{"id":"W4385336663","doi":"10.1016/j.cose.2023.103409","title":"XMal: A lightweight memory-based explainable obfuscated-malware detector","year":2023,"lang":"en","type":"article","venue":"Computers & Security","topic":"Advanced Malware Detection Techniques","field":"Computer Science","cited_by":40,"is_retracted":false,"has_abstract":false,"ca_institutions":"Seneca Polytechnic; Toronto Metropolitan University","funders":"Natural Sciences and Engineering Research Council of Canada","keywords":"Obfuscation; Malware; Computer science; Feature (linguistics); Code (set theory); Popularity; Detector; Process (computing); Computer security; Static analysis; Field (mathematics); Artificial intelligence; Machine learning; Data mining; Pattern recognition (psychology); Operating system; Programming language","routes":{"ca_aff":true,"ca_fund":true,"ca_venue":false,"about_ca":false,"invisible_to_affiliation_only":false},"retraction":null,"screen":null,"direct_labels":[],"prediction":{"model_version":"codex-gemma-dda1882f352a","candidate_categories":["metaepi_narrow"],"consensus_categories":[],"category_scores_codex":[0.0004677426,0.0004099792,0.0004150093,0.0005968843,0.000422743,0.0002745727,0.00189869,0.0001879511,0.0000473416],"category_scores_gemma":[0.00009041811,0.0004238747,0.0002209262,0.002297193,0.0001028367,0.0008406122,0.0008441739,0.0004143183,0.0003809949],"about_ca_system_candidate":false,"about_ca_system_consensus":false,"about_ca_system_score_codex":0.000206939,"about_ca_system_score_gemma":0.0001453043,"about_ca_topic_candidate":false,"about_ca_topic_consensus":false,"about_ca_topic_score_codex":0.00004030437,"about_ca_topic_score_gemma":0.00002150421,"domain_scores_codex":[0.9969516,0.000168306,0.0004581805,0.001039884,0.0005371532,0.0008448937],"domain_scores_gemma":[0.9975386,0.0002899292,0.000205788,0.00142756,0.0002489761,0.0002891141],"domain_codex":null,"domain_gemma":null,"domain_candidate":null,"domain_consensus":null,"study_design_codex":"design_other","study_design_gemma":"simulation_or_modeling","study_design_scores_codex":[0.0003160314,0.001595129,0.001512656,0.00180153,0.0004149699,0.004837622,0.01434762,0.01789871,0.01792961,0.06634604,0.3715517,0.5014483],"study_design_scores_gemma":[0.001649048,0.0006754262,0.00128245,0.0002326792,0.00002343827,0.00008285257,0.00009612099,0.5595064,0.1960495,0.03312199,0.2054899,0.001790156],"study_design_candidate":"simulation_or_modeling","study_design_consensus":null,"genre_codex":"methods","genre_gemma":"empirical","genre_scores_codex":[0.02536088,0.0001495223,0.9593768,0.001524048,0.001574777,0.0005934125,0.00001259807,0.01070289,0.0007050964],"genre_scores_gemma":[0.904301,0.00002430917,0.09385408,0.001047896,0.0002279781,0.0002078136,0.00002507217,0.00006219222,0.0002496191],"genre_candidate":"methods","genre_consensus":null,"teacher_disagreement_score":0.8789402,"threshold_uncertainty_score":0.9998213,"prediction_status":"machine_predicted_unvalidated"},"machine_scores":{"provisional":true,"baseline":true,"maturity_gate_passed":false,"score_opus":0.0111523516249054,"score_gpt":0.2436627829738028,"score_spread":0.2325104313488973,"validation_status":"score_only:v0-immature-baseline","note":"Baseline scores from an immature model (maturity gate not passed). Scores rank; they never assert a category."}}