{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,14]],"date-time":"2026-04-14T18:19:43Z","timestamp":1776190783145,"version":"3.50.1"},"reference-count":42,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/linproxy.fan.workers.dev:443\/https\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/linproxy.fan.workers.dev:443\/https\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/linproxy.fan.workers.dev:443\/https\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/linproxy.fan.workers.dev:443\/https\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/linproxy.fan.workers.dev:443\/https\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/linproxy.fan.workers.dev:443\/https\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/linproxy.fan.workers.dev:443\/https\/doi.org\/10.15223\/policy-004"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62102190"],"award-info":[{"award-number":["62102190"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100002701","name":"Ministry of Education","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100002701","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100008045","name":"Nanjing University of Information Science and Technology","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100008045","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Expert Systems with Applications"],"published-print":{"date-parts":[[2026,6]]},"DOI":"10.1016\/j.eswa.2026.131781","type":"journal-article","created":{"date-parts":[[2026,2,21]],"date-time":"2026-02-21T16:14:23Z","timestamp":1771690463000},"page":"131781","update-policy":"https:\/\/linproxy.fan.workers.dev:443\/https\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["Dynamic malware detection based on enhanced semantic API sequence features"],"prefix":"10.1016","volume":"315","author":[{"ORCID":"https:\/\/linproxy.fan.workers.dev:443\/https\/orcid.org\/0000-0002-9541-1894","authenticated-orcid":false,"given":"Zhiguo","family":"Chen","sequence":"first","affiliation":[]},{"ORCID":"https:\/\/linproxy.fan.workers.dev:443\/https\/orcid.org\/0009-0001-2978-4617","authenticated-orcid":false,"given":"Lei","family":"Zhou","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/linproxy.fan.workers.dev:443\/https\/orcid.org\/0009-0005-0736-897X","authenticated-orcid":false,"given":"Qingcheng","family":"Liu","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/linproxy.fan.workers.dev:443\/https\/orcid.org\/0000-0003-4384-5786","authenticated-orcid":false,"given":"Weizhi","family":"Meng","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/linproxy.fan.workers.dev:443\/https\/orcid.org\/0000-0003-4067-8230","authenticated-orcid":false,"given":"Jian","family":"Weng","sequence":"additional","affiliation":[]}],"member":"78","reference":[{"key":"10.1016\/j.eswa.2026.131781_bib0001","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2020.101760","article-title":"A dynamic windows malware detection and prediction method based on contextual understanding of API call sequence","volume":"92","author":"Amer","year":"2020","journal-title":"Computers & Security"},{"key":"10.1016\/j.eswa.2026.131781_bib0002","unstructured":"Av-test (2023). [Online]. https:\/\/linproxy.fan.workers.dev:443\/https\/portal.av-atlas.org\/malware."},{"key":"10.1016\/j.eswa.2026.131781_bib0003","series-title":"International conference on learning representations","article-title":"BEit: BERT pre-training of image transformers","author":"Bao","year":"2022"},{"key":"10.1016\/j.eswa.2026.131781_bib0004","unstructured":"Catak, F. O., & Yaz\u0131, A. F. (2019). A benchmark API call dataset for windows PE malware classification. arXiv preprint arXiv: 1905.01999."