{"id":"W3145691682","doi":"10.1145/3513025","title":"Analysis and Correlation of Visual Evidence in Campaigns of Malicious Office Documents","year":2022,"lang":"en","type":"article","venue":"Digital Threats Research and Practice","topic":"Advanced Malware Detection Techniques","field":"Computer Science","cited_by":15,"is_retracted":false,"has_abstract":true,"ca_institutions":"Hatch (Canada)","funders":"Horizon 2020 Framework Programme; Generalitat de Catalunya; European Commission","keywords":"Computer science; Visual Basic for Applications; Malware; Task (project management); Payload (computing); Microsoft Office; Pipeline (software); Fingerprint (computing); Construct (python library); Database; Computer security; World Wide Web; Information retrieval; Operating system; Programming language; Engineering","routes":{"ca_aff":true,"ca_fund":false,"ca_venue":false,"about_ca":false,"invisible_to_affiliation_only":false},"retraction":null,"screen":null,"direct_labels":[],"prediction":{"model_version":"metacan-v3-hybrid-931329e0061c","candidate_categories":[],"consensus_categories":[],"category_scores_codex":[0.0006760365,0.0005064829,0.0004574945,0.009256025,0.0004108008,0.001239957,0.0002692878,0.0005146808,0.001475744],"category_scores_gemma":[0.006573164,0.0001994129,0.0002837827,0.002469647,0.0005738614,0.0009047528,0.0008384762,0.0004476569,0.0009932024],"about_ca_system_candidate":false,"about_ca_system_consensus":false,"about_ca_system_score_codex":0.0004151428,"about_ca_system_score_gemma":0.0004080782,"about_ca_topic_candidate":false,"about_ca_topic_consensus":false,"about_ca_topic_score_codex":0.001332366,"about_ca_topic_score_gemma":0.001531062,"domain_scores_codex":[0.9986748,0.0001327283,0.00009566524,0.0001927104,0.0007046702,0.0001994367],"domain_scores_gemma":[0.9914086,0.003138548,0.002389264,0.0007302443,0.001938668,0.000394602],"domain_codex":null,"domain_gemma":null,"domain_candidate":null,"domain_consensus":null,"study_design_codex":"design_other","study_design_gemma":"observational","study_design_scores_codex":[0.002278868,0.0005148989,0.3088565,0.001383376,0.0002245872,0.004670503,0.003271559,0.006733434,0.1581068,0.002893921,0.007840907,0.5032247],"study_design_scores_gemma":[0.00004371896,0.0006422499,0.6628411,0.0004159823,0.0002942659,0.009641622,0.002868538,0.09180036,0.212009,0.00212243,0.01715041,0.0001702843],"study_design_candidate":"observational","study_design_consensus":null,"genre_codex":"empirical","genre_gemma":"empirical","genre_scores_codex":[0.9797001,0.001006404,0.01203654,0.0001071049,0.00005282636,0.0001442254,0.001259825,0.001021869,0.004671151],"genre_scores_gemma":[0.9880613,0.000296645,0.009230278,0.00002675818,0.0000422714,0.00003187222,0.001017324,0.00009036882,0.001203098],"genre_candidate":"empirical","genre_consensus":"empirical","teacher_disagreement_score":0.009256025,"threshold_uncertainty_score":0.004936874,"prediction_status":"machine_predicted_unvalidated"},"machine_scores":{"provisional":true,"baseline":true,"maturity_gate_passed":false,"score_opus":0.08699993772077706,"score_gpt":0.4363185021071302,"score_spread":0.3493185643863531,"validation_status":"score_only:v0-immature-baseline","note":"Baseline scores from an immature model (maturity gate not passed). Scores rank; they never assert a category."}}