<?xml version="1.0" encoding="utf-8"?>
<TEI xmlns="http://www.tei-c.org/ns/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hal="http://hal.archives-ouvertes.fr/" xmlns:gml="http://www.opengis.net/gml/3.3/" xmlns:gmlce="http://www.opengis.net/gml/3.3/ce" version="1.1" xsi:schemaLocation="http://www.tei-c.org/ns/1.0 http://api.archives-ouvertes.fr/documents/aofr-sword.xsd">
  <teiHeader>
    <fileDesc>
      <titleStmt>
        <title>HAL TEI export of hal-04093477</title>
      </titleStmt>
      <publicationStmt>
        <distributor>CCSD</distributor>
        <availability status="restricted">
          <licence target="https://creativecommons.org/publicdomain/zero/1.0/">CC0 1.0 - Universal</licence>
        </availability>
        <date when="2026-05-22T20:49:29+02:00"/>
      </publicationStmt>
      <sourceDesc>
        <p part="N">HAL API Platform</p>
      </sourceDesc>
    </fileDesc>
  </teiHeader>
  <text>
    <body>
      <listBibl>
        <biblFull>
          <titleStmt>
            <title xml:lang="en">When Malware Changed Its Mind An Empirical Study of Variable Program Behaviors in the Real World</title>
            <author role="aut">
              <persName>
                <forename type="first">Erin</forename>
                <surname>Avllazagaj</surname>
              </persName>
              <idno type="halauthorid">2807670-0</idno>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Ziyun</forename>
                <surname>Zhu</surname>
              </persName>
              <idno type="halauthorid">2807671-0</idno>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Leyla</forename>
                <surname>Bilge</surname>
              </persName>
              <idno type="halauthorid">2234184-0</idno>
              <affiliation ref="#struct-1162205"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Davide</forename>
                <surname>Balzarotti</surname>
              </persName>
              <email type="md5">3a357a4280ad9e06b08c793214fe9c71</email>
              <email type="domain">eurecom.fr</email>
              <idno type="idhal" notation="numeric">937917</idno>
              <idno type="halauthorid" notation="string">656193-937917</idno>
              <idno type="ORCID">https://orcid.org/0000-0001-5957-6213</idno>
              <idno type="RESEARCHERID">http://www.researcherid.com/rid/EKT-8806-2022</idno>
              <idno type="ISNI">http://isni.org/isni/0000000382393268</idno>
              <idno type="VIAF">https://viaf.org/viaf/265384337</idno>
              <idno type="IDREF">https://www.idref.fr/156537923</idno>
              <affiliation ref="#struct-421532"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Tudor</forename>
                <surname>Dumitras</surname>
              </persName>
              <idno type="halauthorid">2807672-0</idno>
            </author>
            <editor role="depositor">
              <persName>
                <forename>Centre De Documentation</forename>
                <surname>Eurecom</surname>
              </persName>
              <email type="md5">808fb6c747947adf4fb3953c09dd1636</email>
              <email type="domain">eurecom.fr</email>
            </editor>
            <funder ref="#projeurop-722642"/>
            <funder ref="#projeurop-717387"/>
          </titleStmt>
          <editionStmt>
            <edition n="v1" type="current">
              <date type="whenSubmitted">2023-05-10 11:07:13</date>
              <date type="whenModified">2024-06-13 17:22:51</date>
              <date type="whenReleased">2023-05-15 14:58:41</date>
              <date type="whenProduced">2021-08-11</date>
              <date type="whenEndEmbargoed">2023-05-10</date>
              <ref type="file" target="https://hal.science/hal-04093477v1/document">
                <date notBefore="2023-05-10"/>
              </ref>
              <ref type="file" subtype="author" n="1" target="https://hal.science/hal-04093477v1/file/publi-6594.pdf" id="file-4093477-3563556">
                <date notBefore="2023-05-10"/>
              </ref>
            </edition>
            <respStmt>
              <resp>contributor</resp>
              <name key="118606">
                <persName>
                  <forename>Centre De Documentation</forename>
                  <surname>Eurecom</surname>
                </persName>
                <email type="md5">808fb6c747947adf4fb3953c09dd1636</email>
                <email type="domain">eurecom.fr</email>
              </name>
            </respStmt>
          </editionStmt>
          <publicationStmt>
            <distributor>CCSD</distributor>
            <idno type="halId">hal-04093477</idno>
            <idno type="halUri">https://hal.science/hal-04093477</idno>
            <idno type="halBibtex">avllazagaj:hal-04093477</idno>
            <idno type="halRefHtml">&lt;i&gt;USENIX 2021, 30th USENIX Security Symposium, 11-13 August 2021&lt;/i&gt;, Usenix, Aug 2021, Online, United States</idno>
            <idno type="halRef">USENIX 2021, 30th USENIX Security Symposium, 11-13 August 2021, Usenix, Aug 2021, Online, United States</idno>
            <availability status="restricted">
              <licence target="https://about.hal.science/hal-authorisation-v1/">HAL Authorization<ref corresp="#file-4093477-3563556"/></licence>
            </availability>
          </publicationStmt>
          <seriesStmt>
            <idno type="stamp" n="EURECOM">EURECOM</idno>
            <idno type="stamp" n="OPENAIRE">OpenAIRE</idno>
          </seriesStmt>
          <notesStmt>
            <note type="audience" n="2">International</note>
            <note type="invited" n="0">No</note>
            <note type="popular" n="0">No</note>
            <note type="peer" n="1">Yes</note>
            <note type="proceedings" n="0">No</note>
          </notesStmt>
          <sourceDesc>
            <biblStruct>
              <analytic>
                <title xml:lang="en">When Malware Changed Its Mind An Empirical Study of Variable Program Behaviors in the Real World</title>
                <author role="aut">
                  <persName>
