<?xml version="1.0" encoding="utf-8"?>
<TEI xmlns="http://www.tei-c.org/ns/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hal="http://hal.archives-ouvertes.fr/" xmlns:gml="http://www.opengis.net/gml/3.3/" xmlns:gmlce="http://www.opengis.net/gml/3.3/ce" version="1.1" xsi:schemaLocation="http://www.tei-c.org/ns/1.0 http://api.archives-ouvertes.fr/documents/aofr-sword.xsd">
  <teiHeader>
    <fileDesc>
      <titleStmt>
        <title>HAL TEI export of hal-04739413</title>
      </titleStmt>
      <publicationStmt>
        <distributor>CCSD</distributor>
        <availability status="restricted">
          <licence target="https://creativecommons.org/publicdomain/zero/1.0/">CC0 1.0 - Universal</licence>
        </availability>
        <date when="2026-05-18T16:11:10+02:00"/>
      </publicationStmt>
      <sourceDesc>
        <p part="N">HAL API Platform</p>
      </sourceDesc>
    </fileDesc>
  </teiHeader>
  <text>
    <body>
      <listBibl>
        <biblFull>
          <titleStmt>
            <title xml:lang="en">Malware detection through windows system call analysis</title>
            <title xml:lang="fr">Détection de logiciels malveillants (malware) grâce à l'analyse des appels système Windows</title>
            <author role="aut">
              <persName>
                <forename type="first">Badis</forename>
                <surname>Hammi</surname>
              </persName>
              <email type="md5">6fa284866ea3ff60923756e5106bcfe7</email>
              <email type="domain">telecom-sudparis.eu</email>
              <idno type="idhal" notation="string">badis-hammi</idno>
              <idno type="idhal" notation="numeric">1330799</idno>
              <idno type="halauthorid" notation="string">1640418-1330799</idno>
              <idno type="ORCID">https://orcid.org/0000-0002-4470-6406</idno>
              <affiliation ref="#struct-563936"/>
              <affiliation ref="#struct-95600"/>
              <affiliation ref="#struct-1101446"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Joel</forename>
                <surname>Hachem</surname>
              </persName>
              <email type="md5">9cd2d2d64984fa407d05f507b453b4c4</email>
              <email type="domain">kettering.edu</email>
              <idno type="idhal" notation="numeric">1428504</idno>
              <idno type="halauthorid" notation="string">2649054-1428504</idno>
              <affiliation ref="#struct-563936"/>
              <affiliation ref="#struct-95600"/>
              <affiliation ref="#struct-1101446"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Ali</forename>
                <surname>Rachini</surname>
              </persName>
              <email type="md5">2aa64b14f3012ddf824472fbc86afb0b</email>
              <email type="domain">usek.edu.lb</email>
              <idno type="idhal" notation="numeric">1428505</idno>
              <idno type="halauthorid" notation="string">148853-1428505</idno>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Rida</forename>
                <surname>Khatoun</surname>
              </persName>
              <email type="md5">604c122d586f9ab493e6e3d234c01669</email>
              <email type="domain">telecom-paristech.fr</email>
              <idno type="idhal" notation="string">khatoun</idno>
              <idno type="idhal" notation="numeric">178793</idno>
              <idno type="halauthorid" notation="string">46179-178793</idno>
              <idno type="IDREF">https://www.idref.fr/138135819</idno>
              <idno type="ORCID">https://orcid.org/0009-0004-8282-136X</idno>
              <affiliation ref="#struct-1081156"/>
              <affiliation ref="#struct-121818"/>
            </author>
            <editor role="depositor">
              <persName>
                <forename>Badis</forename>
                <surname>HAMMI</surname>
              </persName>
              <email type="md5">6fa284866ea3ff60923756e5106bcfe7</email>
              <email type="domain">telecom-sudparis.eu</email>
            </editor>
          </titleStmt>
          <editionStmt>
            <edition n="v1" type="current">
              <date type="whenSubmitted">2024-10-16 11:36:07</date>
              <date type="whenModified">2026-02-07 05:29:09</date>
              <date type="whenReleased">2024-10-18 11:49:36</date>
              <date type="whenProduced">2024-11-09</date>
              <date type="whenEndEmbargoed">2024-10-16</date>