},{"key":"10.1016\/j.eswa.2026.131781_bib0005","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2023.103518","article-title":"CTIMD: Cyber threat intelligence enhanced malware detection using API call sequences with parameters","volume":"136","author":"Chen","year":"2024","journal-title":"Computers & Security"},{"key":"10.1016\/j.eswa.2026.131781_bib0006","doi-asserted-by":"crossref","first-page":"788","DOI":"10.1109\/TIFS.2022.3152360","article-title":"CruParamer: Learning on parameter-augmented API sequences for malware detection","volume":"17","author":"Chen","year":"2022","journal-title":"IEEE Transactions on Information Forensics and Security"},{"key":"10.1016\/j.eswa.2026.131781_bib0007","series-title":"2022 IEEE symposium on computers and communications (ISCC)","first-page":"01","article-title":"Malpro: Learning on process-aware behaviors for malware detection","author":"Chen","year":"2022"},{"key":"10.1016\/j.eswa.2026.131781_bib0008","unstructured":"Cloud, A. (2018). Alibaba cloud malware detection based on behaviors. https:\/\/linproxy.fan.workers.dev:443\/https\/tianchi.aliyun.com\/getStart\/information.htm?raceId=231694. Online; accessed 11-November-2018."},{"key":"10.1016\/j.eswa.2026.131781_bib0009","series-title":"Proceedings of the 32nd ACM SIGSOFT international symposium on software testing and analysis","first-page":"261","article-title":"Api2vec: Learning representations of API sequences for malware detection","author":"Cui","year":"2023"},{"key":"10.1016\/j.eswa.2026.131781_bib0010","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2022.102846","article-title":"An ensemble of pre-trained transformer models for imbalanced multiclass malware classification","volume":"121","author":"Demirk\u0131ran","year":"2022","journal-title":"Computers & Security"},{"key":"10.1016\/j.eswa.2026.131781_bib0011","doi-asserted-by":"crossref","unstructured":"Devlin, J., Chang, M.-W., Lee, K., & Toutanova, K. (2019). BERT: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of the 2019 conference of the North American chapter of the association for computational linguistics: human language technologies, volume 1 (long and short papers). (pp. 4171\u20134186).","DOI":"10.18653\/v1\/N19-1423"},{"key":"10.1016\/j.eswa.2026.131781_bib0012","series-title":"2022 IEEE International conference on trust, security and privacy in computing and communications (trustcom)","first-page":"175","article-title":"Mal-BERT-GCN: Malware detection by combining BERT and GCN","author":"Ding","year":"2022"},{"issue":"1","key":"10.1016\/j.eswa.2026.131781_bib0013","article-title":"Toward detecting malware based on process-aware behaviors","volume":"2023","author":"Du","year":"2023","journal-title":"Security and Communication Networks"},{"key":"10.1016\/j.eswa.2026.131781_bib0014","doi-asserted-by":"crossref","first-page":"62","DOI":"10.1016\/j.cose.2014.07.004","article-title":"Enhancing the detection of metamorphic malware using call graphs","volume":"46","author":"Elhadi","year":"2014","journal-title":"Computers & Security"},{"key":"10.1016\/j.eswa.2026.131781_bib0015","doi-asserted-by":"crossref","DOI":"10.7717\/peerj-cs.2946","article-title":"A malware detection method with function parameters encoding and function dependency modeling","volume":"11","author":"Hou","year":"2025","journal-title":"PeerJ Computer Science"},{"issue":"6","key":"10.1016\/j.eswa.2026.131781_bib0016","doi-asserted-by":"crossref","DOI":"10.1155\/2015\/659101","article-title":"A novel approach to detect malware based on API call sequence analysis","volume":"11","author":"Ki","year":"2015","journal-title":"International Journal of Distributed Sensor Networks"},{"key":"10.1016\/j.eswa.2026.131781_bib0017","doi-asserted-by":"crossref","first-page":"2083","DOI":"10.1109\/TIFS.2025.3531230","article-title":"D24d: Dynamic deep 4-dimensional analysis for malware detection","volume":"116","author":"Koppanati","year":"2025","journal-title":"IEEE Transactions on Information Forensics and Security"},{"key":"10.1016\/j.eswa.2026.131781_bib0018","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2022.102872","article-title":"DMalNet: Dynamic malware analysis based on API feature engineering and graph learning","volume":"122","author":"Li","year":"2022","journal-title":"Computers & Security"},{"key":"10.1016\/j.eswa.2026.131781_bib0019","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2022.102686","article-title":"A novel deep framework for dynamic malware detection based on API sequence intrinsic features","volume":"116","author":"Li","year":"2022","journal-title":"Computers & Security"},{"issue":"15","key":"10.1016\/j.eswa.2026.131781_bib0020","doi-asserted-by":"crossref","first-page":"13288","DOI":"10.1609\/aaai.v35i15.17569","article-title":"Merging statistical feature via adaptive gate for improved text classification","volume":"35","author":"Li","year":"2021","journal-title":"Proceedings of the AAAI Conference on Artificial Intelligence"},{"key":"10.1016\/j.eswa.2026.131781_bib0021","unstructured":"Malicious-code-dataset (2019). [Online]. https:\/\/linproxy.fan.workers.dev:443\/https\/github.com\/kericwy1337."