id sid tid token lemma pos fcis-13109 1 1 frontiers frontier NOUN fcis-13109 1 2 in in ADP fcis-13109 1 3 computing computing NOUN fcis-13109 1 4 and and CCONJ fcis-13109 1 5 intelligent intelligent ADJ fcis-13109 1 6 systems system NOUN fcis-13109 1 7 issn issn VERB fcis-13109 1 8 : : PUNCT fcis-13109 1 9 2832 2832 NUM fcis-13109 1 10 - - SYM fcis-13109 1 11 6024 6024 NUM fcis-13109 1 12 | | NOUN fcis-13109 1 13 vol vol NOUN fcis-13109 1 14 . . PROPN fcis-13109 2 1 5 5 NUM fcis-13109 2 2 , , PUNCT fcis-13109 2 3 no no INTJ fcis-13109 2 4 . . NOUN fcis-13109 2 5 2 2 NUM fcis-13109 2 6 , , PUNCT fcis-13109 2 7 2023 2023 NUM fcis-13109 2 8 104 104 NUM fcis-13109 2 9 survey survey NOUN fcis-13109 2 10 of of ADP fcis-13109 2 11 malicious malicious ADJ fcis-13109 2 12 pdf pdf NOUN fcis-13109 2 13 attacks attack NOUN fcis-13109 2 14 shuhan shuhan ADP fcis-13109 2 15 wang wang PROPN fcis-13109 2 16 * * PUNCT fcis-13109 2 17 department department PROPN fcis-13109 2 18 of of ADP fcis-13109 2 19 computer computer NOUN fcis-13109 2 20 science science NOUN fcis-13109 2 21 , , PUNCT fcis-13109 2 22 southwest southwest PROPN fcis-13109 2 23 jiaotong jiaotong PROPN fcis-13109 2 24 university university PROPN fcis-13109 2 25 , , PUNCT fcis-13109 2 26 chengdu chengdu PROPN fcis-13109 2 27 610031 610031 NUM fcis-13109 2 28 , , PUNCT fcis-13109 2 29 china china PROPN fcis-13109 2 30 * * PUNCT fcis-13109 2 31 corresponding correspond VERB fcis-13109 2 32 author author NOUN fcis-13109 2 33 email email NOUN fcis-13109 2 34 : : PUNCT fcis-13109 2 35 sc21s2w@leeds.ac.uk sc21s2w@leeds.ac.uk PROPN fcis-13109 2 36 abstract abstract ADJ fcis-13109 2 37 : : PUNCT fcis-13109 2 38 in in ADP fcis-13109 2 39 recent recent ADJ fcis-13109 2 40 years year NOUN fcis-13109 2 41 , , PUNCT fcis-13109 2 42 malicious malicious ADJ fcis-13109 2 43 documents document NOUN fcis-13109 2 44 have have AUX fcis-13109 2 45 gained gain VERB fcis-13109 2 46 widespread widespread ADJ fcis-13109 2 47 attention attention NOUN fcis-13109 2 48 as as ADP fcis-13109 2 49 one one NUM fcis-13109 2 50 of of ADP fcis-13109 2 51 the the DET fcis-13109 2 52 primary primary ADJ fcis-13109 2 53 vectors vector NOUN fcis-13109 2 54 for for ADP fcis-13109 2 55 advanced advanced ADJ fcis-13109 2 56 persistent persistent ADJ fcis-13109 2 57 threat threat NOUN fcis-13109 2 58 ( ( PUNCT fcis-13109 2 59 apt apt ADJ fcis-13109 2 60 ) ) PUNCT fcis-13109 2 61 attacks attack NOUN fcis-13109 2 62 . . PUNCT fcis-13109 3 1 these these DET fcis-13109 3 2 malicious malicious ADJ fcis-13109 3 3 document document NOUN fcis-13109 3 4 attacks attack NOUN fcis-13109 3 5 employ employ VERB fcis-13109 3 6 various various ADJ fcis-13109 3 7 sophisticated sophisticated ADJ fcis-13109 3 8 techniques technique NOUN fcis-13109 3 9 , , PUNCT fcis-13109 3 10 including include VERB fcis-13109 3 11 stream stream NOUN fcis-13109 3 12 object object NOUN fcis-13109 3 13 attacks attack NOUN fcis-13109 3 14 , , PUNCT fcis-13109 3 15 embedded embed VERB fcis-13109 3 16 javascript javascript NOUN fcis-13109 3 17 , , PUNCT fcis-13109 3 18 information information NOUN fcis-13109 3 19 entropy entropy NOUN fcis-13109 3 20 attacks attack NOUN fcis-13109 3 21 , , PUNCT fcis-13109 3 22 and and CCONJ fcis-13109 3 23 machine machine NOUN fcis-13109 3 24 learning learning NOUN fcis-13109 3 25 . . PUNCT fcis-13109 4 1 therefore therefore ADV fcis-13109 4 2 , , PUNCT fcis-13109 4 3 it it PRON fcis-13109 4 4 is be AUX fcis-13109 4 5 essential essential ADJ fcis-13109 4 6 to to PART fcis-13109 4 7 pay pay VERB fcis-13109 4 8 attention attention NOUN fcis-13109 4 9 to to ADP fcis-13109 4 10 the the DET fcis-13109 4 11 existing exist VERB fcis-13109 4 12 research research NOUN fcis-13109 4 13 findings finding NOUN fcis-13109 4 14 and and CCONJ fcis-13109 4 15 trends trend NOUN fcis-13109 4 16 . . PUNCT fcis-13109 5 1 stream stream NOUN fcis-13109 5 2 object object NOUN fcis-13109 5 3 attacks attack NOUN fcis-13109 5 4 leverage leverage NOUN fcis-13109 5 5 stream stream NOUN fcis-13109 5 6 objects object NOUN fcis-13109 5 7 in in ADP fcis-13109 5 8 pdf pdf NOUN fcis-13109 5 9 or or CCONJ fcis-13109 5 10 office office NOUN fcis-13109 5 11 documents document NOUN fcis-13109 5 12 to to PART fcis-13109 5 13 hide hide VERB fcis-13109 5 14 malicious malicious ADJ fcis-13109 5 15 code code NOUN fcis-13109 5 16 , , PUNCT fcis-13109 5 17 bypassing bypass VERB fcis-13109 5 18 traditional traditional ADJ fcis-13109 5 19 detection detection NOUN fcis-13109 5 20 methods method NOUN fcis-13109 5 21 . . PUNCT fcis-13109 6 1 embedded embed VERB fcis-13109 6 2 javascript javascript NOUN fcis-13109 6 3 executes execute VERB fcis-13109 6 4 malicious malicious ADJ fcis-13109 6 5 actions action NOUN fcis-13109 6 6 , , PUNCT fcis-13109 6 7 such such ADJ fcis-13109 6 8 as as ADP fcis-13109 6 9 downloading download VERB fcis-13109 6 10 malware malware NOUN fcis-13109 6 11 or or CCONJ fcis-13109 6 12 launching launch VERB fcis-13109 6 13 network network NOUN fcis-13109 6 14 attacks attack NOUN fcis-13109 6 15 . . PUNCT fcis-13109 7 1 information information NOUN fcis-13109 7 2 entropy entropy NOUN fcis-13109 7 3 attacks attack NOUN fcis-13109 7 4 utilize utilize VERB fcis-13109 7 5 the the DET fcis-13109 7 6 information information NOUN fcis-13109 7 7 entropy entropy NOUN fcis-13109 7 8 characteristics characteristic NOUN fcis-13109 7 9 within within ADP fcis-13109 7 10 documents document NOUN fcis-13109 7 11 to to PART fcis-13109 7 12 detect detect VERB fcis-13109 7 13 concealed conceal VERB fcis-13109 7 14 malicious malicious ADJ fcis-13109 7 15 activities activity NOUN fcis-13109 7 16 . . PUNCT fcis-13109 8 1 this this DET fcis-13109 8 2 article article NOUN fcis-13109 8 3 examines examine VERB fcis-13109 8 4 and and CCONJ fcis-13109 8 5 summarizes summarize VERB fcis-13109 8 6 the the DET fcis-13109 8 7 current current ADJ fcis-13109 8 8 status status NOUN fcis-13109 8 9 and and CCONJ fcis-13109 8 10 progress progress NOUN fcis-13109 8 11 in in ADP fcis-13109 8 12 each each DET fcis-13109 8 13 domain domain NOUN fcis-13109 8 14 . . PUNCT fcis-13109 9 1 in in ADP fcis-13109 9 2 conclusion conclusion NOUN fcis-13109 9 3 , , PUNCT fcis-13109 9 4 it it PRON fcis-13109 