              <ref type="file" target="https://hal.science/hal-04739413v1/document">
                <date notBefore="2024-10-16"/>
              </ref>
              <ref type="file" subtype="author" n="1" target="https://hal.science/hal-04739413v1/file/main.pdf" id="file-4739413-4126456">
                <date notBefore="2024-10-16"/>
              </ref>
            </edition>
            <respStmt>
              <resp>contributor</resp>
              <name key="1463022">
                <persName>
                  <forename>Badis</forename>
                  <surname>HAMMI</surname>
                </persName>
                <email type="md5">6fa284866ea3ff60923756e5106bcfe7</email>
                <email type="domain">telecom-sudparis.eu</email>
              </name>
            </respStmt>
          </editionStmt>
          <publicationStmt>
            <distributor>CCSD</distributor>
            <idno type="halId">hal-04739413</idno>
            <idno type="halUri">https://hal.science/hal-04739413</idno>
            <idno type="halBibtex">hammi:hal-04739413</idno>
            <idno type="halRefHtml">&lt;i&gt;9th International Conference On Mobile And Secure Services (MOBISECSERV)&lt;/i&gt;, Nov 2024, Miami, United States. pp.7</idno>
            <idno type="halRef">9th International Conference On Mobile And Secure Services (MOBISECSERV), Nov 2024, Miami, United States. pp.7</idno>
            <availability status="restricted">
              <licence target="https://about.hal.science/hal-authorisation-v1/">HAL Authorization<ref corresp="#file-4739413-4126456"/></licence>
            </availability>
          </publicationStmt>
          <seriesStmt>
            <idno type="stamp" n="ENST">Ecole Nationale Supérieure des Télécommunications</idno>
            <idno type="stamp" n="TELECOM-PARISTECH" corresp="PARISTECH">Télécom Paris</idno>
            <idno type="stamp" n="TELECOM-SUDPARIS" corresp="INSTITUT-MINES-TELECOM">Télécom SudParis</idno>
            <idno type="stamp" n="LTCI" corresp="TELECOM-PARISTECH">Laboratoire Traitement et Communication de l'Information</idno>
            <idno type="stamp" n="INFRES" corresp="TELECOM-PARISTECH">Département Informatique et Réseaux</idno>
            <idno type="stamp" n="IP_PARIS">Institut Polytechnique de Paris</idno>
            <idno type="stamp" n="INSTITUTS-TELECOM">composantes instituts telecom </idno>
            <idno type="stamp" n="C2" corresp="TELECOM-PARISTECH">Equipe Cybersécurité et Cryptographie </idno>
            <idno type="stamp" n="INSTITUT-MINES-TELECOM">Institut Mines Telecom</idno>
            <idno type="stamp" n="DEPARTEMENT-DE-MATHEMATIQUES">Collection du Département de Mathématiques</idno>
            <idno type="stamp" n="IP-PARIS-DEPARTEMENT-MATHEMATIQUES">Département de Mathèmatiques</idno>
            <idno type="stamp" n="IP-PARIS-MATHEMATIQUES">IP Paris Département de Mathématiques</idno>
            <idno type="stamp" n="IP-PARIS-INFORMATION-COMMUNICATION-ELECTRONIQUE">IP Paris Département d'Information, de Communication et d'Électronique</idno>
            <idno type="stamp" n="IP-PARIS-INFORMATIQUE-DONNEES-ET-IA">IP Paris Département d'Informatique, de Données et d'IA</idno>
            <idno type="stamp" n="SAMOVAR">Services répartis, Architectures, Modélisation, Validation, Administration des Réseaux</idno>
          </seriesStmt>
          <notesStmt>
            <note type="audience" n="2">International</note>
            <note type="invited" n="0">No</note>
            <note type="popular" n="0">No</note>
            <note type="peer" n="1">Yes</note>
            <note type="proceedings" n="1">Yes</note>
          </notesStmt>
          <sourceDesc>
            <biblStruct>
              <analytic>
                <title xml:lang="en">Malware detection through windows system call analysis</title>
                <title xml:lang="fr">Détection de logiciels malveillants (malware) grâce à l'analyse des appels système Windows</title>
                <author role="aut">
                  <persName>
                    <forename type="first">Badis</forename>
                    <surname>Hammi</surname>
                  </persName>
                  <email type="md5">6fa284866ea3ff60923756e5106bcfe7</email>
                  <email type="domain">telecom-sudparis.eu</email>
                  <idno type="idhal" notation="string">badis-hammi</idno>
                  <idno type="idhal" notation="numeric">1330799</idno>