},{"key":"10.1016\/j.eswa.2026.131781_bib0022","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2023.103134","article-title":"Adversarial attacks against windows PE malware detection: A survey of the state-of-the-art","volume":"128","author":"Ling","year":"2023","journal-title":"Computers & Security"},{"key":"10.1016\/j.eswa.2026.131781_bib0023","unstructured":"Liu, Y., Ott, M., Goyal, N., Du, J., Joshi, M., Chen, D., Levy, O., Lewis, M., Zettlemoyer, L., & Stoyanov, V. (2019). RoBERTa: A robustly optimized BERT pretraining approach. arXiv preprint arXiv: 1907.11692."},{"issue":"2","key":"10.1016\/j.eswa.2026.131781_bib0024","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3605943","article-title":"Recent advances in natural language processing via large pre-trained language models: A survey","volume":"56","author":"Min","year":"2023","journal-title":"ACM Computing Surveys"},{"issue":"2","key":"10.1016\/j.eswa.2026.131781_bib0025","doi-asserted-by":"crossref","first-page":"621","DOI":"10.1109\/TSE.2025.3531210","article-title":"Mecha: A neural-symbolic open-set homogeneous decision fusion approach for zero-day malware similarity detection","volume":"51","author":"Molloy","year":"2025","journal-title":"IEEE Transactions on Software Engineering"},{"key":"10.1016\/j.eswa.2026.131781_bib0026","doi-asserted-by":"crossref","DOI":"10.1016\/j.eswa.2024.126044","article-title":"Detection and prevention of evasion attacks on machine learning models","volume":"266","author":"Muthalagu","year":"2025","journal-title":"Expert Systems with Applications"},{"issue":"2","key":"10.1016\/j.eswa.2026.131781_bib0027","doi-asserted-by":"crossref","first-page":"239","DOI":"10.3390\/app9020239","article-title":"Cross-method-based analysis and classification of malicious behavior by API calls extraction","volume":"9","author":"Ndibanje","year":"2019","journal-title":"Applied Sciences"},{"key":"10.1016\/j.eswa.2026.131781_bib0028","series-title":"ICLR 2021-9th international conference on learning representations","first-page":"1","article-title":"Structured prediction as translation between augmented natural languages","author":"Paolini","year":"2021"},{"key":"10.1016\/j.eswa.2026.131781_bib0029","series-title":"Proceedings of the 36th annual computer security applications conference","first-page":"54","article-title":"Advanced windows methods on malware detection and classification","author":"Rabadi","year":"2020"},{"key":"10.1016\/j.eswa.2026.131781_bib0030","series-title":"Proceedings of the 2010 ACM symposium on applied computing","first-page":"1020","article-title":"Malware detection based on mining API calls","author":"Sami","year":"2010"},{"key":"10.1016\/j.eswa.2026.131781_bib0031","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1016\/j.cosrev.2019.01.002","article-title":"A survey on malware analysis and mitigation techniques","volume":"32","author":"Sibi Chakkaravarthy","year":"2019","journal-title":"Computer Science Review"},{"key":"10.1016\/j.eswa.2026.131781_bib0032","doi-asserted-by":"crossref","DOI":"10.1016\/j.infsof.2020.106273","article-title":"Detection of malicious software by analyzing the behavioral artifacts using machine learning algorithms","volume":"121","author":"Singh","year":"2020","journal-title":"Information and Software Technology"},{"key":"10.1016\/j.eswa.2026.131781_bib0033","doi-asserted-by":"crossref","DOI":"10.1016\/j.sysarc.2020.101861","article-title":"A survey on machine learning-based malware detection in executable files","volume":"112","author":"Singh","year":"2021","journal-title":"Journal of Systems Architecture"},{"key":"10.1016\/j.eswa.2026.131781_bib0034","series-title":"2010 5th international conference on malicious and unwanted software","first-page":"23","article-title":"Differentiating