Demo Data from EDBT 2026 / reviewers in the wild / expert
Baodi Ning
dblp:271/5186
· DBLP profile ↗
1ranked-venue papers
0as first author
0since 2021 · last 2020
—ORCID · none
Domains — the database's venue-derived domains; a paper can count in several
Security and privacy · 1
Expertise — from the expertise taxonomy: the topics of the expert's papers under the CCF categories. A weight counts papers with recency: 1 for a paper about the topic, 0.3 when the topic is its context, halved every five years.
| Network and information security
1 paper |
Malware analysis · 100% | |
| Artificial intelligence
1 paper |
Representation and self-supervised learning · 100% |
Topics — the 3 heaviest of 4, each with the papers that count most for it
| Topic | Weight | Papers | Last | Evidence papers |
|---|---|---|---|---|
Malware analysis
android malware |
0.4 | 1 | 2020 | Familial Clustering for Weakly-Labeled Android Malware Using Hybrid Representation Learning · IEEE Trans. Inf. Forensics Secur. 2020 |
Malware analysis › malware similarity
malware clustering |
0.4 | 1 | 2020 | Familial Clustering for Weakly-Labeled Android Malware Using Hybrid Representation Learning · IEEE Trans. Inf. Forensics Secur. 2020 |
Malware analysis › malware classification
malware family classification |
0.1 | 1 | 2020 | Familial Clustering for Weakly-Labeled Android Malware Using Hybrid Representation Learning · IEEE Trans. Inf. Forensics Secur. 2020 |
Methods — techniques the papers use, named apart from their topics
static code analysis · 0.9hybrid representation learning · 0.9density-based clustering · 0.9deep neural network · 0.9
| Year | Publication | Venue | Position |
|---|---|---|---|
| 2020 | Familial Clustering for Weakly-Labeled Android Malware Using Hybrid Representation LearningabstractLabeling malware or malware clustering is important for identifying new security threats, triaging and building reference datasets. The state-of-the-art Android malware clustering approaches rely heavily on the raw labels from commercial AntiVirus (AV) vendors, which causes misclustering for a substantial number ofweakly-labeled malwaredue to the inconsistent, incomplete and overly generic labels reported by these closed-source AV engines, whose capabilities vary greatly and whose internal mechanisms are opaque (i.e., intermediate detection results are unavailable for clustering). The raw labels are thus often used as the only important source of information for clustering. To address the limitations of the existing approaches, this paper presents Andre, a new ANDroid Hybrid REpresentation Learning approach to clustering weakly-labeled Android malware by preserving heterogeneous information from multiple sources (including the results of static code analysis, the meta-information of an app, and the raw-labels of the AV vendors) to jointly learn a hybrid representation for accurate clustering. The learned representation is then fed into our outlier-aware clustering to partition the weakly-labeled malware into known and unknown families. The malware whose malicious behaviours are close to those of the existing families on the network, are further classified using a three-layer Deep Neural Network (DNN). The unknown malware are clustered using a standard density-based clustering algorithm. We have evaluated our approach using 5,416 ground-truth malware from Drebin and 9,000 malware from VirusShare (uploaded between Mar. 2017 and Feb. 2018), consisting of 3324 weakly-labeled malware. The evaluation shows that Andre effectively clusters weakly-labeled malware which cannot be clustered by the state-of-the-art approaches, while achieving comparable accuracy with those approaches for clustering ground-truth samples. Yulei Sui, Shirui Pan, Zheng Zheng 0001, Baodi Ning, Ivor W. Tsang, Wanlei Zhou 0001 |
IEEE Trans. Inf. Forensics Secur. | 5 |