs are constructed using angr static disassembly; static CFG/CG construction cannot recover code that is packed, encrypted, or generated at runtime. Appendix C tests only non-executed manipulations (FGSM append, slack, DOS/header field edits), never attacks on executed code and no packed samples. Section 5.4's case study is telling: the identified operational subgraph is a 'preparatory decoding stage prior to malicious payload execution,' i.e., the static graph may contain the decoder but not the decoded payload. Consequently, the reported F1/AUC/AUPRC gains and the robustness-based narrative do not yet generalize to a large class of evasive PE malware. Please either add experiments on packed/self-modifying samples (or dy
  2. [§3.2, References] The sentence 'manipulations inserted into non-executed regions ... have limited impact on the resulting graph (Peng et al., 2025)' cites Peng et al. (2025) as support, but that paper is an evasion attack that actively inserts opcodes into CFG-based GNN malware detectors while preserving maliciousness. Citing it as evidence of robustness is the opposite of what the source demonstrates. This citation should be removed or replaced with actual evidence for the non-executed-region filtering claim.
  3. [§5.5, Eqs. (26)–(27)] The economic value analysis is not an independent validation. Equation (26) defines the cost under MalGuard as the baseline cost multiplied by the ratio of test-set FNRs, so Table 4's 'cost reductions' are a deterministic monotone rescaling of the FNRs already reported in Table 2. No external cost model, uncertainty intervals, or sensitivity analysis is provided. The conclusion that MalGuard 'yields substantial economic value' should be reworded as an illustrative calculation based on the authors' linearity assumption, or supplemented with a real cost model and sensitivity analysis.
  4. [§5.1, Algorithm 1, Eq. (15)] The number of latent operational roles K is a central hyperparameter: it defines the latent role space and, with threshold τ, determines the operational subgraphs used in Stage 2. Yet Section 5.1 reports the hidden dimension, number of layers, C=0.3, and τ=0.5, but never states K. No sensitivity analysis for K (or for τ and C) is reported. Without this, the method is not reproducible and the stability of the role-extraction step is unknown. Please report K and add sensitivity experiments.
minor comments (5)
  1. [§5.2, Appendix C] The main-table significance tests are reported only by star annotations; the statistical test used (e.g., paired t-test, Wilcoxon) and number of runs are not stated. Appendix C reports AUC/AUPRC under evasion without any significance testing; since several baseline differences are small (e.g., MalGuard vs. MalGraph in FGSM Append), confidence intervals or tests would help.
  2. [§5.3, Table 3] MalGuard-OR removes both the role identification module and the role-based coarsening layer, while MalGuard-CL removes only the coarsening layer (retaining role information as node attributes). Thus the unique contribution of the latent-role identification step is not cleanly isolated from the contribution of the coarsening architecture. A variant that retains coarsening but uses a non-latent grouping (e.g., graph partitioning) would strengthen the attribution.
  3. [General] The code and dataset are not released, which limits verification of the two-stage pipeline and the exact graph construction. For an IS design-science paper this may be acceptable, but a reproducibility appendix with the exact angr settings and preprocessing code would be valuable.
  4. [§5.1] The dataset is split randomly 8:1:1; because malware was collected over a specific date range (Feb–Oct 2024), a temporal split (e.g., train on early months, test on later months) would better reflect the deployment scenario and reduce potential family-level leakage.
  5. [Figure 7] The disassembly excerpt in Figure 7 is difficult to read and appears to contain repeated/garbled byte sequences. A cleaner formatted listing or a zoomed-in figure would improve the case study's readability.

Circularity Check

1 steps flagged · score 2.0 of 10

Central detection benchmark is independent; only the economic-value claim reduces to a rescaling of the same test FNRs.

  1. other [Section 5.5, Equations (26)-(27) and Table 4]
    "Assuming that the total cost is approximately proportional to the number of false negatives (i.e., malware mistakenly classified as benign), we have: Cost_ours = Cost_baseline · FNR_ours / FNR_baseline"

    The cost reduction in Eq. (27) is exactly 1 − FNR_ours/FNR_baseline, so Table 4's 'cost reductions' are a monotone linear rescaling of the same test-set FNRs already reported in the detection benchmark (Table 2), under an assumed proportionality. They supply no independent evidence and cannot be wrong if the detection evaluation is accepted. This is a secondary, definitional corollary rather than a separate empirical result; it does not affect the validity of the main detection claim.