9 5 reviews review VERB fcis-13109 9 6 and and CCONJ fcis-13109 9 7 proposes propose VERB fcis-13109 9 8 research research NOUN fcis-13109 9 9 related relate VERB fcis-13109 9 10 to to ADP fcis-13109 9 11 embedded embed VERB fcis-13109 9 12 javascript javascript NOUN fcis-13109 9 13 , , PUNCT fcis-13109 9 14 information information NOUN fcis-13109 9 15 entropy entropy NOUN fcis-13109 9 16 attacks attack NOUN fcis-13109 9 17 , , PUNCT fcis-13109 9 18 and and CCONJ fcis-13109 9 19 machine machine NOUN fcis-13109 9 20 learning learning NOUN fcis-13109 9 21 . . PUNCT fcis-13109 10 1 keywords keyword NOUN fcis-13109 10 2 : : PUNCT fcis-13109 10 3 entropy entropy NOUN fcis-13109 10 4 attack attack NOUN fcis-13109 10 5 ; ; PUNCT fcis-13109 10 6 embedded embed VERB fcis-13109 10 7 javascript javascript NOUN fcis-13109 10 8 attack attack NOUN fcis-13109 10 9 ; ; PUNCT fcis-13109 10 10 stream stream NOUN fcis-13109 10 11 object object NOUN fcis-13109 10 12 attack attack NOUN fcis-13109 10 13 ; ; PUNCT fcis-13109 10 14 feature feature NOUN fcis-13109 10 15 extraction extraction NOUN fcis-13109 10 16 . . PUNCT fcis-13109 11 1 1 1 X fcis-13109 11 2 . . X fcis-13109 11 3 introduction introduction NOUN fcis-13109 11 4 in in ADP fcis-13109 11 5 today today NOUN fcis-13109 11 6 's 's PART fcis-13109 11 7 digital digital ADJ fcis-13109 11 8 age age NOUN fcis-13109 11 9 , , PUNCT fcis-13109 11 10 the the DET fcis-13109 11 11 threat threat NOUN fcis-13109 11 12 of of ADP fcis-13109 11 13 malicious malicious ADJ fcis-13109 11 14 documents document NOUN fcis-13109 11 15 is be AUX fcis-13109 11 16 becoming become VERB fcis-13109 11 17 increasingly increasingly ADV fcis-13109 11 18 severe severe ADJ fcis-13109 11 19 . . PUNCT fcis-13109 12 1 malicious malicious ADJ fcis-13109 12 2 documents document NOUN fcis-13109 12 3 refer refer VERB fcis-13109 12 4 to to ADP fcis-13109 12 5 files file NOUN fcis-13109 12 6 that that PRON fcis-13109 12 7 are be AUX fcis-13109 12 8 designed design VERB fcis-13109 12 9 to to PART fcis-13109 12 10 deceive deceive VERB fcis-13109 12 11 , , PUNCT fcis-13109 12 12 infect infect VERB fcis-13109 12 13 , , PUNCT fcis-13109 12 14 or or CCONJ fcis-13109 12 15 attack attack NOUN fcis-13109 12 16 computer computer NOUN fcis-13109 12 17 systems system NOUN fcis-13109 12 18 and and CCONJ fcis-13109 12 19 users user NOUN fcis-13109 12 20 , , PUNCT fcis-13109 12 21 such such ADJ fcis-13109 12 22 as as ADP fcis-13109 12 23 malware malware NOUN fcis-13109 12 24 , , PUNCT fcis-13109 12 25 viruses virus NOUN fcis-13109 12 26 , , PUNCT fcis-13109 12 27 spyware spyware NOUN fcis-13109 12 28 , , PUNCT fcis-13109 12 29 etc etc X fcis-13109 12 30 . . X fcis-13109 13 1 these these DET fcis-13109 13 2 malicious malicious ADJ fcis-13109 13 3 documents document NOUN fcis-13109 13 4 can can AUX fcis-13109 13 5 be be AUX fcis-13109 13 6 disseminated disseminate VERB fcis-13109 13 7 through through ADP fcis-13109 13 8 emails email NOUN fcis-13109 13 9 , , PUNCT fcis-13109 13 10 downloads download NOUN fcis-13109 13 11 , , PUNCT fcis-13109 13 12 web web NOUN fcis-13109 13 13 links link NOUN fcis-13109 13 14 , , PUNCT fcis-13109 13 15 or or CCONJ fcis-13109 13 16 portable portable ADJ fcis-13109 13 17 devices device NOUN fcis-13109 13 18 , , PUNCT fcis-13109 13 19 posing pose VERB fcis-13109 13 20 a a DET fcis-13109 13 21 significant significant ADJ fcis-13109 13 22 threat threat NOUN fcis-13109 13 23 to to ADP fcis-13109 13 24 the the DET fcis-13109 13 25 information information NOUN fcis-13109 13 26 security security NOUN fcis-13109 13 27 of of ADP fcis-13109 13 28 individual individual ADJ fcis-13109 13 29 users user NOUN fcis-13109 13 30 , , PUNCT fcis-13109 13 31 businesses business NOUN fcis-13109 13 32 , , PUNCT fcis-13109 13 33 and and CCONJ fcis-13109 13 34 organizations organization NOUN fcis-13109 13 35 . . PUNCT fcis-13109 14 1 with with ADP fcis-13109 14 2 the the DET fcis-13109 14 3 widespread widespread ADJ fcis-13109 14 4 application application NOUN fcis-13109 14 5 of of ADP fcis-13109 14 6 artificial artificial ADJ fcis-13109 14 7 intelligence intelligence NOUN fcis-13109 14 8 ( ( PUNCT fcis-13109 14 9 ai ai NOUN fcis-13109 14 10 ) ) PUNCT fcis-13109 14 11 across across ADP fcis-13109 14 12 various various ADJ fcis-13109 14 13 fields field NOUN fcis-13109 14 14 , , PUNCT fcis-13109 14 15 we we PRON fcis-13109 14 16 have have AUX fcis-13109 14 17 enjoyed enjoy VERB fcis-13109 14 18 many many ADJ fcis-13109 14 19 conveniences convenience NOUN fcis-13109 14 20 . . PUNCT fcis-13109 15 1 however however ADV fcis-13109 15 2 , , PUNCT fcis-13109 15 3 this this PRON fcis-13109 15 4 has have AUX fcis-13109 15 5 also also ADV fcis-13109 15 6 brought bring VERB fcis-13109 15 7 about about ADP fcis-13109 15 8 an an DET fcis-13109 15 9 increase increase NOUN fcis-13109 15 10 in in ADP fcis-13109 15 11 malicious malicious ADJ fcis-13109 15 12 attacks attack NOUN fcis-13109 15 13 , , PUNCT fcis-13109 15 14 especially especially ADV fcis-13109 15 15 threats threat NOUN fcis-13109 15 16 propagated propagate VERB fcis-13109 15 17 through through ADP fcis-13109 15 18 malicious malicious ADJ fcis-13109 15 19 documents document NOUN fcis-13109 15 20 . . PUNCT fcis-13109 16 1 the the DET fcis-13109 16 2 purpose purpose NOUN fcis-13109 16 3 of of ADP fcis-13109 16 4 this this DET fcis-13109 16 5 review review NOUN fcis-13109 16 6 is be AUX fcis-13109 16 7 to to PART fcis-13109 16 8 explore explore VERB fcis-13109 16 9 the the DET fcis-13109 16 10 issues issue NOUN fcis-13109 16 11 , , PUNCT fcis-13109 16 12 methods method NOUN fcis-13109 16 13 , , PUNCT fcis-13109 16 14 and and CCONJ fcis-13109 16 15 latest late ADJ fcis-13109 16 16 developments development NOUN fcis-13109 16 17 in in ADP fcis-13109 16 18 malicious malicious ADJ fcis-13109 16 19 document document NOUN fcis-13109 16 20 detection detection NOUN fcis-13109 16 21 . . PUNCT fcis-13109 17 1 this this PRON fcis-13109 17 2 aims aim VERB fcis-13109 17 3 to to PART fcis-13109 17 4 enhance enhance VERB fcis-13109 17 5 the the DET fcis-13109 17 6 understanding understanding NOUN fcis-13109 17 7 of of ADP fcis-13109 17 8 the the DET fcis-13109 17 9 threat threat NOUN fcis-13109 17 10 of of ADP