                  <idno type="halauthorid" notation="string">1640418-1330799</idno>
                  <idno type="ORCID">https://orcid.org/0000-0002-4470-6406</idno>
                  <affiliation ref="#struct-563936"/>
                  <affiliation ref="#struct-95600"/>
                  <affiliation ref="#struct-1101446"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Joel</forename>
                    <surname>Hachem</surname>
                  </persName>
                  <email type="md5">9cd2d2d64984fa407d05f507b453b4c4</email>
                  <email type="domain">kettering.edu</email>
                  <idno type="idhal" notation="numeric">1428504</idno>
                  <idno type="halauthorid" notation="string">2649054-1428504</idno>
                  <affiliation ref="#struct-563936"/>
                  <affiliation ref="#struct-95600"/>
                  <affiliation ref="#struct-1101446"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Ali</forename>
                    <surname>Rachini</surname>
                  </persName>
                  <email type="md5">2aa64b14f3012ddf824472fbc86afb0b</email>
                  <email type="domain">usek.edu.lb</email>
                  <idno type="idhal" notation="numeric">1428505</idno>
                  <idno type="halauthorid" notation="string">148853-1428505</idno>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Rida</forename>
                    <surname>Khatoun</surname>
                  </persName>
                  <email type="md5">604c122d586f9ab493e6e3d234c01669</email>
                  <email type="domain">telecom-paristech.fr</email>
                  <idno type="idhal" notation="string">khatoun</idno>
                  <idno type="idhal" notation="numeric">178793</idno>
                  <idno type="halauthorid" notation="string">46179-178793</idno>
                  <idno type="IDREF">https://www.idref.fr/138135819</idno>
                  <idno type="ORCID">https://orcid.org/0009-0004-8282-136X</idno>
                  <affiliation ref="#struct-1081156"/>
                  <affiliation ref="#struct-121818"/>
                </author>
              </analytic>
              <monogr>
                <title level="m">MOBISECSERV 2024 : 9th International Conference On Mobile And Secure Services</title>
                <meeting>
                  <title>9th International Conference On Mobile And Secure Services  (MOBISECSERV)</title>
                  <date type="start">2024-11-09</date>
                  <date type="end">2024-11-10</date>
                  <settlement>Miami</settlement>
                  <country key="US">United States</country>
                </meeting>
                <imprint>
                  <biblScope unit="pp">7</biblScope>
                </imprint>
              </monogr>
            </biblStruct>
          </sourceDesc>
          <profileDesc>
            <langUsage>
              <language ident="en">English</language>
            </langUsage>
            <textClass>
              <keywords scheme="author">
                <term xml:lang="en">Malware detection</term>
                <term xml:lang="en">Endpoint Detection and Response (EDR)</term>
                <term xml:lang="en">Windows</term>
                <term xml:lang="en">System calls</term>
                <term xml:lang="en">Machine learning</term>
              </keywords>
              <classCode scheme="halDomain" n="info.info-ni">Computer Science [cs]/Networking and Internet Architecture [cs.NI]</classCode>
              <classCode scheme="halTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halOldTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halTreeTypology" n="COMM">Conference papers</classCode>
            </textClass>
            <abstract xml:lang="en">
              <p>Detecting malware remains a significant challenge, as malware authors constantly develop new techniques to evade traditional signature-based and heuristic-based detection methods. This paper proposes a novel approach to malware detection that analyzes patterns in Windows system calls sequences to identify malicious behaviors. We use a voting classifier, a machine learning model that aggregates predictions from multiple individual models. It determines the final output based on the class that receives the highest likelihood or majority vote from the ensemble of models. We trained the model on large datasets of benign and malicious system call traces to detect anomalies indicative of malware. By focusing on system call behavior rather than static code characteristics, the approach is able to identify novel malware variants without requiring prior knowledge of their signatures. Experiments using a dataset of 42,797 API call sequences from malware samples and 1,079 sequences from benign software demonstrate that voting classifier can achieve high detectionrates while maintaining low false positive rates. This type of Machine Learning-based malware detection could be integrated into an Endpoint Detection and Response (EDR) tool to provide advanced, behavior-based malware detection capabilities.</p>