full rationale

The central derivation is not circular. Stage 1 infers operational roles by maximizing an ELBO over CFG adjacency reconstruction (Eq. 12) without using malware labels; Stage 2 trains the detector with binary cross-entropy on labels (Eq. 25). The benchmark compares MalGuard against external byte-based and graph-based baselines on a held-out split, so the reported F1/AUC/AUPRC improvements are empirical rather than forced by construction. The only mild circularity is the economic-value analysis, which converts the same test-set FNRs into dollar savings under an assumed linear proportionality; it is an algebraic corollary, not an independent measurement. Self-citations are present but not load-bearing: Fang et al. (2025), a co-authored working paper, is cited only to situate the computational design science paradigm, and the method itself is not justified by that citation. There are separate correctness risks that are not circularity: the robustness premise that angr static CFG/CG construction captures all executed malicious code is untested for packed/self-modifying malware, Section 3.2 cites Peng et al. (2025) for a robustness claim although that paper is an evasion attack on CFG-based GNN detectors, and Appendix C perturbs only non-executed byte regions. Algorithm 1 also trains Stage 1 on CFGs without an explicitly described train/test split, a potential transductive-leakage concern. These concerns lower confidence in generalization but do not make the derivation circular. Overall, the central detection result stands on its own empirical evaluation; the circularity residue is confined to the secondary cost-savings presentation.

Assumptions & free parameters 4 free parameters · 6 assumptions · 2 invented entities

MalGuard's central detection claim is empirical and depends on a static graph-extraction pipeline, a latent-role reconstruction objective, hand-set thresholds (K, tau, C), and a simplified economic model. The role concept itself is invented in this paper and has no independent external evidence beyond downstream performance and one case study.

free parameters (4)
  • K (number of latent operational roles)
    Not reported in the implementation details; the illustrative example uses K=4. It controls the dimensionality of role assignments and is validated only implicitly through downstream detection.
  • tau (role assignment threshold) = 0.5
    Set by hand in Section 5.1; determines which nodes enter operational subgraphs.
  • C (edge absence fallback) = 0.3
    Fixed in Section 5.1; tunes how absent edges between similar-role nodes are explained.
  • Standard training hyperparameters = d=128, L=2, lr=1e-3, batch=64, early stopping
    Chosen in Section 5.1 without sensitivity analysis; they affect the reported scores but are not the claimed novelty.
assumptions (6)
  • domain assumption Static disassembly with angr yields CFGs and CGs that cover all executed malicious behavior.
    Used to construct hierarchical program graphs in Sections 3.2 and 5.1; fails for packed, self-modifying, or runtime-generated code.
  • ad hoc to paper Operational roles exist as cohesive groups of basic blocks with shared computational objectives and are recoverable from CFG reconstruction.
    The generative objective in Section 4.1.3 assumes latent role structure is encoded in adjacency reconstruction; no independent external validation is provided.
  • domain assumption VirusTotal/ground-truth labels are trustworthy after removing 24 inconsistent instances.
    Section 5.1 relies on this for all training and evaluation labels.
  • domain assumption The 13 hand-crafted instruction-statistic features are sufficient node attributes.
    Section 5.1 initializes CFG node attributes with these counts, treating them as adequate for malware detection.
  • ad hoc to paper Economic loss scales linearly with the false-negative rate, using a single external cost constant.
    Section 5.5 assumes Cost is proportional to FNR and fixes the baseline cost at $2,613,952 from one Accenture report.
  • standard math Mean-field variational approximation with a logit-normal prior is adequate for posterior inference over operational roles.
    Section 4.1.2 adopts standard variational inference machinery; the approximation quality is not empirically assessed.
invented entities (2)
  • operational role
    purpose: Latent grouping of basic blocks that jointly realize a computational objective; enables role-aware coarsening and detection.
    No external falsifiable handle; supported only by downstream detection gains and one interpretive case study in Section 5.4.
  • operational subgraph
    purpose: Connected component of role-thresholded nodes used as super-nodes in the coarsened graph.
    Derived from the invented operational roles; no independent validation outside the paper.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Guarding Organizations Against Malware Risk: A Novel Graph-Based Malware Detection Method." pith.science (2026). https://pith.science/paper/LGKRSMDV

@misc{pith2026260726634,
  author       = {Pith},
  title        = {Pith review of: Guarding Organizations Against Malware Risk: A Novel Graph-Based Malware Detection Method},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LGKRSMDV}},
  note         = {Machine review of arXiv:2607.26634}
}
read the original abstract