fcis-13109 17 11 malicious malicious ADJ fcis-13109 17 12 documents document NOUN fcis-13109 17 13 and and CCONJ fcis-13109 17 14 provide provide VERB fcis-13109 17 15 researchers researcher NOUN fcis-13109 17 16 , , PUNCT fcis-13109 17 17 security security NOUN fcis-13109 17 18 experts expert NOUN fcis-13109 17 19 , , PUNCT fcis-13109 17 20 and and CCONJ fcis-13109 17 21 decision decision NOUN fcis-13109 17 22 - - PUNCT fcis-13109 17 23 makers maker NOUN fcis-13109 17 24 with with ADP fcis-13109 17 25 a a DET fcis-13109 17 26 comprehensive comprehensive ADJ fcis-13109 17 27 overview overview NOUN fcis-13109 17 28 of of ADP fcis-13109 17 29 malicious malicious ADJ fcis-13109 17 30 document document NOUN fcis-13109 17 31 detection detection NOUN fcis-13109 17 32 . . PUNCT fcis-13109 18 1 detecting detect VERB fcis-13109 18 2 malicious malicious ADJ fcis-13109 18 3 documents document NOUN fcis-13109 18 4 is be AUX fcis-13109 18 5 vital vital ADJ fcis-13109 18 6 for for ADP fcis-13109 18 7 protecting protect VERB fcis-13109 18 8 individual individual ADJ fcis-13109 18 9 privacy privacy NOUN fcis-13109 18 10 , , PUNCT fcis-13109 18 11 corporate corporate ADJ fcis-13109 18 12 secrets secret NOUN fcis-13109 18 13 , , PUNCT fcis-13109 18 14 and and CCONJ fcis-13109 18 15 national national ADJ fcis-13109 18 16 security security NOUN fcis-13109 18 17 . . PUNCT fcis-13109 19 1 by by ADP fcis-13109 19 2 accurately accurately ADV fcis-13109 19 3 and and CCONJ fcis-13109 19 4 efficiently efficiently ADV fcis-13109 19 5 detecting detect VERB fcis-13109 19 6 malicious malicious ADJ fcis-13109 19 7 documents document NOUN fcis-13109 19 8 , , PUNCT fcis-13109 19 9 we we PRON fcis-13109 19 10 can can AUX fcis-13109 19 11 take take VERB fcis-13109 19 12 preventive preventive ADJ fcis-13109 19 13 measures measure NOUN fcis-13109 19 14 at at ADP fcis-13109 19 15 an an DET fcis-13109 19 16 early early ADJ fcis-13109 19 17 stage stage NOUN fcis-13109 19 18 , , PUNCT fcis-13109 19 19 reducing reduce VERB fcis-13109 19 20 the the DET fcis-13109 19 21 spread spread NOUN fcis-13109 19 22 and and CCONJ fcis-13109 19 23 impact impact NOUN fcis-13109 19 24 of of ADP fcis-13109 19 25 malware malware NOUN fcis-13109 19 26 , , PUNCT fcis-13109 19 27 and and CCONJ fcis-13109 19 28 preventing prevent VERB fcis-13109 19 29 data data NOUN fcis-13109 19 30 breaches breach NOUN fcis-13109 19 31 , , PUNCT fcis-13109 19 32 financial financial ADJ fcis-13109 19 33 losses loss NOUN fcis-13109 19 34 , , PUNCT fcis-13109 19 35 and and CCONJ fcis-13109 19 36 other other ADJ fcis-13109 19 37 severe severe ADJ fcis-13109 19 38 consequences consequence NOUN fcis-13109 19 39 like like ADP fcis-13109 19 40 cybercrimes cybercrime NOUN fcis-13109 19 41 . . PUNCT fcis-13109 20 1 currently currently ADV fcis-13109 20 2 , , PUNCT fcis-13109 20 3 methods method NOUN fcis-13109 20 4 for for ADP fcis-13109 20 5 analyzing analyze VERB fcis-13109 20 6 malicious malicious ADJ fcis-13109 20 7 pdf pdf NOUN fcis-13109 20 8 document document NOUN fcis-13109 20 9 detection detection NOUN fcis-13109 20 10 primarily primarily ADV fcis-13109 20 11 fall fall VERB fcis-13109 20 12 into into ADP fcis-13109 20 13 two two NUM fcis-13109 20 14 categories category NOUN fcis-13109 20 15 : : PUNCT fcis-13109 20 16 static static ADJ fcis-13109 20 17 analysis analysis NOUN fcis-13109 20 18 and and CCONJ fcis-13109 20 19 dynamic dynamic ADJ fcis-13109 20 20 analysis analysis NOUN fcis-13109 20 21 . . PUNCT fcis-13109 21 1 static static ADJ fcis-13109 21 2 analysis analysis NOUN fcis-13109 21 3 methods method NOUN fcis-13109 21 4 determine determine VERB fcis-13109 21 5 the the DET fcis-13109 21 6 nature nature NOUN fcis-13109 21 7 of of ADP fcis-13109 21 8 a a DET fcis-13109 21 9 document document NOUN fcis-13109 21 10 without without ADP fcis-13109 21 11 opening open VERB fcis-13109 21 12 it it PRON fcis-13109 21 13 , , PUNCT fcis-13109 21 14 by by ADP fcis-13109 21 15 analyzing analyze VERB fcis-13109 21 16 embedded embed VERB fcis-13109 21 17 code code NOUN fcis-13109 21 18 , , PUNCT fcis-13109 21 19 content content NOUN fcis-13109 21 20 , , PUNCT fcis-13109 21 21 structure structure NOUN fcis-13109 21 22 , , PUNCT fcis-13109 21 23 and and CCONJ fcis-13109 21 24 other other ADJ fcis-13109 21 25 features feature NOUN fcis-13109 21 26 in in ADP fcis-13109 21 27 the the DET fcis-13109 21 28 document document NOUN fcis-13109 21 29 . . PUNCT fcis-13109 22 1 furthermore furthermore ADV fcis-13109 22 2 , , PUNCT fcis-13109 22 3 they they PRON fcis-13109 22 4 employ employ VERB fcis-13109 22 5 multi multi ADJ fcis-13109 22 6 - - ADJ fcis-13109 22 7 level level ADJ fcis-13109 22 8 abstraction abstraction NOUN fcis-13109 22 9 methods method NOUN fcis-13109 22 10 that that PRON fcis-13109 22 11 abstract abstract VERB fcis-13109 22 12 and and CCONJ fcis-13109 22 13 vectorize vectorize VERB fcis-13109 22 14 the the DET fcis-13109 22 15 document document NOUN fcis-13109 22 16 structure structure NOUN fcis-13109 22 17 and and CCONJ fcis-13109 22 18 scripting scripting NOUN fcis-13109 22 19 languages language NOUN fcis-13109 22 20 , , PUNCT fcis-13109 22 21 utilizing utilize VERB fcis-13109 22 22 machine machine NOUN fcis-13109 22 23 learning learning NOUN fcis-13109 22 24 for for ADP fcis-13109 22 25 computation computation NOUN fcis-13109 22 26 . . PUNCT fcis-13109 23 1 dynamic dynamic ADJ fcis-13109 23 2 analysis analysis NOUN fcis-13109 23 3 , , PUNCT fcis-13109 23 4 on on ADP fcis-13109 23 5 the the DET fcis-13109 23 6 other other ADJ fcis-13109 23 7 hand hand NOUN fcis-13109 23 8 , , PUNCT fcis-13109 23 9 entails entail VERB fcis-13109 23 10 opening open VERB fcis-13109 23 11 the the DET fcis-13109 23 12 document document NOUN fcis-13109 23 13 within within ADP fcis-13109 23 14 a a DET fcis-13109 23 15 virtual virtual ADJ fcis-13109 23 16 environment environment NOUN fcis-13109 23 17 and and CCONJ fcis-13109 23 18 monitoring monitor VERB fcis-13109 23 19 its its PRON fcis-13109 23 20 behavior behavior NOUN fcis-13109 23 21 during during ADP fcis-13109 23 22 execution execution NOUN fcis-13109 23 23 to to PART fcis-13109 23 24 determine determine VERB fcis-13109 23 25 if if SCONJ fcis-13109 23 26 it it PRON fcis-13109 