{"id":"W4414982131","doi":"10.1145/3771542","title":"Toward a Robust Detection of PowerShell Malware against Code Mixing and Obfuscation by Using Sentence Transformer and Similarity Learning","year":2025,"lang":"en","type":"article","venue":"ACM Transactions on Privacy and Security","topic":"Advanced Malware Detection Techniques","field":"Computer Science","cited_by":2,"is_retracted":false,"has_abstract":true,"ca_institutions":"Queen's University; McGill University","funders":"","keywords":"Malware; Obfuscation; Scripting language; Robustness (evolution); Scalability; Sentence; Classifier (UML); Header; Sliding window protocol","routes":{"ca_aff":true,"ca_fund":false,"ca_venue":false,"about_ca":false,"invisible_to_affiliation_only":false},"retraction":null,"screen":null,"direct_labels":[],"prediction":{"model_version":"codex-gemma-dda1882f352a","candidate_categories":[],"consensus_categories":[],"category_scores_codex":[0.0002259139,0.0001685686,0.0001961985,0.0002001254,0.0004010149,0.00007268122,0.0002078806,0.0001293902,0.000001842125],"category_scores_gemma":[0.00007555532,0.0001845802,0.00004408732,0.000368129,0.0001172773,0.0007411362,0.0000277948,0.0003883395,1.091908e-7],"about_ca_system_candidate":false,"about_ca_system_consensus":false,"about_ca_system_score_codex":0.00005246426,"about_ca_system_score_gemma":0.00002757279,"about_ca_topic_candidate":false,"about_ca_topic_consensus":false,"about_ca_topic_score_codex":0.00007933339,"about_ca_topic_score_gemma":0.00003750334,"domain_scores_codex":[0.9988997,0.00008937733,0.0002613942,0.0004367129,0.0001353251,0.0001774719],"domain_scores_gemma":[0.9993082,0.0001477511,0.00009137893,0.00029456,0.00009199341,0.00006612993],"domain_codex":null,"domain_gemma":null,"domain_candidate":null,"domain_consensus":null,"study_design_codex":"design_other","study_design_gemma":"bench_or_experimental","study_design_scores_codex":[0.000227684,0.0003236166,0.001303263,0.0008228885,0.0001182726,0.000005774829,0.009362391,0.002179468,0.255776,0.0007136205,0.00001017276,0.7291569],"study_design_scores_gemma":[0.001209855,0.000390931,0.001532641,0.0003573764,0.00008738256,0.00006359857,0.001102162,0.1770629,0.8008156,0.01520746,0.001602058,0.0005679615],"study_design_candidate":"bench_or_experimental","study_design_consensus":null,"genre_codex":"methods","genre_gemma":"empirical","genre_scores_codex":[0.283212,0.0002710442,0.7157071,0.0003860314,0.00005870373,0.0001853196,0.0000104228,0.0001400911,0.00002932406],"genre_scores_gemma":[0.9762679,0.001091386,0.02248657,0.0001126497,0.000003758934,0.00001324697,0.000001812944,0.000007466446,0.000015183],"genre_candidate":"empirical","genre_consensus":null,"teacher_disagreement_score":0.7285889,"threshold_uncertainty_score":0.7526963,"prediction_status":"machine_predicted_unvalidated"},"machine_scores":{"provisional":true,"baseline":true,"maturity_gate_passed":false,"score_opus":0.02180981101327473,"score_gpt":0.2641078728312054,"score_spread":0.2422980618179307,"validation_status":"score_only:v0-immature-baseline","note":"Baseline scores from an immature model (maturity gate not passed). Scores rank; they never assert a category."}}