Organizational digitalization expands cybersecurity risks, making cybersecurity an increasingly important research area in Information Systems (IS). Among these risks, malware has become a pervasive and destructive threat. Byte-based machine learning (ML) methods are widely used for malware detection but remain vulnerable to evasive behaviors that manipulate raw bytes to evade detection. Graph-based methods are less affected by such manipulations because they represent software as program graphs that capture execution behavior. However, they do not explicitly identify cohesive groups of basic blocks that jointly realize meaningful program behaviors, nor do they learn sufficiently expressive program graph representations for accurate detection. To this end, we propose MalGuard, a graph-based malware detection method for organizational malware risk management. MalGuard introduces two methodological innovations: an operational role identification approach and a program graph representation learning method. The former identifies these cohesive groups of basic blocks as operational roles, enabling the detector to capture program behaviors that may not be visible from isolated basic blocks. The latter learns expressive program graph representations by modeling interactions among operational roles, preserving sparse malicious signals, and capturing hierarchical graph structure. Extensive experiments show that MalGuard improves detection performance and reduces the expected cost of undetected malware.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

129 extracted references · 2 linked inside Pith

  1. [1]

    Information Systems Research , volume=

    Pathways for design research on artificial intelligence , author=. Information Systems Research , volume=. 2024 , publisher=

    2024

  2. [2]

    MIS Quarterly , volume=

    Machine learning in information systems research , author=. MIS Quarterly , volume=

  3. [3]

    Available at SSRN 5455094 , year=

    Computational Design Science: A Critical Information Systems Research Area Contributing to Artificial Intelligence and Data Science , author=. Available at SSRN 5455094 , year=

  4. [4]

    MIS Quarterly , volume=

    Complexity is the worst enemy of security: Studying cybersecurity through the lens of organizational complexity , author=. MIS Quarterly , volume=

  5. [5]

    MIS Quarterly , volume=

    United we stand, divided we fall: An autogenic perspective on empowering cybersecurity in organizations , author=. MIS Quarterly , volume=

  6. [6]

    MIS Quarterly , volume=

    See no evil, hear no evil? dissecting the impact of online hacker forums , author=. MIS Quarterly , volume=

  7. [7]

    MIS Quarterly , volume=

    Discovering emerging threats in the hacker community: A nonparametric emerging topic detection framework , author=. MIS Quarterly , volume=

  8. [8]

    MIS Quarterly , volume=

    DICE-E: A framework for conducting Darknet identification, collection, evaluation with ethics , author=. MIS Quarterly , volume=

Show all 129 references
  1. [9]

    MIS Quarterly , volume=

    Creating proactive cyber threat intelligence with hacker exploit labels: A deep transfer learning approach , author=. MIS Quarterly , volume=

  2. [10]

    MIS Quarterly , volume=

    Linking exploits from the dark web to known vulnerabilities for proactive cyber threat intelligence: An attention-based deep structured semantic model , author=. MIS Quarterly , volume=

  3. [11]

    MIS Quarterly , volume=

    Cross-lingual cybersecurity analytics in the international dark web with adversarial deep representation learning , author=. MIS Quarterly , volume=

  4. [12]

    Information Systems Research , volume=

    The phishing funnel model: A design artifact to predict user susceptibility to phishing websites , author=. Information Systems Research , volume=. 2021 , publisher=

    2021

  5. [13]

    Information Systems Research , volume=

    Dynamics of shared security in the cloud , author=. Information Systems Research , volume=. 2025 , publisher=

    2025

  6. [14]

    MIS Quarterly , volume=

    Avoidance of information technology threats: A theoretical perspective , author=. MIS Quarterly , volume=

  7. [15]

    MIS Quarterly , volume=

    Practicing Safe Computing: A Multimethod Empirical Examination of Home Computer User Security Behavioral Intentions , author=. MIS Quarterly , volume=

  8. [16]

    MIS Quarterly , volume=

    Information security policy compliance: an empirical study of rationality-based beliefs and information security Awareness , author=. MIS Quarterly , volume=. 2010 , publisher=

    2010

  9. [17]

    MIS Quarterly , volume=

    Seeing the Forest and the Trees: A Meta-Analysis of the Antecedents to Information Security Policy Compliance , author=. MIS Quarterly , volume=. 2019 , publisher=

    2019

  10. [18]

    Information Systems Research , volume=

    Cloud implications on software network structure and security risks , author=. Information Systems Research , volume=. 2014 , publisher=

    2014

  11. [19]

    Information Systems Research , volume=

    ``Extortionality'' in ransomware attacks: A microeconomic study of extortion and externality , author=. Information Systems Research , volume=. 2026 , publisher=

    2026

  12. [20]

    Information Systems Research , volume=

    Software diversity for improved network security: Optimal distribution of software-based shared vulnerabilities , author=. Information Systems Research , volume=. 2017 , publisher=

    2017

  13. [21]