23 27 's be AUX fcis-13109 23 28 malicious malicious ADJ fcis-13109 23 29 . . PUNCT fcis-13109 24 1 depending depend VERB fcis-13109 24 2 on on ADP fcis-13109 24 3 the the DET fcis-13109 24 4 principle principle NOUN fcis-13109 24 5 of of ADP fcis-13109 24 6 analysis analysis NOUN fcis-13109 24 7 , , PUNCT fcis-13109 24 8 dynamic dynamic ADJ fcis-13109 24 9 methods method NOUN fcis-13109 24 10 can can AUX fcis-13109 24 11 be be AUX fcis-13109 24 12 divided divide VERB fcis-13109 24 13 into into ADP fcis-13109 24 14 document document NOUN fcis-13109 24 15 emulation emulation NOUN fcis-13109 24 16 and and CCONJ fcis-13109 24 17 code code NOUN fcis-13109 24 18 simulation simulation NOUN fcis-13109 24 19 techniques technique NOUN fcis-13109 24 20 [ [ X fcis-13109 24 21 1 1 NUM fcis-13109 24 22 ] ] PUNCT fcis-13109 24 23 . . PUNCT fcis-13109 25 1 researchers researcher NOUN fcis-13109 25 2 have have AUX fcis-13109 25 3 also also ADV fcis-13109 25 4 started start VERB fcis-13109 25 5 to to PART fcis-13109 25 6 integrate integrate VERB fcis-13109 25 7 the the DET fcis-13109 25 8 behavioral behavioral ADJ fcis-13109 25 9 characteristics characteristic NOUN fcis-13109 25 10 of of ADP fcis-13109 25 11 the the DET fcis-13109 25 12 document document NOUN fcis-13109 25 13 when when SCONJ fcis-13109 25 14 opened open VERB fcis-13109 25 15 with with ADP fcis-13109 25 16 its its PRON fcis-13109 25 17 inherent inherent ADJ fcis-13109 25 18 features feature NOUN fcis-13109 25 19 for for ADP fcis-13109 25 20 analysis analysis NOUN fcis-13109 25 21 , , PUNCT fcis-13109 25 22 leading lead VERB fcis-13109 25 23 to to ADP fcis-13109 25 24 the the DET fcis-13109 25 25 development development NOUN fcis-13109 25 26 of of ADP fcis-13109 25 27 combined combined ADJ fcis-13109 25 28 static static ADJ fcis-13109 25 29 and and CCONJ fcis-13109 25 30 dynamic dynamic ADJ fcis-13109 25 31 malicious malicious ADJ fcis-13109 25 32 document document NOUN fcis-13109 25 33 detection detection NOUN fcis-13109 25 34 methods method NOUN fcis-13109 25 35 . . PUNCT fcis-13109 26 1 this this DET fcis-13109 26 2 review review NOUN fcis-13109 26 3 encompasses encompass VERB fcis-13109 26 4 topics topic NOUN fcis-13109 26 5 like like ADP fcis-13109 26 6 social social ADJ fcis-13109 26 7 engineering engineering NOUN fcis-13109 26 8 tactics tactic NOUN fcis-13109 26 9 , , PUNCT fcis-13109 26 10 cyberattacks cyberattack NOUN fcis-13109 26 11 , , PUNCT fcis-13109 26 12 and and CCONJ fcis-13109 26 13 vulnerability vulnerability NOUN fcis-13109 26 14 exploitation exploitation NOUN fcis-13109 26 15 . . PUNCT fcis-13109 27 1 it it PRON fcis-13109 27 2 can can AUX fcis-13109 27 3 reveal reveal VERB fcis-13109 27 4 patterns pattern NOUN fcis-13109 27 5 and and CCONJ fcis-13109 27 6 trends trend NOUN fcis-13109 27 7 in in ADP fcis-13109 27 8 the the DET fcis-13109 27 9 spread spread NOUN fcis-13109 27 10 of of ADP fcis-13109 27 11 malicious malicious ADJ fcis-13109 27 12 documents document NOUN fcis-13109 27 13 , , PUNCT fcis-13109 27 14 enabling enable VERB fcis-13109 27 15 better well ADJ fcis-13109 27 16 prevention prevention NOUN fcis-13109 27 17 and and CCONJ fcis-13109 27 18 response response NOUN fcis-13109 27 19 to to ADP fcis-13109 27 20 their their PRON fcis-13109 27 21 dissemination dissemination NOUN fcis-13109 27 22 . . PUNCT fcis-13109 28 1 this this PRON fcis-13109 28 2 also also ADV fcis-13109 28 3 aids aid VERB fcis-13109 28 4 others other NOUN fcis-13109 28 5 in in ADP fcis-13109 28 6 gaining gain VERB fcis-13109 28 7 a a DET fcis-13109 28 8 deeper deep ADJ fcis-13109 28 9 understanding understanding NOUN fcis-13109 28 10 of of ADP fcis-13109 28 11 how how SCONJ fcis-13109 28 12 malicious malicious ADJ fcis-13109 28 13 documents document NOUN fcis-13109 28 14 operate operate VERB fcis-13109 28 15 and and CCONJ fcis-13109 28 16 the the DET fcis-13109 28 17 extent extent NOUN fcis-13109 28 18 of of ADP fcis-13109 28 19 their their PRON fcis-13109 28 20 threats threat NOUN fcis-13109 28 21 . . PUNCT fcis-13109 29 1 by by ADP fcis-13109 29 2 sharing share VERB fcis-13109 29 3 this this DET fcis-13109 29 4 information information NOUN fcis-13109 29 5 , , PUNCT fcis-13109 29 6 everyone everyone PRON fcis-13109 29 7 can can AUX fcis-13109 29 8 remain remain VERB fcis-13109 29 9 vigilant vigilant ADJ fcis-13109 29 10 about about ADP fcis-13109 29 11 emerging emerge VERB fcis-13109 29 12 threats threat NOUN fcis-13109 29 13 and and CCONJ fcis-13109 29 14 take take VERB fcis-13109 29 15 timely timely ADJ fcis-13109 29 16 preventive preventive ADJ fcis-13109 29 17 measures measure NOUN fcis-13109 29 18 . . PUNCT fcis-13109 30 1 2 2 X fcis-13109 30 2 . . X fcis-13109 30 3 relation relation NOUN fcis-13109 30 4 work work VERB fcis-13109 30 5 2.1 2.1 NUM fcis-13109 30 6 . . PUNCT fcis-13109 31 1 stream stream NOUN fcis-13109 31 2 object object VERB fcis-13109 31 3 the the DET fcis-13109 31 4 stream stream NOUN fcis-13109 31 5 object object NOUN fcis-13109 31 6 attack attack NOUN fcis-13109 31 7 is be AUX fcis-13109 31 8 a a DET fcis-13109 31 9 malicious malicious ADJ fcis-13109 31 10 document document NOUN fcis-13109 31 11 attack attack NOUN fcis-13109 31 12 technique technique NOUN fcis-13109 31 13 commonly commonly ADV fcis-13109 31 14 found find VERB fcis-13109 31 15 in in ADP fcis-13109 31 16 pdf pdf NOUN fcis-13109 31 17 files file NOUN fcis-13109 31 18 . . PUNCT fcis-13109 32 1 this this DET fcis-13109 32 2 attack attack NOUN fcis-13109 32 3 leverages leverage VERB fcis-13109 32 4 the the DET fcis-13109 32 5 characteristics characteristic NOUN fcis-13109 32 6 of of ADP fcis-13109 32 7 the the DET fcis-13109 32 8 pdf pdf NOUN fcis-13109 32 9 format format NOUN fcis-13109 32 10 by by ADP fcis-13109 32 11 tampering tamper VERB fcis-13109 32 12 with with ADP fcis-13109 32 13 or or CCONJ fcis-13109 32 14 manipulating manipulate VERB fcis-13109 32 15 the the DET fcis-13109 32 16 stream stream NOUN fcis-13109 32 17 objects object NOUN fcis-13109 32 18 within within ADP fcis-13109 32 19 a a DET fcis-13109 32 20 pdf pdf NOUN fcis-13109 32 21 document document NOUN fcis-13109 32 22 to to PART fcis-13109 32 23 facilitate facilitate VERB fcis-13109 32 24 malicious malicious ADJ fcis-13109 32 25 actions action NOUN fcis-13109 32 26 . . PUNCT fcis-13109 33 1 in in ADP fcis-13109 33 2 pdf pdf NOUN fcis-13109 33 3 files file NOUN fcis-13109 33 4 , , PUNCT fcis-13109 33 5 a a DET fcis-13109 33 6 stream stream NOUN fcis-13109 33 7 object object NOUN fcis-13109 33 8 is be AUX fcis-13109 33 9 a a DET fcis-13109 33 10 data data NOUN fcis-13109 33 11 structure structure NOUN fcis-13109 33 12 used use VERB fcis-13109 33 13 to to PART fcis-13109 33 14 store store VERB fcis-13109 33 15 document document NOUN fcis-13109 33 16 content content NOUN fcis-13109 33 17 , , PUNCT fcis-13109 33 18 including include VERB fcis-13109 33 19 text text NOUN fcis-13109 33 20 , , PUNCT fcis-13109 33 21 images image NOUN fcis-13109 33 22 , , PUNCT fcis-13109 33 23 fonts font NOUN fcis-13109 33 24 , , PUNCT fcis-13109 33 25 and and CCONJ fcis-13109 33 26 more more ADJ fcis-13109 33 27 . . PUNCT fcis-13109 34 1 attackers attacker NOUN fcis-13109 34 2 can can AUX fcis-13109 34 3 exploit exploit VERB fcis-13109 34 4 vulnerabilities vulnerability NOUN fcis-13109 34 5 or or CCONJ fcis-13109 34 6 weaknesses weakness NOUN fcis-13109 34 7 in in ADP fcis-13109 34 8 pdf pdf NOUN fcis-13109 34 9 readers reader NOUN fcis-13109 34 10 by by ADP fcis-13109 34 11 modifying modify VERB fcis-13109 34 12 or or CCONJ fcis-13109 34 13 adding add VERB fcis-13109 34 14 malicious malicious ADJ fcis-13109 34 15 stream stream NOUN fcis-13109 34 16 objects object NOUN fcis-13109 34 17 , , PUNCT fcis-13109 34 18 aiming aim VERB fcis-13109 34 19 to to PART fcis-13109 34 20 compromise compromise VERB fcis-13109 34 21 or or CCONJ fcis-13109 34 22 exploit exploit VERB fcis-13109 34 23 the the DET fcis-13109 34 24 user user NOUN fcis-13109 34 25 's 's PART fcis-13109 34 26 system system NOUN fcis-13109 34 27 . . PUNCT fcis-13109 35 1 2.2 2.2 NUM fcis-13109 35 2 . . PUNCT fcis-13109 35 3 entropy entropy VERB fcis-13109 35 4 the the DET fcis-13109 35 5 entropy entropy PROPN fcis-13109 35 6 attack attack NOUN fcis-13109 35 7 is be AUX fcis-13109 35 8 a a DET fcis-13109 35 9 cryptographic cryptographic ADJ fcis-13109 35 10 attack attack NOUN fcis-13109 35 11 method method NOUN fcis-13109 35 12 aimed aim VERB fcis-13109 35 13 at at ADP fcis-13109 35 14 deciphering decipher VERB fcis-13109 35 15 passwords password NOUN fcis-13109 35 16 or or CCONJ fcis-13109 35 17 extracting extract VERB fcis-13109 35 18 keys key NOUN fcis-13109 35 19 by by ADP fcis-13109 35 20 analyzing analyze VERB fcis-13109 35 21 the the DET fcis-13109 35 22 information information NOUN fcis-13109 35 23 entropy entropy NOUN fcis-13109 35 24 within within ADP fcis-13109 35 25 a a DET fcis-13109 35 26 cryptographic cryptographic ADJ fcis-13109 35 27 system system NOUN fcis-13109 35 28 . . PUNCT fcis-13109 36 1 information information NOUN fcis-13109 36 2 entropy entropy PROPN fcis-13109 36 3 is be AUX fcis-13109 36 4 a a DET fcis-13109 36 5 measure measure NOUN fcis-13109 36 6 of of ADP fcis-13109 36 7 the the DET fcis-13109 36 8 amount amount NOUN fcis-13109 36 9 of of ADP fcis-13109 36 10 information information NOUN fcis-13109 36 11 present present ADJ fcis-13109 36 12 in in ADP fcis-13109 36 13 the the DET fcis-13109 36 14 keys key NOUN fcis-13109 36 15 or or CCONJ fcis-13109 36 16 plaintext plaintext NOUN fcis-13109 36 17 of of ADP fcis-13109 36 18 a a DET fcis-13109 36 19 cryptographic cryptographic ADJ fcis-13109 36 20 system system NOUN fcis-13109 36 21 . . PUNCT fcis-13109 37 1 attackers attacker NOUN fcis-13109 37 2 exploit exploit VERB fcis-13109 37 3 the the DET fcis-13109 37 4 characteristics characteristic NOUN fcis-13109 37 5 of of ADP fcis-13109 37 6 information information NOUN fcis-13109 37 7 entropy entropy NOUN fcis-13109 37 8 to to PART fcis-13109 37 9 guess guess VERB fcis-13109 37 10 or or CCONJ fcis-13109 37 11 infer infer VERB fcis-13109 37 12 key key ADJ fcis-13109 37 13 details detail NOUN fcis-13109 37 14 in in ADP fcis-13109 37 15 the the DET fcis-13109 37 16 cryptographic cryptographic ADJ fcis-13109 37 17 system system NOUN fcis-13109 37 18 . . PUNCT fcis-13109 38 1 entropy entropy PROPN fcis-13109 38 2 attacks attack NOUN fcis-13109 38 3 typically typically ADV fcis-13109 38 4 operate operate VERB fcis-13109 38 5 based base VERB fcis-13109 38 6 on on ADP fcis-13109 38 7 principles principle NOUN fcis-13109 38 8 of of ADP fcis-13109 38 9 statistical statistical ADJ fcis-13109 38 10 analysis analysis NOUN fcis-13109 38 11 and and CCONJ fcis-13109 38 12 probabilistic probabilistic ADJ fcis-13109 38 13 inference inference NOUN fcis-13109 38 14 . . PUNCT fcis-13109 39 1 attackers attacker NOUN fcis-13109 39 2 might might AUX fcis-13109 39 3 use use VERB fcis-13109 39 4 a a DET fcis-13109 39 5 plethora plethora NOUN fcis-13109 39 6 of of ADP fcis-13109 39 7 known know VERB fcis-13109 39 8 plaintext plaintext NOUN fcis-13109 39 9 - - PUNCT fcis-13109 39 10 ciphertext ciphertext NOUN fcis-13109 39 11 pairs pair NOUN fcis-13109 39 12 , , PUNCT fcis-13109 39 13 and and CCONJ fcis-13109 39 14 by by ADP fcis-13109 39 15 analyzing analyze VERB fcis-13109 39 16 patterns pattern NOUN fcis-13109 39 17 , , PUNCT fcis-13109 39 18 frequencies frequency NOUN fcis-13109 39 19 , , PUNCT fcis-13109 39 20 and and CCONJ fcis-13109 39 21 statistical statistical ADJ fcis-13109 39 22 features feature NOUN fcis-13109 39 23 105 105 NUM fcis-13109 39 24 within within ADP fcis-13109 39 25 this this DET fcis-13109 39 26 dataset dataset NOUN fcis-13109 39 27 , , PUNCT fcis-13109 39 28 they they PRON fcis-13109 39 29 strive strive VERB fcis-13109 39 30 to to PART fcis-13109 39 31 crack crack VERB fcis-13109 39 32 the the DET fcis-13109 39 33 keys key NOUN fcis-13109 39 34 or or CCONJ fcis-13109 39 35 cryptographic cryptographic ADJ fcis-13109 39 36 algorithms algorithm NOUN fcis-13109 39 37 within within ADP fcis-13109 39 38 the the DET fcis-13109 39 39 system system NOUN fcis-13109 39 40 . . PUNCT fcis-13109 40 1 2.3 2.3 NUM fcis-13109 40 2 . . PUNCT fcis-13109 40 3 embedded embed VERB fcis-13109 40 4 javascript javascript NOUN fcis-13109 40 5 javascript javascript NOUN fcis-13109 40 6 attacks attack NOUN fcis-13109 40 7 embedded embed VERB fcis-13109 40 8 in in ADP fcis-13109 40 9 malicious malicious