21 citations · 48 across the 10 of their papers we have counts for
12 papers
Decoding the Secrets of Machine Learning in Malware Classification: A Deep Dive into Datasets, Feature Extraction, and Model Performance
Savino Dambra, Yufei Han, Simone Aonzo +5
Many studies have proposed machine-learning (ML) models for malware detection and classification, reporting an almost-perfect performance. However, they assemble ground-truth in di…
One Size Does not Fit All: Quantifying the Risk of Malicious App Encounters for Different Android User Profiles
Savino Dambra, Leyla Bilge, Platon Kotzias +2
Previous work has investigated the particularities of security practices within specific user communities defined based on country of origin, age, prior tech abuse, and economic st…
A Deep Dive into VirusTotal: Characterizing and Clustering a Massive File Feed
Kevin van Liebergen, Juan Caballero, Platon Kotzias +1
Online scanners analyze user-submitted files with a large number of security tools and provide access to the analysis results. As the most popular online scanner, VirusTotal (VT) i…
Watch Your Back: Identifying Cybercrime Financial Relationships in Bitcoin through Back-and-Forth Exploration
Gibran Gomez, Pedro Moreno-Sanchez, Juan Caballero
Cybercriminals often leverage Bitcoin for their illicit activities. In this work, we propose back-and-forth exploration, a novel automated Bitcoin transaction tracing technique to…
Unsupervised Detection and Clustering of Malicious TLS Flows
Gibran Gomez, Platon Kotzias, Matteo Dell'Amico +2
Malware abuses TLS to encrypt its malicious traffic, preventing examination by content signatures and deep packet inspection. Network detection of malicious TLS flows is an importa…
Malware Traffic Classification: Evaluation of Algorithms and an Automated Ground-truth Generation Pipeline
Syed Muhammad Kumail Raza, Juan Caballero
Identifying threats in a network traffic flow which is encrypted is uniquely challenging. On one hand it is extremely difficult to simply decrypt the traffic due to modern encrypti…
How Did That Get In My Phone? Unwanted App Distribution on Android Devices
Platon Kotzias, Juan Caballero, Leyla Bilge
Android is the most popular operating system with billions of active devices. Unfortunately, its popularity and openness makes it attractive for unwanted apps, i.e., malware and po…
AVClass2: Massive Malware Tag Extraction from AV Labels
Silvia Sebastián, Juan Caballero
Tags can be used by malware repositories and analysis services to enable searches for samples of interest across different dimensions. Automatically extracting tags from AV labels…
A Survey of Binary Code Similarity
Irfan Ul Haq, Juan Caballero
Binary code similarity approaches compare two or more pieces of binary code to identify their similarities and differences. The ability to compare binary code enables many real-wor…
Cross-Origin State Inference (COSI) Attacks: Leaking Web Site States through XS-Leaks
Avinash Sudhodanan, Soheil Khodayari, Juan Caballero
In a Cross-Origin State Inference (COSI) attack, an attacker convinces a victim into visiting an attack web page, which leverages the cross-origin interaction features of the victi…
The MalSource Dataset: Quantifying Complexity and Code Reuse in Malware Development
Alejandro Calleja, Juan Tapiador, Juan Caballero
During the last decades, the problem of malicious and unwanted software (malware) has surged in numbers and sophistication. Malware plays a key role in most of today's cyber attack…
Malware Lineage in the Wild
Irfan Ul Haq, Sergio Chica, Juan Caballero +1
Malware lineage studies the evolutionary relationships among malware and has important applications for malware analysis. A persistent limitation of prior malware lineage approache…