    What users do besides problem-focused coping when facing

    Liang, Huigang and Xue, Yajiong and Pinsonneault, Alain and Wu, Yu ``Andy'' , journal=. What users do besides problem-focused coping when facing

  14. [22]

    MIS Quarterly , volume=

    Toward a Unified Model of Information Security Policy Compliance , author=. MIS Quarterly , volume=. 2018 , publisher=

    2018

  15. [23]

    Information technology and organizational performance: An integrative model of

    Melville, Nigel and Kraemer, Kenneth and Gurbaxani, Vijay , journal=. Information technology and organizational performance: An integrative model of

  16. [24]

    Where is

    Li, Wilson Weixun and Leung, Alvin Chung Man and Yue, Wei Thoo , journal=. Where is

  17. [25]

    Journal of Management Information Systems , volume=

    Impact of network structure on malware propagation: A growth curve perspective , author=. Journal of Management Information Systems , volume=

  18. [26]

    MIS Quarterly , volume=

    The impact of malicious agents on the enterprise software industry , author=. MIS Quarterly , volume=

  19. [27]

    Management Science , volume=

    Economics of ransomware: Risk interdependence and large-scale attacks , author=. Management Science , volume=. 2022 , publisher=

    2022

  20. [28]

    2025 , publisher=

    Ebrahimi, Reza and Chai, Yidong and Li, Weifeng and Pacheco, Jason and Chen, Hsinchun , journal=. 2025 , publisher=

    2025

  21. [29]

    MIS Quarterly , volume=

    Differential effects of prior experience on the malware resolution process , author=. MIS Quarterly , volume=

  22. [30]

    Workshops at the thirty-second AAAI conference on artificial intelligence , year=

    Malware detection by eating a whole exe , author=. Workshops at the thirty-second AAAI conference on artificial intelligence , year=

  23. [31]

    2022 , organization=

    Ling, Xiang and Wu, Lingfei and Deng, Wei and Qu, Zhenqing and Zhang, Jiangyu and Zhang, Sheng and Ma, Tengfei and Wang, Bin and Wu, Chunming and Ji, Shouling , booktitle=. 2022 , organization=

    2022

  24. [32]

    Saha, Shoumik and Wang, Wenxiao and Kaya, Yigitcan and Feizi, Soheil and Dumitras, Tudor , booktitle=

  25. [33]

    AAAI-2019 Workshop on Artificial Intelligence for Cyber Security , year=

    Non-negative networks against adversarial attacks , author=. AAAI-2019 Workshop on Artificial Intelligence for Cyber Security , year=

    2019

  26. [34]

    Journal of Information Security , volume=

    Malware analysis and classification: A survey , author=. Journal of Information Security , volume=. 2014 , publisher=

    2014

  27. [35]

    Computers & Security , volume=

    Survey of machine learning techniques for malware analysis , author=. Computers & Security , volume=. 2019 , publisher=

    2019

  28. [36]

    Adversarial attacks against

    Ling, Xiang and Wu, Lingfei and Zhang, Jiangyu and Qu, Zhenqing and Deng, Wei and Chen, Xiang and Qian, Yaguan and Wu, Chunming and Ji, Shouling and Luo, Tianyue and others , journal=. Adversarial attacks against. 2023 , publisher=

    2023

  29. [37]

    IEEE Transactions on Information Forensics and Security , volume=

    On the dissection of evasive malware , author=. IEEE Transactions on Information Forensics and Security , volume=. 2020 , publisher=

    2020

  30. [38]

    Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security , pages=

    Scalable graph-based bug search for firmware images , author=. Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security , pages=

    2016

  31. [39]

    Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security , pages=

    Neural network-based graph embedding for cross-platform binary code similarity detection , author=. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security , pages=

    2017

  32. [40]

    Proceedings of the 35th IEEE/ACM International Conference on Automated Software Engineering , pages=

    On benign features in malware detection , author=. Proceedings of the 35th IEEE/ACM International Conference on Automated Software Engineering , pages=

  33. [41]

    23rd USENIX Security Symposium (USENIX Security 14) , pages=

    \ BareCloud \ : Bare-metal analysis-based evasive malware detection , author=. 23rd USENIX Security Symposium (USENIX Security 14) , pages=

  34. [42]

    A Survey of strategy-driven evasion methods for

    Geng, Jiaxuan and Wang, Junfeng and Fang, Zhiyang and Zhou, Yingjie and Wu, Di and Ge, Wenhan , journal=. A Survey of strategy-driven evasion methods for. 2024 , publisher=

    2024

  35. [43]

    IEEE Transactions on Dependable and Secure Computing , volume=

    Learning contextualized action representations in sequential decision making for adversarial malware optimization , author=. IEEE Transactions on Dependable and Secure Computing , volume=. 2024 , publisher=