ADJ fcis-13109 40 10 documents document NOUN fcis-13109 40 11 are be AUX fcis-13109 40 12 a a DET fcis-13109 40 13 common common ADJ fcis-13109 40 14 cyber cyber NOUN fcis-13109 40 15 security security NOUN fcis-13109 40 16 threat threat NOUN fcis-13109 40 17 . . PUNCT fcis-13109 41 1 attackers attacker NOUN fcis-13109 41 2 take take VERB fcis-13109 41 3 advantage advantage NOUN fcis-13109 41 4 of of ADP fcis-13109 41 5 javascript javascript NOUN fcis-13109 41 6 's 's PART fcis-13109 41 7 versatility versatility NOUN fcis-13109 41 8 and and CCONJ fcis-13109 41 9 broad broad ADJ fcis-13109 41 10 browser browser NOUN fcis-13109 41 11 support support NOUN fcis-13109 41 12 to to PART fcis-13109 41 13 embed embed VERB fcis-13109 41 14 malicious malicious ADJ fcis-13109 41 15 code code NOUN fcis-13109 41 16 into into ADP fcis-13109 41 17 documents document NOUN fcis-13109 41 18 , , PUNCT fcis-13109 41 19 facilitating facilitate VERB fcis-13109 41 20 a a DET fcis-13109 41 21 range range NOUN fcis-13109 41 22 of of ADP fcis-13109 41 23 malicious malicious ADJ fcis-13109 41 24 activities activity NOUN fcis-13109 41 25 . . PUNCT fcis-13109 42 1 this this DET fcis-13109 42 2 type type NOUN fcis-13109 42 3 of of ADP fcis-13109 42 4 attack attack NOUN fcis-13109 42 5 capitalizes capitalize VERB fcis-13109 42 6 on on ADP fcis-13109 42 7 users user NOUN fcis-13109 42 8 ' ' PART fcis-13109 42 9 trust trust NOUN fcis-13109 42 10 in in ADP fcis-13109 42 11 documents document NOUN fcis-13109 42 12 . . PUNCT fcis-13109 43 1 by by ADP fcis-13109 43 2 deceiving deceive VERB fcis-13109 43 3 users user NOUN fcis-13109 43 4 into into ADP fcis-13109 43 5 opening open VERB fcis-13109 43 6 a a DET fcis-13109 43 7 malicious malicious ADJ fcis-13109 43 8 document document NOUN fcis-13109 43 9 or or CCONJ fcis-13109 43 10 visiting visit VERB fcis-13109 43 11 a a DET fcis-13109 43 12 malicious malicious ADJ fcis-13109 43 13 webpage webpage NOUN fcis-13109 43 14 , , PUNCT fcis-13109 43 15 the the DET fcis-13109 43 16 embedded embed VERB fcis-13109 43 17 javascript javascript NOUN fcis-13109 43 18 code code NOUN fcis-13109 43 19 is be AUX fcis-13109 43 20 triggered trigger VERB fcis-13109 43 21 and and CCONJ fcis-13109 43 22 executed execute VERB fcis-13109 43 23 . . PUNCT fcis-13109 44 1 once once ADV fcis-13109 44 2 executed execute VERB fcis-13109 44 3 , , PUNCT fcis-13109 44 4 the the DET fcis-13109 44 5 malicious malicious ADJ fcis-13109 44 6 javascript javascript NOUN fcis-13109 44 7 can can AUX fcis-13109 44 8 carry carry VERB fcis-13109 44 9 out out ADP fcis-13109 44 10 various various ADJ fcis-13109 44 11 malevolent malevolent ADJ fcis-13109 44 12 actions action NOUN fcis-13109 44 13 such such ADJ fcis-13109 44 14 as as ADP fcis-13109 44 15 stealing steal VERB fcis-13109 44 16 sensitive sensitive ADJ fcis-13109 44 17 information information NOUN fcis-13109 44 18 , , PUNCT fcis-13109 44 19 hijacking hijacking NOUN fcis-13109 44 20 user user NOUN fcis-13109 44 21 sessions session NOUN fcis-13109 44 22 , , PUNCT fcis-13109 44 23 implanting implanting NOUN fcis-13109 44 24 malware malware NOUN fcis-13109 44 25 , , PUNCT fcis-13109 44 26 attacking attack VERB fcis-13109 44 27 other other ADJ fcis-13109 44 28 websites website NOUN fcis-13109 44 29 or or CCONJ fcis-13109 44 30 systems system NOUN fcis-13109 44 31 , , PUNCT fcis-13109 44 32 and and CCONJ fcis-13109 44 33 more more ADJ fcis-13109 44 34 . . PUNCT fcis-13109 45 1 3 3 X fcis-13109 45 2 . . X fcis-13109 45 3 attack attack NOUN fcis-13109 45 4 3.1 3.1 NUM fcis-13109 45 5 . . PUNCT fcis-13109 46 1 streaming stream VERB fcis-13109 46 2 object object NOUN fcis-13109 46 3 attack attack NOUN fcis-13109 46 4 there there PRON fcis-13109 46 5 is be VERB fcis-13109 46 6 an an DET fcis-13109 46 7 analysis analysis NOUN fcis-13109 46 8 method method NOUN fcis-13109 46 9 that that PRON fcis-13109 46 10 can can AUX fcis-13109 46 11 successfully successfully ADV fcis-13109 46 12 extract extract VERB fcis-13109 46 13 javascript javascript NOUN fcis-13109 46 14 code code NOUN fcis-13109 46 15 nested nest VERB fcis-13109 46 16 within within ADP fcis-13109 46 17 stream stream NOUN fcis-13109 46 18 objects object NOUN fcis-13109 46 19 and and CCONJ fcis-13109 46 20 , , PUNCT fcis-13109 46 21 combined combine VERB fcis-13109 46 22 with with ADP fcis-13109 46 23 support support NOUN fcis-13109 46 24 vector vector NOUN fcis-13109 46 25 machine machine NOUN fcis-13109 46 26 ( ( PUNCT fcis-13109 46 27 svm svm ADJ fcis-13109 46 28 ) ) PUNCT fcis-13109 46 29 detection detection NOUN fcis-13109 46 30 techniques technique NOUN fcis-13109 46 31 , , PUNCT fcis-13109 46 32 can can AUX fcis-13109 46 33 detect detect VERB fcis-13109 46 34 these these DET fcis-13109 46 35 codes code NOUN fcis-13109 46 36 , , PUNCT fcis-13109 46 37 achieving achieve VERB fcis-13109 46 38 the the DET fcis-13109 46 39 detection detection NOUN fcis-13109 46 40 of of ADP fcis-13109 46 41 malicious malicious ADJ fcis-13109 46 42 pdf pdf NOUN fcis-13109 46 43 documents document NOUN fcis-13109 46 44 . . PUNCT fcis-13109 47 1 the the DET fcis-13109 47 2 system system NOUN fcis-13109 47 3 consists consist VERB fcis-13109 47 4 of of ADP fcis-13109 47 5 four four NUM fcis-13109 47 6 modules module NOUN fcis-13109 47 7 : : PUNCT fcis-13109 47 8 user user NOUN fcis-13109 47 9 shell shell PROPN fcis-13109 47 10 control control NOUN fcis-13109 47 11 interface interface NOUN fcis-13109 47 12 , , PUNCT fcis-13109 47 13 sample sample VERB fcis-13109 47 14 analysis analysis NOUN fcis-13109 47 15 module module NOUN fcis-13109 47 16 , , PUNCT fcis-13109 47 17 svm svm ADJ fcis-13109 47 18 detection detection NOUN fcis-13109 47 19 module module NOUN fcis-13109 47 20 , , PUNCT fcis-13109 47 21 and and CCONJ fcis-13109 47 22 shellcode shellcode ADJ fcis-13109 47 23 analysis analysis NOUN fcis-13109 47 24 module module NOUN fcis-13109 47 25 . . PUNCT fcis-13109 48 1 figure figure NOUN fcis-13109 48 2 1 1 NUM fcis-13109 48 3 . . PUNCT fcis-13109 48 4 net net ADJ fcis-13109 48 5 horse horse NOUN fcis-13109 48 6 detection detection NOUN fcis-13109 48 7 system system NOUN fcis-13109 48 8 overall overall ADJ fcis-13109 48 9 framework framework NOUN fcis-13109 48 10 the the