            </abstract>
          </profileDesc>
        </biblFull>
      </listBibl>
    </body>
    <back>
      <listOrg type="structures">
        <org type="regroupinstitution" xml:id="struct-563936" status="VALID">
          <idno type="IdRef">238327159</idno>
          <idno type="ISNI">0000000502717600</idno>
          <idno type="ROR">https://ror.org/042tfbd02</idno>
          <idno type="Wikidata">Q48759778</idno>
          <orgName>Institut Polytechnique de Paris</orgName>
          <orgName type="acronym">IP Paris</orgName>
          <date type="start">2019-06-02</date>
          <desc>
            <address>
              <addrLine>Route de Saclay, 91120 Palaiseau Cedex, France</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.ip-paris.fr</ref>
          </desc>
        </org>
        <org type="department" xml:id="struct-95600" status="VALID">
          <orgName>Département Réseaux et Services de Télécommunications</orgName>
          <orgName type="acronym">TSP - RST</orgName>
          <desc>
            <address>
              <addrLine>Télécom SudParis - 9 rue Charles Fourier - 91011 Évry cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://rst.telecom-sudparis.eu/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-352124" type="direct"/>
            <relation active="#struct-302102" type="indirect"/>
            <relation name="563936" active="#struct-563936" type="indirect"/>
          </listRelation>
        </org>
        <org type="researchteam" xml:id="struct-1101446" status="VALID">
          <orgName>Sécurité et Confiance Numérique</orgName>
          <orgName type="acronym">SCN-SAMOVAR</orgName>
          <date type="start">2022-06-01</date>
          <desc>
            <address>
              <addrLine>Télécom Sudparis, 9 rue Charles Fourier -91011 Evry-Courcouronnes cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://samovar.telecom-sudparis.eu/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-638" type="direct"/>
            <relation active="#struct-352124" type="indirect"/>
            <relation active="#struct-302102" type="indirect"/>
            <relation name="563936" active="#struct-563936" type="indirect"/>
          </listRelation>
        </org>
        <org type="researchteam" xml:id="struct-1081156" status="VALID">
          <orgName>Cybersécurité et Cryptographie</orgName>
          <orgName type="acronym">C2</orgName>
          <date type="start">2021-10-07</date>
          <desc>
            <address>
              <addrLine>Télécom Paris 19 Place Marguerite Perey 91120 PALAISEAU. Fusion de: CCN, Cybersecurity for Communication and Networking et de MC2, Mathématiques discrètes, Codage et Cryptographie</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.telecom-paris.fr/fr/recherche/laboratoires/laboratoire-traitement-et-communication-de-linformation-ltci/les-equipes-de-recherche/cybersecurite-cryptographie-c2</ref>
          </desc>
          <listRelation>
            <relation name="484335" active="#struct-484335" type="direct"/>
            <relation active="#struct-302102" type="indirect"/>
            <relation active="#struct-1048346" type="indirect"/>
            <relation active="#struct-563936" type="indirect"/>
          </listRelation>
        </org>
        <org type="department" xml:id="struct-121818" status="VALID">
          <orgName>Département Informatique et Réseaux</orgName>
          <orgName type="acronym">INFRES</orgName>
          <desc>
            <address>
              <addrLine>46, rue Barrault 75013 Paris</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.telecom-paris.fr/fr/recherche/laboratoires/laboratoire-traitement-et-communication-de-linformation-ltci/les-departements-denseignement-et-recherche</ref>
          </desc>
          <listRelation>