    2024

  36. [44]

    Computers & Security , volume=

    A survey on technical threat intelligence in the age of sophisticated cyber attacks , author=. Computers & Security , volume=. 2018 , publisher=

    2018

  37. [45]

    2021 IEEE International Conference on Intelligence and Security Informatics (ISI) , pages=

    Single-shot black-box adversarial attacks against malware detectors: A causal language model approach , author=. 2021 IEEE International Conference on Intelligence and Security Informatics (ISI) , pages=. 2021 , organization=

    2021

  38. [46]

    2021, AAAI workshop on Robust, Secure and Efficient Machine Learning (RSEML) , year=

    Binary black-box evasion attacks against deep learning-based static malware detectors with adversarial byte-level language model , author=. 2021, AAAI workshop on Robust, Secure and Efficient Machine Learning (RSEML) , year=

    2021

  39. [47]

    Functionality-preserving black-box optimization of adversarial

    Demetrio, Luca and Biggio, Battista and Lagorio, Giovanni and Roli, Fabio and Armando, Alessandro , journal=. Functionality-preserving black-box optimization of adversarial. 2021 , publisher=

    2021

  40. [48]

    Adversarial

    Demetrio, Luca and Coull, Scott E and Biggio, Battista and Lagorio, Giovanni and Armando, Alessandro and Roli, Fabio , journal=. Adversarial. 2021 , publisher=

    2021

  41. [49]

    Proceedings of the 36th International Conference on Software Engineering , pages=

    Checking app behavior against app descriptions , author=. Proceedings of the 36th International Conference on Software Engineering , pages=

  42. [50]

    IEEE Transactions on Software Engineering , volume=

    On the value of static analysis for fault detection in software , author=. IEEE Transactions on Software Engineering , volume=. 2006 , publisher=

    2006

  43. [51]

    Proceedings 2001 IEEE Symposium on Security and Privacy

    Data mining methods for detection of new malicious executables , author=. Proceedings 2001 IEEE Symposium on Security and Privacy. S&P 2001 , pages=. 2000 , organization=

    2001

  44. [52]

    Proceedings of the tenth ACM SIGKDD International Conference on Knowledge Discovery and Data Mining , pages=

    Learning to detect malicious executables in the wild , author=. Proceedings of the tenth ACM SIGKDD International Conference on Knowledge Discovery and Data Mining , pages=

  45. [53]

    Anderson, Hyrum S and Roth, Phil , journal=

  46. [54]

    ACM Computing Surveys , volume=

    A survey on malware detection using data mining techniques , author=. ACM Computing Surveys , volume=. 2017 , publisher=

    2017

  47. [55]

    Ye, Yanfang and Wang, Dingding and Li, Tao and Ye, Dongyi , booktitle=

  48. [56]

    arXiv preprint arXiv:1802.04528 , year=

    Deceiving end-to-end deep learning malware detectors using adversarial examples , author=. arXiv preprint arXiv:1802.04528 , year=

    arXiv

  49. [57]

    2019 IEEE Security and Privacy Workshops (SPW) , pages=

    Exploring adversarial examples in malware detection , author=. 2019 IEEE Security and Privacy Workshops (SPW) , pages=. 2019 , organization=

    2019

  50. [58]

    Proceedings of the Third Italian Conference on Cyber Security , series=

    Explaining vulnerabilities of deep learning to adversarial malware binaries , author=. Proceedings of the Third Italian Conference on Cyber Security , series=

  51. [59]

    ACM Computing Surveys , volume=

    Malware dynamic analysis evasion techniques: A survey , author=. ACM Computing Surveys , volume=. 2019 , publisher=

    2019

  52. [60]

    Computers & Security , volume=

    AMAL: high-fidelity, behavior-based automated malware analysis and classification , author=. Computers & Security , volume=. 2015 , publisher=

    2015

  53. [61]

    2023 , organization=

    Chen, Yanhui and Feng, Yun and Wang, Chengchun and Zhao, Jianjun and Liu, Qixu , booktitle=. 2023 , organization=

    2023

  54. [62]

    2024 , publisher=

    Kargarnovin, Omid and Sadeghzadeh, Amir Mahdi and Jalili, Rasool , journal=. 2024 , publisher=

    2024

  55. [63]

    ACM Computing Surveys , volume=

    Ransomware reloaded: Re-examining its trend, research and mitigation in the era of data exfiltration , author=. ACM Computing Surveys , volume=. 2024 , publisher=

    2024

  56. [64]

    Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security , pages=

    Malgene: Automatic extraction of malware analysis evasion signature , author=. Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security , pages=