                    <forename type="first">Erin</forename>
                    <surname>Avllazagaj</surname>
                  </persName>
                  <idno type="halauthorid">2807670-0</idno>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Ziyun</forename>
                    <surname>Zhu</surname>
                  </persName>
                  <idno type="halauthorid">2807671-0</idno>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Leyla</forename>
                    <surname>Bilge</surname>
                  </persName>
                  <idno type="halauthorid">2234184-0</idno>
                  <affiliation ref="#struct-1162205"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Davide</forename>
                    <surname>Balzarotti</surname>
                  </persName>
                  <email type="md5">3a357a4280ad9e06b08c793214fe9c71</email>
                  <email type="domain">eurecom.fr</email>
                  <idno type="idhal" notation="numeric">937917</idno>
                  <idno type="halauthorid" notation="string">656193-937917</idno>
                  <idno type="ORCID">https://orcid.org/0000-0001-5957-6213</idno>
                  <idno type="RESEARCHERID">http://www.researcherid.com/rid/EKT-8806-2022</idno>
                  <idno type="ISNI">http://isni.org/isni/0000000382393268</idno>
                  <idno type="VIAF">https://viaf.org/viaf/265384337</idno>
                  <idno type="IDREF">https://www.idref.fr/156537923</idno>
                  <affiliation ref="#struct-421532"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Tudor</forename>
                    <surname>Dumitras</surname>
                  </persName>
                  <idno type="halauthorid">2807672-0</idno>
                </author>
              </analytic>
              <monogr>
                <meeting>
                  <title>USENIX 2021, 30th USENIX Security Symposium, 11-13 August 2021</title>
                  <date type="start">2021-08-11</date>
                  <date type="end">2021-08-13</date>
                  <settlement>Online</settlement>
                  <country key="US">United States</country>
                </meeting>
                <respStmt>
                  <resp>conferenceOrganizer</resp>
                  <name>Usenix</name>
                </respStmt>
                <imprint/>
              </monogr>
            </biblStruct>
          </sourceDesc>
          <profileDesc>
            <langUsage>
              <language ident="en">English</language>
            </langUsage>
            <textClass>
              <classCode scheme="halDomain" n="info">Computer Science [cs]</classCode>
              <classCode scheme="halTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halOldTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halTreeTypology" n="COMM">Conference papers</classCode>
            </textClass>
            <abstract xml:lang="en">
              <p>Behavioral program analysis is widely used for understanding malware behavior, for creating rule-based detectors, and for clustering samples into malware families. However, this approach is ineffective when the behavior of individual samples changes across different executions, owing to environment sensitivity, evasive techniques or time variability. While the inability to observe the complete behavior of a program is a well-known limitation of dynamic analysis, the prevalence of this behavior variability in the wild, and the behavior components that are most affected by it, are still unknown. As the behavioral traces are typically collected by executing the samples in a controlled environment, the models created and tested using such traces do not account for the broad range of behaviors observed in the wild, and may result in a false sense of security. In this paper we conduct the first quantitative analysis of behavioral variability in Windows malware, PUP and benign samples, using a novel dataset of 7.6M execution traces, recorded in 5.4M real hosts from 113 countries. We analyze program behaviors at multiple granularities, and we show how they change across hosts and across time. We then analyze the invariant parts of the malware behaviors, and we show how this affects the effectiveness of malware detection using a common class of behavioral rules. Our findings have actionable implications for malware clustering and detection, and they emphasize that program behavior in the wild depends on a subtle interplay of factors that may only be observed at scale, by monitoring malware on real hosts.</p>
            </abstract>
          </profileDesc>
        </biblFull>
      </listBibl>
    </body>
    <back>
      <listOrg type="structures">
        <org type="institution" xml:id="struct-1162205" status="INCOMING">
          <orgName>NortonLifeLock</orgName>
          <desc>
            <address>
              <country key="FR"/>
            </address>
          </desc>
        </org>
        <org type="institution" xml:id="struct-421532" status="VALID">
          <orgName>Eurecom [Sophia Antipolis]</orgName>
          <desc>
            <address>
              <addrLine>Campus SophiaTech, 450 Route des Chappes, CS 50193 - 06904 Biot Sophia Antipolis cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.eurecom.fr/</ref>
          </desc>
        </org>
      </listOrg>
      <listOrg type="projects">
        <org type="europeanProject" xml:id="projeurop-722642" status="VALID">
          <idno type="number">771844</idno>
          <idno type="program">ERC-2017-COG</idno>
          <idno type="call">ERC-2017-COG</idno>
          <orgName>BITCRUMBS</orgName>
          <desc>Towards a Reliable and Automated Analysis of Compromised Systems</desc>
          <date type="start">2018-04-01</date>
          <date type="end">2023-08-31</date>
        </org>
        <org type="europeanProject" xml:id="projeurop-717387" status="INCOMING">
          <idno type="number">ERC-2017-COG</idno>
          <orgName>BITCRUMBS</orgName>
          <desc>Towards a Reliable and Automated Analysis of Compromised Systems</desc>
        </org>
      </listOrg>
    </back>
  </text>
</TEI>