Demonstration venue · read-only. Every page can be browsed; the buttons that would change it are switched off. Create an account to run TaxoReview on your own data. A simulation from public publication records: the people listed were not invited and did not agree to review.
? Tutorial for this page

Baodi Ning

dblp:271/5186 · DBLP profile ↗
← Back
1ranked-venue papers
0as first author
0since 2021 · last 2020
—ORCID · none

Domains — the database's venue-derived domains; a paper can count in several

Security and privacy · 1

Expertise — from the expertise taxonomy: the topics of the expert's papers under the CCF categories. A weight counts papers with recency: 1 for a paper about the topic, 0.3 when the topic is its context, halved every five years.

Network and information security
1 paper
Malware analysis · 100%
Artificial intelligence
1 paper
Representation and self-supervised learning · 100%

Topics — the 3 heaviest of 4, each with the papers that count most for it

TopicWeightPapersLastEvidence papers
Malware analysis
android malware
0.412020
Familial Clustering for Weakly-Labeled Android Malware Using Hybrid Representation Learning · IEEE Trans. Inf. Forensics Secur. 2020
Malware analysis › malware similarity
malware clustering
0.412020
Familial Clustering for Weakly-Labeled Android Malware Using Hybrid Representation Learning · IEEE Trans. Inf. Forensics Secur. 2020
Malware analysis › malware classification
malware family classification
0.112020
Familial Clustering for Weakly-Labeled Android Malware Using Hybrid Representation Learning · IEEE Trans. Inf. Forensics Secur. 2020

Methods — techniques the papers use, named apart from their topics

static code analysis · 0.9hybrid representation learning · 0.9density-based clustering · 0.9deep neural network · 0.9
YearPublicationVenuePosition
2020 Familial Clustering for Weakly-Labeled Android Malware Using Hybrid Representation Learning
abstract
Labeling malware or malware clustering is important for identifying new security threats, triaging and building reference datasets. The state-of-the-art Android malware clustering approaches rely heavily on the raw labels from commercial AntiVirus (AV) vendors, which causes misclustering for a substantial number ofweakly-labeled malwaredue to the inconsistent, incomplete and overly generic labels reported by these closed-source AV engines, whose capabilities vary greatly and whose internal mechanisms are opaque (i.e., intermediate detection results are unavailable for clustering). The raw labels are thus often used as the only important source of information for clustering. To address the limitations of the existing approaches, this paper presents Andre, a new ANDroid Hybrid REpresentation Learning approach to clustering weakly-labeled Android malware by preserving heterogeneous information from multiple sources (including the results of static code analysis, the meta-information of an app, and the raw-labels of the AV vendors) to jointly learn a hybrid representation for accurate clustering. The learned representation is then fed into our outlier-aware clustering to partition the weakly-labeled malware into known and unknown families. The malware whose malicious behaviours are close to those of the existing families on the network, are further classified using a three-layer Deep Neural Network (DNN). The unknown malware are clustered using a standard density-based clustering algorithm. We have evaluated our approach using 5,416 ground-truth malware from Drebin and 9,000 malware from VirusShare (uploaded between Mar. 2017 and Feb. 2018), consisting of 3324 weakly-labeled malware. The evaluation shows that Andre effectively clusters weakly-labeled malware which cannot be clustered by the state-of-the-art approaches, while achieving comparable accuracy with those approaches for clustering ground-truth samples.
Yulei Sui, Shirui Pan, Zheng Zheng 0001, Baodi Ning, Ivor W. Tsang, Wanlei Zhou 0001
IEEE Trans. Inf. Forensics Secur.5