  57. [65]

    A systematical and longitudinal study of evasive behaviors in

    Galloro, Nicola and Polino, Mario and Carminati, Michele and Continella, Andrea and Zanero, Stefano , journal=. A systematical and longitudinal study of evasive behaviors in. 2022 , publisher=

    2022

  58. [66]

    IEEE Security & Privacy , volume=

    Using entropy analysis to find encrypted and packed malware , author=. IEEE Security & Privacy , volume=. 2007 , publisher=

    2007

  59. [67]

    Proceedings of the 22nd Annual Computer Security Applications Conference , pages=

    Polyunpack: Automating the hidden-code extraction of unpack-executing malware , author=. Proceedings of the 22nd Annual Computer Security Applications Conference , pages=. 2006 , organization=

    2006

  60. [68]

    Proceedings of the 12th USENIX Security Symposium , pages=

    Static analysis of executables to detect malicious patterns , author=. Proceedings of the 12th USENIX Security Symposium , pages=

  61. [69]

    Lost in the loader: The many faces of the

    Nisi, Dario and Graziano, Mariano and Fratantonio, Yanick and Balzarotti, Davide , booktitle=. Lost in the loader: The many faces of the

  62. [70]

    Proceedings of the 8th International Symposium on Visualization for Cyber Security , pages=

    Malware images: Visualization and automatic classification , author=. Proceedings of the 8th International Symposium on Visualization for Cyber Security , pages=

  63. [71]

    Security and Communication Networks , volume=

    Detecting malware with an ensemble method based on deep neural network , author=. Security and Communication Networks , volume=. 2018 , publisher=

    2018

  64. [72]

    2019 49th annual IEEE/IFIP International Conference on Dependable Systems and Networks , pages=

    Classifying malware represented as control flow graphs using deep graph convolutional neural network , author=. 2019 49th annual IEEE/IFIP International Conference on Dependable Systems and Networks , pages=. 2019 , organization=

    2019

  65. [73]

    2024 , publisher=

    Feng, Pengbin and Gai, Le and Yang, Li and Wang, Qin and Li, Teng and Xi, Ning and Ma, Jianfeng , journal=. 2024 , publisher=

    2024

  66. [74]

    Proceedings of the 32nd AAAI Conference on Artificial Intelligence , volume=

    An end-to-end deep learning architecture for graph classification , author=. Proceedings of the 32nd AAAI Conference on Artificial Intelligence , volume=

  67. [75]

    Emerging Threats and Countermeasures in Cybersecurity , pages=

    Class-imbalanced problems in malware analysis and detection in classification algorithms , author=. Emerging Threats and Countermeasures in Cybersecurity , pages=. 2025 , publisher=

    2025

  68. [76]

    2023 , url =

    VirusTotal , title =. 2023 , url =

    2023

  69. [77]

    Static Analyzer of Vicious Executables (

    Sung, AH and Xu, J and Chavez, P and Mukkamala, S , booktitle=. Static Analyzer of Vicious Executables (

  70. [78]

    IEEE Transactions on Dependable and Secure Computing , volume=

    Deep learning and visualization for identifying malware families , author=. IEEE Transactions on Dependable and Secure Computing , volume=. 2018 , publisher=

    2018

  71. [79]

    ACM Computing Surveys , volume=

    A survey on malware detection with graph representation learning , author=. ACM Computing Surveys , volume=. 2024 , publisher=

    2024

  72. [80]

    AI 2016: Advances in Artificial Intelligence: 29th Australasian Joint Conference, Hobart, TAS, Australia, December 5-8, 2016, Proceedings 29 , pages=

    Deep learning for classification of malware system call sequences , author=. AI 2016: Advances in Artificial Intelligence: 29th Australasian Joint Conference, Hobart, TAS, Australia, December 5-8, 2016, Proceedings 29 , pages=. 2016 , organization=

    2016

  73. [81]

    IEEE Transactions on Dependable and Secure Computing , volume=

    Control flow-based malware variant detection , author=. IEEE Transactions on Dependable and Secure Computing , volume=. 2013 , publisher=

    2013

  74. [82]

    arXiv preprint arXiv:2504.20904 , year=

    Dual Explanations via Subgraph Matching for Malware Detection , author=. arXiv preprint arXiv:2504.20904 , year=

    arXiv

  75. [83]

    Proceedings of the Third International Conference on Detection of Intrusions and Malware and Vulnerability Assessment , pages=

    Detecting self-mutating malware using control-flow graph matching , author=. Proceedings of the Third International Conference on Detection of Intrusions and Malware and Vulnerability Assessment , pages=. 2006 , organization=

    2006

  76. [84]