DET fcis-13109 48 11 entire entire ADJ fcis-13109 48 12 system system NOUN fcis-13109 48 13 process process NOUN fcis-13109 48 14 is be AUX fcis-13109 48 15 as as SCONJ fcis-13109 48 16 follows follow VERB fcis-13109 48 17 : : PUNCT fcis-13109 48 18 for for SCONJ fcis-13109 48 19 the the DET fcis-13109 48 20 input input NOUN fcis-13109 48 21 sample sample NOUN fcis-13109 48 22 to to PART fcis-13109 48 23 be be AUX fcis-13109 48 24 tested test VERB fcis-13109 48 25 , , PUNCT fcis-13109 48 26 the the DET fcis-13109 48 27 system system NOUN fcis-13109 48 28 first first ADV fcis-13109 48 29 determines determine VERB fcis-13109 48 30 whether whether SCONJ fcis-13109 48 31 its its PRON fcis-13109 48 32 type type NOUN fcis-13109 48 33 is be AUX fcis-13109 48 34 html html NOUN fcis-13109 48 35 or or CCONJ fcis-13109 48 36 pdf pdf NOUN fcis-13109 48 37 , , PUNCT fcis-13109 48 38 and and CCONJ fcis-13109 48 39 based base VERB fcis-13109 48 40 on on ADP fcis-13109 48 41 the the DET fcis-13109 48 42 type type NOUN fcis-13109 48 43 , , PUNCT fcis-13109 48 44 it it PRON fcis-13109 48 45 invokes invoke VERB fcis-13109 48 46 the the DET fcis-13109 48 47 corresponding correspond VERB fcis-13109 48 48 analysis analysis NOUN fcis-13109 48 49 module module NOUN fcis-13109 48 50 for for ADP fcis-13109 48 51 sample sample NOUN fcis-13109 48 52 parsing parsing NOUN fcis-13109 48 53 . . PUNCT fcis-13109 49 1 for for ADP fcis-13109 49 2 html html NOUN fcis-13109 49 3 samples sample NOUN fcis-13109 49 4 , , PUNCT fcis-13109 49 5 the the DET fcis-13109 49 6 system system NOUN fcis-13109 49 7 checks check VERB fcis-13109 49 8 if if SCONJ fcis-13109 49 9 the the DET fcis-13109 49 10 page page NOUN fcis-13109 49 11 's 's PART fcis-13109 49 12 iframe iframe ADJ fcis-13109 49 13 tags tag NOUN fcis-13109 49 14 contain contain VERB fcis-13109 49 15 suspicious suspicious ADJ fcis-13109 49 16 links link NOUN fcis-13109 49 17 and and CCONJ fcis-13109 49 18 extracts extract NOUN fcis-13109 49 19 the the DET fcis-13109 49 20 content content NOUN fcis-13109 49 21 within within ADP fcis-13109 49 22 the the DET fcis-13109 49 23 < < NOUN fcis-13109 49 24 script> > X fcis-13109 49 26 tags tag NOUN fcis-13109 49 27 on on ADP fcis-13109 49 28 the the DET fcis-13109 49 29 current current ADJ fcis-13109 49 30 page page NOUN fcis-13109 49 31 . . PUNCT fcis-13109 50 1 if if SCONJ fcis-13109 50 2 a a DET fcis-13109 50 3 suspicious suspicious ADJ fcis-13109 50 4 link link NOUN fcis-13109 50 5 is be AUX fcis-13109 50 6 discovered discover VERB fcis-13109 50 7 , , PUNCT fcis-13109 50 8 the the DET fcis-13109 50 9 system system NOUN fcis-13109 50 10 further far ADV fcis-13109 50 11 invokes invoke VERB fcis-13109 50 12 a a DET fcis-13109 50 13 page page NOUN fcis-13109 50 14 downloader downloader NOUN fcis-13109 50 15 to to PART fcis-13109 50 16 retrieve retrieve VERB fcis-13109 50 17 the the DET fcis-13109 50 18 corresponding corresponding ADJ fcis-13109 50 19 page page NOUN fcis-13109 50 20 , , PUNCT fcis-13109 50 21 then then ADV fcis-13109 50 22 repeatedly repeatedly ADV fcis-13109 50 23 carries carry VERB fcis-13109 50 24 out out ADP fcis-13109 50 25 page page NOUN fcis-13109 50 26 type type NOUN fcis-13109 50 27 determination determination NOUN fcis-13109 50 28 , , PUNCT fcis-13109 50 29 suspicious suspicious ADJ fcis-13109 50 30 link link NOUN fcis-13109 50 31 extraction extraction NOUN fcis-13109 50 32 , , PUNCT fcis-13109 50 33 page page NOUN fcis-13109 50 34 parsing parsing NOUN fcis-13109 50 35 , , PUNCT fcis-13109 50 36 and and CCONJ fcis-13109 50 37 javascript javascript NOUN fcis-13109 50 38 extraction extraction NOUN fcis-13109 50 39 processes process NOUN fcis-13109 50 40 . . PUNCT fcis-13109 51 1 for for ADP fcis-13109 51 2 pdf pdf NOUN fcis-13109 51 3 samples sample NOUN fcis-13109 51 4 , , PUNCT fcis-13109 51 5 the the DET fcis-13109 51 6 system system NOUN fcis-13109 51 7 conducts conduct VERB fcis-13109 51 8 static static ADJ fcis-13109 51 9 stream stream NOUN fcis-13109 51 10 object object VERB fcis-13109 51 11 analysis analysis NOUN fcis-13109 51 12 to to PART fcis-13109 51 13 locate locate VERB fcis-13109 51 14 js js ADJ fcis-13109 51 15 stream stream NOUN fcis-13109 51 16 objects object NOUN fcis-13109 51 17 and and CCONJ fcis-13109 51 18 extracts extract NOUN fcis-13109 51 19 the the DET fcis-13109 51 20 embedded embed VERB fcis-13109 51 21 javascript javascript NOUN fcis-13109 51 22 code code PROPN fcis-13109 51 23 . . PUNCT fcis-13109 52 1 then then ADV fcis-13109 52 2 , , PUNCT fcis-13109 52 3 using use VERB fcis-13109 52 4 the the DET fcis-13109 52 5 feature feature NOUN fcis-13109 52 6 classifier classifier NOUN fcis-13109 52 7 based base VERB fcis-13109 52 8 on on ADP fcis-13109 52 9 the the DET fcis-13109 52 10 support support NOUN fcis-13109 52 11 vector vector NOUN fcis-13109 52 12 machine machine NOUN fcis-13109 52 13 , , PUNCT fcis-13109 52 14 it it PRON fcis-13109 52 15 assesses assess VERB fcis-13109 52 16 the the DET fcis-13109 52 17 maliciousness maliciousness NOUN fcis-13109 52 18 of of ADP fcis-13109 52 19 the the DET fcis-13109 52 20 javascript javascript NOUN fcis-13109 52 21 code code NOUN fcis-13109 52 22 extracted extract VERB fcis-13109 52 23 from from ADP fcis-13109 52 24 the the DET fcis-13109 52 25 sample sample NOUN fcis-13109 52 26 analysis analysis NOUN fcis-13109 52 27 module module NOUN fcis-13109 52 28 . . PUNCT fcis-13109 53 1 if if SCONJ fcis-13109 53 2 the the DET fcis-13109 53 3 javascript javascript NOUN fcis-13109 53 4 code code NOUN fcis-13109 53 5 is be AUX fcis-13109 53 6 determined determine VERB fcis-13109 53 7 to to PART fcis-13109 53 8 be be AUX fcis-13109 53 9 a a DET fcis-13109 53 10 malicious malicious ADJ fcis-13109 53 11 segment segment NOUN fcis-13109 53 12 , , PUNCT fcis-13109 53 13 the the DET fcis-13109 53 14 system system NOUN fcis-13109 53 15 will will AUX fcis-13109 53 16 call call VERB fcis-13109 53 17 upon upon ADP fcis-13109 53 18 a a DET fcis-13109 53 19 js js ADJ fcis-13109 53 20 engine engine NOUN fcis-13109 53 21 to to AUX fcis-13109 53 22 de de VERB fcis-13109 53 23 - - VERB fcis-13109 53 24 obfuscate obfuscate VERB fcis-13109 53 25 that that DET fcis-13109 53 26 javascript javascript