            <relation active="#struct-300362" type="direct"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-352124" status="VALID">
          <idno type="IdRef">162347510</idno>
          <idno type="ISNI">0000000406406351</idno>
          <idno type="ROR">https://ror.org/05xvk4r52</idno>
          <idno type="Wikidata">Q43305</idno>
          <orgName>Télécom SudParis</orgName>
          <orgName type="acronym">TSP</orgName>
          <desc>
            <address>
              <addrLine>9 rue Charles Fourier -91011 Evry Cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.telecom-sudparis.eu/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-302102" type="direct"/>
            <relation name="563936" active="#struct-563936" type="direct"/>
          </listRelation>
        </org>
        <org type="regroupinstitution" xml:id="struct-302102" status="VALID">
          <idno type="IdRef">192427156</idno>
          <idno type="ISNI">000000012202567X</idno>
          <idno type="ROR">https://ror.org/025vp2923</idno>
          <idno type="Wikidata">Q27962533</idno>
          <orgName>Institut Mines-Télécom [Paris]</orgName>
          <orgName type="acronym">IMT</orgName>
          <date type="start">2012-03-01</date>
          <desc>
            <address>
              <addrLine>19 Place Marguerite Perey, 91120 Palaiseau</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.imt.fr/</ref>
          </desc>
        </org>
        <org type="laboratory" xml:id="struct-638" status="VALID">
          <idno type="IdRef">281286515</idno>
          <idno type="ISNI">0000000403830480</idno>
          <idno type="RNSR">200319330C</idno>
          <orgName>Services répartis, Architectures, MOdélisation, Validation, Administration des Réseaux</orgName>
          <orgName type="acronym">SAMOVAR</orgName>
          <desc>
            <address>
              <addrLine>Télécom Sudparis, 9 rue Charles Fourier -91011 Evry cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://samovar.telecom-sudparis.eu/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-352124" type="direct"/>
            <relation active="#struct-302102" type="indirect"/>
            <relation name="563936" active="#struct-563936" type="indirect"/>
          </listRelation>
        </org>
        <org type="laboratory" xml:id="struct-484335" status="VALID">
          <idno type="IdRef">162384270</idno>
          <idno type="ISNI">0000 0000 9194 9502</idno>
          <idno type="RNSR">200319327Z</idno>
          <idno type="ROR">https://ror.org/057er4c39</idno>
          <orgName>Laboratoire Traitement et Communication de l'Information</orgName>
          <orgName type="acronym">LTCI</orgName>
          <date type="start">2017-01-01</date>
          <desc>
            <address>
              <addrLine>Télécom Paris 19 Place Marguerite Perey 91120 PALAISEAU</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.telecom-paris.fr/fr/recherche/laboratoires/laboratoire-traitement-et-communication-de-linformation-ltci</ref>
          </desc>
          <listRelation>
            <relation active="#struct-302102" type="direct"/>
            <relation active="#struct-1048346" type="direct"/>
            <relation active="#struct-563936" type="indirect"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-1048346" status="VALID">
          <idno type="IdRef">026375273</idno>
          <idno type="ISNI">0000 0001 2108 2779</idno>
          <idno type="ROR">https://ror.org/01naq7912</idno>
          <orgName>Télécom Paris</orgName>
          <date type="start">2019-06-12</date>
          <desc>
            <address>
              <addrLine>19 Place Marguerite Perey 91120 Palaiseau</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.telecom-paris.fr</ref>
          </desc>
          <listRelation>
            <relation active="#struct-302102" type="direct"/>
            <relation active="#struct-563936" type="direct"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-300362" status="VALID">
          <idno type="ROR">https://ror.org/01naq7912</idno>
          <orgName>Télécom ParisTech</orgName>
          <date type="start">2008-01-01</date>
          <date type="end">2019-06-11</date>
          <desc>
            <address>
              <addrLine>46 rue Barrault 75634 Paris Cedex 13</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.telecom-paris.fr</ref>
          </desc>
        </org>
      </listOrg>
    </back>
  </text>
</TEI>