    Evading control flow graph based

    Peng, Hao and Yu, Zehao and Zhao, Dandan and Ding, Zhiguo and Yang, Jieshuai and Zhang, Bo and Han, Jianming and Zhang, Xuhong and Ji, Shouling and Zhong, Ming , journal=. Evading control flow graph based. 2025 , publisher=

    2025

  77. [85]

    Applied Sciences , volume=

    Reducing false negatives in ransomware detection: A critical evaluation of machine learning algorithms , author=. Applied Sciences , volume=. 2022 , publisher=

    2022

  78. [86]

    2024 , organization=

    Ami, Amit Seal and Moran, Kevin and Poshyvanyk, Denys and Nadkarni, Adwait , booktitle=. 2024 , organization=

    2024

  79. [87]

    2025 , url =

    Microsoft , title =. 2025 , url =

    2025

  80. [88]

    MSDN Magazine, March , year=

    An in-depth look into the Win32 portable executable file format, part 2 , author=. MSDN Magazine, March , year=

  81. [89]

    Information and Software Technology , volume=

    Program analysis via graph reachability , author=. Information and Software Technology , volume=. 1998 , publisher=

    1998

  82. [90]

    IEEE Transactions on Software Engineering , pages=

    Constructing the call graph of a program , author=. IEEE Transactions on Software Engineering , pages=. 1979 , publisher=

    1979

  83. [91]

    ACM Sigplan Notices , volume=

    Control flow analysis , author=. ACM Sigplan Notices , volume=. 1970 , publisher=

    1970

  84. [92]

    IEEE Transactions on Software Engineering , volume=

    Model-based performance prediction in software development: A survey , author=. IEEE Transactions on Software Engineering , volume=. 2004 , publisher=

    2004

  85. [93]

    2021 , url=

    Daya Guo and Shuo Ren and Shuai Lu and Zhangyin Feng and Duyu Tang and Shujie LIU and Long Zhou and Nan Duan and Alexey Svyatkovskiy and Shengyu Fu and Michele Tufano and Shao Kun Deng and Colin Clement and Dawn Drain and Neel Sundaresan and Jian Yin and Daxin Jiang and Ming Z...

    2021

  86. [94]

    Proceedings of the Eighth Australasian Symposium on Parallel and Distributed Computing-Volume 107 , pages=

    Classification of malware using structured control flow , author=. Proceedings of the Eighth Australasian Symposium on Parallel and Distributed Computing-Volume 107 , pages=. 2010 , organization=

    2010

  87. [95]

    The Computer Journal , volume=

    Annotated control flow graph for metamorphic malware detection , author=. The Computer Journal , volume=. 2015 , publisher=

    2015

  88. [96]

    2007 , publisher=

    Compilers principles, techniques & tools , author=. 2007 , publisher=

    2007

  89. [97]

    Advances in Artificial Intelligence and Machine Learning , volume=

    Empirical network structure of malicious programs , author=. Advances in Artificial Intelligence and Machine Learning , volume=. 2024 , doi=

    2024

  90. [98]

    ACM Computing Surveys , volume=

    A survey of binary code similarity , author=. ACM Computing Surveys , volume=. 2021 , publisher=

    2021

  91. [99]

    International Conference on Learning Representations , year=

    Semi-Supervised Classification with Graph Convolutional Networks , author=. International Conference on Learning Representations , year=

  92. [100]

    Proceedings of the 31st International Conference on Neural Information Processing Systems , pages=

    Inductive representation learning on large graphs , author=. Proceedings of the 31st International Conference on Neural Information Processing Systems , pages=

  93. [101]

    International Conference on Learning Representations , year=

    Graph Attention Networks , author=. International Conference on Learning Representations , year=

  94. [102]

    International Conference on Learning Representations , year=

    How Powerful are Graph Neural Networks? , author=. International Conference on Learning Representations , year=

  95. [103]

    Proceedings of the NIPS Workshop on Bayesian Deep Learning , year=

    Variational Graph Auto-Encoders , author=. Proceedings of the NIPS Workshop on Bayesian Deep Learning , year=

  96. [104]

    Proceedings of the 34th International Conference on Neural Information Processing Systems , volume=

    Dirichlet Graph Variational Autoencoder , author=. Proceedings of the 34th International Conference on Neural Information Processing Systems , volume=

  97. [105]

    International Conference on Learning Representations , year=

    Auto-Encoding Variational Bayes , author=. International Conference on Learning Representations , year=

  98. [106]

    Proceedings of the 31st International Conference on Machine Learning , pages=

    Stochastic backpropagation and approximate inference in deep generative models , author=. Proceedings of the 31st International Conference on Machine Learning , pages=

