{"id":"W3145691682","doi":"10.1145/3513025","title":"Analysis and Correlation of Visual Evidence in Campaigns of Malicious Office Documents","year":2022,"lang":"en","type":"article","venue":"Digital Threats Research and Practice","topic":"Advanced Malware Detection Techniques","field":"Computer Science","cited_by":15,"is_retracted":false,"has_abstract":true,"ca_institutions":"Hatch (Canada)","funders":"Horizon 2020 Framework Programme; Generalitat de Catalunya; European Commission","keywords":"Computer science; Visual Basic for Applications; Malware; Task (project management); Payload (computing); Microsoft Office; Pipeline (software); Fingerprint (computing); Construct (python library); Database; Computer security; World Wide Web; Information retrieval; Operating system; Programming language; Engineering","routes":{"ca_aff":true,"ca_fund":false,"ca_venue":false,"about_ca":false,"invisible_to_affiliation_only":false},"retraction":null,"screen":null,"direct_labels":[],"prediction":{"model_version":"codex-gemma-dda1882f352a","candidate_categories":[],"consensus_categories":[],"category_scores_codex":[0.001588051,0.00006504689,0.0001595435,0.0005922674,0.0001062077,0.0001094693,0.0002393798,0.00002411321,0.000009958851],"category_scores_gemma":[0.001754509,0.00006670477,0.0000235928,0.002194358,0.0001162276,0.002773186,0.000622022,0.0002509193,8.276498e-7],"about_ca_system_candidate":false,"about_ca_system_consensus":false,"about_ca_system_score_codex":0.00005726562,"about_ca_system_score_gemma":0.00005930773,"about_ca_topic_candidate":false,"about_ca_topic_consensus":false,"about_ca_topic_score_codex":0.0002338201,"about_ca_topic_score_gemma":0.00002043344,"domain_scores_codex":[0.9983485,0.0003266687,0.0002331528,0.0002840759,0.0006353503,0.0001722874],"domain_scores_gemma":[0.9962714,0.003020188,0.0001556107,0.0002355859,0.0002569193,0.00006023643],"domain_codex":null,"domain_gemma":null,"domain_candidate":null,"domain_consensus":null,"study_design_codex":"design_other","study_design_gemma":"observational","study_design_scores_codex":[0.003272372,0.001794318,0.1199894,0.0002423232,0.000455118,0.000201777,0.005977063,0.001978657,0.005940194,0.0164449,0.00009737354,0.8436065],"study_design_scores_gemma":[0.007411133,0.05712477,0.3253676,0.001042288,0.0006156789,0.002122384,0.02855033,0.2190527,0.09470164,0.2392779,0.0211595,0.003574078],"study_design_candidate":"design_other","study_design_consensus":null,"genre_codex":"empirical","genre_gemma":"empirical","genre_scores_codex":[0.5447127,0.002697812,0.4465786,0.0005161723,0.00004523238,0.0006575091,0.00003059869,0.00008045058,0.004680969],"genre_scores_gemma":[0.9963511,0.0004786115,0.002936198,0.00001675047,0.000003299072,0.0000267858,0.000003273322,0.000003819629,0.0001801661],"genre_candidate":"empirical","genre_consensus":"empirical","teacher_disagreement_score":0.8400325,"threshold_uncertainty_score":0.2720142,"prediction_status":"machine_predicted_unvalidated"},"machine_scores":{"provisional":true,"baseline":true,"maturity_gate_passed":false,"score_opus":0.08699993772077706,"score_gpt":0.4363185021071302,"score_spread":0.3493185643863531,"validation_status":"score_only:v0-immature-baseline","note":"Baseline scores from an immature model (maturity gate not passed). Scores rank; they never assert a category."}}