malware from cleanware using behavioural analysis","author":"Tian","year":"2010"},{"issue":"3","key":"10.1016\/j.eswa.2026.131781_bib0035","doi-asserted-by":"crossref","first-page":"1359","DOI":"10.1109\/TSE.2022.3176674","article-title":"Software updates strategies: A quantitative evaluation against advanced persistent threats","volume":"49","author":"Tizio","year":"2023","journal-title":"IEEE Transactions on Software Engineering"},{"key":"10.1016\/j.eswa.2026.131781_bib0036","doi-asserted-by":"crossref","first-page":"6155","DOI":"10.1109\/TIFS.2024.3409083","article-title":"Nebula: Self-attention for dynamic malware analysis","volume":"19","author":"Trizna","year":"2024","journal-title":"IEEE Transactions on Information Forensics and Security"},{"key":"10.1016\/j.eswa.2026.131781_bib0037","doi-asserted-by":"crossref","first-page":"99","DOI":"10.1016\/j.comnet.2019.04.007","article-title":"ASSCA: API sequence and statistics features combined architecture for malware detection","volume":"157","author":"Xiaofeng","year":"2019","journal-title":"Computer Networks"},{"key":"10.1016\/j.eswa.2026.131781_bib0038","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2021.102458","article-title":"MalBERT: A novel pre-training method for malware detection","volume":"111","author":"Xu","year":"2021","journal-title":"Computers & Security"},{"key":"10.1016\/j.eswa.2026.131781_bib0039","series-title":"Proceedings of the 59th annual meeting of the association for computational linguistics and the 11th international joint conference on natural language processing (volume 1: Long papers)","first-page":"2416","article-title":"A unified generative framework for aspect-based sentiment analysis","author":"Yan","year":"2021"},{"key":"10.1016\/j.eswa.2026.131781_bib0040","doi-asserted-by":"crossref","first-page":"148853","DOI":"10.1109\/ACCESS.2019.2946482","article-title":"A novel solutions for malicious code detection and family clustering based on machine learning","volume":"7","author":"Yang","year":"2019","journal-title":"IEEE Access"},{"key":"10.1016\/j.eswa.2026.131781_bib0041","series-title":"Proceedings of the 2020 ACM SIGSAC conference on computer and communications security","first-page":"757","article-title":"Enhancing state-of-the-art classifiers with API semantics to detect evolved android malware","author":"Zhang","year":"2020"},{"key":"10.1016\/j.eswa.2026.131781_bib0042","series-title":"Proceedings of the AAAI conference on artificial intelligence","first-page":"1210","article-title":"Dynamic malware analysis with feature engineering and feature learning","volume":"vol. 34","author":"Zhang","year":"2020"}],"container-title":["Expert Systems with Applications"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/linproxy.fan.workers.dev:443\/https\/api.elsevier.com\/content\/article\/PII:S0957417426006949?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/linproxy.fan.workers.dev:443\/https\/api.elsevier.com\/content\/article\/PII:S0957417426006949?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,4,14]],"date-time":"2026-04-14T17:27:35Z","timestamp":1776187655000},"score":1,"resource":{"primary":{"URL":"https:\/\/linproxy.fan.workers.dev:443\/https\/linkinghub.elsevier.com\/retrieve\/pii\/S0957417426006949"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,6]]},"references-count":42,"alternative-id":["S0957417426006949"],"URL":"https:\/\/linproxy.fan.workers.dev:443\/https\/doi.org\/10.1016\/j.eswa.2026.131781","relation":{},"ISSN":["0957-4174"],"issn-type":[{"value":"0957-4174","type":"print"}],"subject":[],"published":{"date-parts":[[2026,6]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"Dynamic malware detection based on enhanced semantic API sequence features","name":"articletitle","label":"Article Title"},{"value":"Expert Systems with Applications","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/linproxy.fan.workers.dev:443\/https\/doi.org\/10.1016\/j.eswa.2026.131781","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 Elsevier Ltd. All rights are reserved, including those for text and data mining, AI training, and similar technologies.","name":"copyright","label":"Copyright"}],"article-number":"131781"}}