  99. [107]

    Proceedings of the 36th International Conference on Machine Learning , pages=

    Graphite: Iterative generative modeling of graphs , author=. Proceedings of the 36th International Conference on Machine Learning , pages=

  100. [108]

    Biometrics , volume=

    A generalised logit-normal distribution , author=. Biometrics , volume=. 1965 , publisher=

    1965

  101. [109]

    Biometrika , volume=

    Logistic-normal distributions: Some properties and uses , author=. Biometrika , volume=. 1980 , publisher=

    1980

  102. [110]

    Journal of the Royal Statistical Society: Series B (Methodological) , volume=

    The statistical analysis of compositional data , author=. Journal of the Royal Statistical Society: Series B (Methodological) , volume=. 1982 , publisher=

    1982

  103. [111]

    International Conference on Learning Representations , year=

    Adam: A method for stochastic optimization , author=. International Conference on Learning Representations , year=

  104. [112]

    International Conference on Learning Representations , year=

    Explaining and harnessing adversarial examples , author=. International Conference on Learning Representations , year=

  105. [113]

    Ke, Guolin and Meng, Qi and Finley, Thomas and Wang, Taifeng and Chen, Wei and Ma, Weidong and Ye, Qiwei and Liu, Tie-Yan , booktitle=

  106. [114]

    Machine Learning , volume=

    An introduction to variational methods for graphical models , author=. Machine Learning , volume=. 1999 , publisher=

    1999

  107. [115]

    Sur les fonctions convexes et les in

    Jensen, Johan Ludwig William Valdemar , journal=. Sur les fonctions convexes et les in. 1906 , publisher=

    1906

  108. [116]

    IEEE Transactions on Knowledge and Data Engineering , volume=

    Learning under concept drift: A review , author=. IEEE Transactions on Knowledge and Data Engineering , volume=. 2018 , publisher=

    2018

  109. [117]

    IEEE Transactions on Pattern Analysis and Machine Intelligence , volume=

    A comprehensive survey of continual learning: Theory, method and application , author=. IEEE Transactions on Pattern Analysis and Machine Intelligence , volume=. 2024 , publisher=

    2024

  110. [118]

    MIS Quarterly , volume =

    Rai, Arun , title =. MIS Quarterly , volume =

  111. [119]

    International Conference on Learning Representations , year=

    Towards deep learning models resistant to adversarial attacks , author=. International Conference on Learning Representations , year=

  112. [120]

    Information Systems Research , volume=

    Toward a Causal Interpretation from Observational Data: A New Bayesian Networks Method for Structural Models with Latent Variables , author=. Information Systems Research , volume=

  113. [121]

    IEEE Transactions on Parallel and Distributed Systems , volume=

    Self-disciplinary worms and countermeasures: Modeling and analysis , author=. IEEE Transactions on Parallel and Distributed Systems , volume=. 2009 , publisher=

    2009

  114. [122]

    ACM Transactions on Information Systems , volume=

    M3rec: A context-aware offline meta-level model-based reinforcement learning approach for cold-start recommendation , author=. ACM Transactions on Information Systems , volume=

  115. [123]

    Information Systems Research , volume=

    From business intelligence to competitive intelligence: Inferring competitive measures using augmented site-centric data , author=. Information Systems Research , volume=

  116. [124]

    MIS Quarterly , volume=

    What will be popular next? Predicting hotspots in two-mode social networks , author=. MIS Quarterly , volume=

  117. [125]

    IEEE Transactions on Knowledge and Data Engineering , volume=

    Dual metric learning for effective and efficient cross-domain recommendations , author=. IEEE Transactions on Knowledge and Data Engineering , volume=. 2021 , publisher=

    2021

  118. [126]

    Information Systems Research , volume=

    Personalized ranking at a mobile app distribution platform , author=. Information Systems Research , volume=. 2023 , publisher=

    2023

  119. [127]

    IEEE Transactions on Knowledge and Data Engineering , volume=

    Detecting pickpocket suspects from large-scale public transit records , author=. IEEE Transactions on Knowledge and Data Engineering , volume=. 2018 , publisher=

    2018

  120. [128]

    IEEE transactions on neural networks and learning systems , volume=

    A comprehensive survey on graph neural networks , author=. IEEE transactions on neural networks and learning systems , volume=. 2020 , publisher=

    2020

  121. [129]

    Knowledge-Based Systems , volume=

    Efficient locality weighted sparse representation for graph-based learning , author=. Knowledge-Based Systems , volume=. 2017 , publisher=

    2017

Pith tools

Reviewed August 1, 2026 · model on record in the stance chip above.