NOUN fcis-13109 53 27 code code PROPN fcis-13109 53 28 . . PUNCT fcis-13109 54 1 if if SCONJ fcis-13109 54 2 the the DET fcis-13109 54 3 de de ADJ fcis-13109 54 4 - - ADJ fcis-13109 54 5 obfuscated obfuscated ADJ fcis-13109 54 6 code code NOUN fcis-13109 54 7 contains contain VERB fcis-13109 54 8 shellcode shellcode NOUN fcis-13109 54 9 , , PUNCT fcis-13109 54 10 the the DET fcis-13109 54 11 system system NOUN fcis-13109 54 12 further far ADV fcis-13109 54 13 invokes invoke VERB fcis-13109 54 14 a a DET fcis-13109 54 15 shellcode shellcode ADJ fcis-13109 54 16 simulation simulation NOUN fcis-13109 54 17 tool tool NOUN fcis-13109 54 18 to to PART fcis-13109 54 19 emulate emulate VERB fcis-13109 54 20 its its PRON fcis-13109 54 21 behavior behavior NOUN fcis-13109 54 22 , , PUNCT fcis-13109 54 23 aiming aim VERB fcis-13109 54 24 to to PART fcis-13109 54 25 obtain obtain VERB fcis-13109 54 26 detailed detailed ADJ fcis-13109 54 27 information information NOUN fcis-13109 54 28 about about ADP fcis-13109 54 29 the the DET fcis-13109 54 30 malicious malicious ADJ fcis-13109 54 31 script script NOUN fcis-13109 54 32 's 's PART fcis-13109 54 33 functionality functionality NOUN fcis-13109 54 34 [ [ X fcis-13109 54 35 2 2 NUM fcis-13109 54 36 ] ] PUNCT fcis-13109 54 37 . . PUNCT fcis-13109 55 1 3.2 3.2 NUM fcis-13109 55 2 . . PUNCT fcis-13109 55 3 embedded embed VERB fcis-13109 55 4 javascript javascript NOUN fcis-13109 55 5 for for ADP fcis-13109 55 6 detecting detect VERB fcis-13109 55 7 embedded embed VERB fcis-13109 55 8 javascript javascript NOUN fcis-13109 55 9 , , PUNCT fcis-13109 55 10 one one PRON fcis-13109 55 11 can can AUX fcis-13109 55 12 employ employ VERB fcis-13109 55 13 specific specific ADJ fcis-13109 55 14 models model NOUN fcis-13109 55 15 . . PUNCT fcis-13109 56 1 the the DET fcis-13109 56 2 training training NOUN fcis-13109 56 3 phase phase NOUN fcis-13109 56 4 for for ADP fcis-13109 56 5 a a DET fcis-13109 56 6 malicious malicious ADJ fcis-13109 56 7 document document NOUN fcis-13109 56 8 detection detection NOUN fcis-13109 56 9 model model NOUN fcis-13109 56 10 generally generally ADV fcis-13109 56 11 involves involve VERB fcis-13109 56 12 three three NUM fcis-13109 56 13 steps step NOUN fcis-13109 56 14 . . PUNCT fcis-13109 57 1 initially initially ADV fcis-13109 57 2 , , PUNCT fcis-13109 57 3 javascript javascript PROPN fcis-13109 57 4 code code NOUN fcis-13109 57 5 is be AUX fcis-13109 57 6 extracted extract VERB fcis-13109 57 7 from from ADP fcis-13109 57 8 benign benign ADJ fcis-13109 57 9 pdf pdf NOUN fcis-13109 57 10 files file NOUN fcis-13109 57 11 using use VERB fcis-13109 57 12 a a DET fcis-13109 57 13 pdf pdf NOUN fcis-13109 57 14 parser parser NOUN fcis-13109 57 15 . . PUNCT fcis-13109 58 1 subsequently subsequently ADV fcis-13109 58 2 , , PUNCT fcis-13109 58 3 a a DET fcis-13109 58 4 composite composite ADJ fcis-13109 58 5 javascript javascript NOUN fcis-13109 58 6 feature feature NOUN fcis-13109 58 7 is be AUX fcis-13109 58 8 constructed construct VERB fcis-13109 58 9 by by ADP fcis-13109 58 10 extracting extract VERB fcis-13109 58 11 semantic semantic ADJ fcis-13109 58 12 and and CCONJ fcis-13109 58 13 malicious malicious ADJ fcis-13109 58 14 - - PUNCT fcis-13109 58 15 related relate VERB fcis-13109 58 16 information information NOUN fcis-13109 58 17 from from ADP fcis-13109 58 18 the the DET fcis-13109 58 19 gleaned glean VERB fcis-13109 58 20 javascript javascript NOUN fcis-13109 58 21 code code PROPN fcis-13109 58 22 , , PUNCT fcis-13109 58 23 combining combine VERB fcis-13109 58 24 it it PRON fcis-13109 58 25 into into ADP fcis-13109 58 26 a a DET fcis-13109 58 27 token token ADJ fcis-13109 58 28 sequence sequence NOUN fcis-13109 58 29 . . PUNCT fcis-13109 59 1 these these DET fcis-13109 59 2 token token VERB fcis-13109 59 3 sequences sequence NOUN fcis-13109 59 4 are be AUX fcis-13109 59 5 then then ADV fcis-13109 59 6 transformed transform VERB fcis-13109 59 7 and and CCONJ fcis-13109 59 8 encoded encode VERB fcis-13109 59 9 through through ADP fcis-13109 59 10 an an DET fcis-13109 59 11 n n CCONJ fcis-13109 59 12 - - PUNCT fcis-13109 59 13 gram gram NOUN fcis-13109 59 14 model model NOUN fcis-13109 59 15 , , PUNCT fcis-13109 59 16 yielding yield VERB fcis-13109 59 17 the the DET fcis-13109 59 18 composite composite ADJ fcis-13109 59 19 javascript javascript NOUN fcis-13109 59 20 feature feature NOUN fcis-13109 59 21 . . PUNCT fcis-13109 60 1 finally finally ADV fcis-13109 60 2 , , PUNCT fcis-13109 60 3 a a DET fcis-13109 60 4 one one NUM fcis-13109 60 5 - - PUNCT fcis-13109 60 6 class class NOUN fcis-13109 60 7 support support NOUN fcis-13109 60 8 vector vector NOUN fcis-13109 60 9 machine machine NOUN fcis-13109 60 10 is be AUX fcis-13109 60 11 utilized utilize VERB fcis-13109 60 12 to to PART fcis-13109 60 13 train train VERB fcis-13109 60 14 on on ADP fcis-13109 60 15 these these DET fcis-13109 60 16 features feature NOUN fcis-13109 60 17 , , PUNCT fcis-13109 60 18 resulting result VERB fcis-13109 60 19 in in ADP fcis-13109 60 20 the the DET fcis-13109 60 21 malicious malicious ADJ fcis-13109 60 22 pdf pdf NOUN fcis-13109 60 23 document document NOUN fcis-13109 60 24 detection detection NOUN fcis-13109 60 25 model model NOUN fcis-13109 60 26 [ [ X fcis-13109 60 27 3 3 NUM fcis-13109 60 28 ] ] PUNCT fcis-13109 60 29 . . PUNCT fcis-13109 61 1 it it PRON fcis-13109 61 2 's be AUX fcis-13109 61 3 important important ADJ fcis-13109 61 4 to to PART fcis-13109 61 5 note note VERB fcis-13109 61 6 that that SCONJ fcis-13109 61 7 the the DET fcis-13109 61 8 effectiveness effectiveness NOUN fcis-13109 61 9 of of ADP fcis-13109 61 10 this this DET fcis-13109 61 11 method method NOUN fcis-13109 61 12 hinges hinge NOUN fcis-13109 61 13 on on ADP fcis-13109 61 14 accurately accurately ADV fcis-13109 61 15 extracting extract VERB fcis-13109 61 16 javascript javascript NOUN fcis-13109 61 17 code code NOUN fcis-13109 61 18 from from ADP fcis-13109 61 19 pdf pdf NOUN fcis-13109 61 20 documents document NOUN fcis-13109 61 21 . . PUNCT fcis-13109 62 1 however however ADV fcis-13109 62 2 , , PUNCT fcis-13109 62 3 some some DET fcis-13109 62 4 attackers attacker NOUN fcis-13109 62 5 might might AUX fcis-13109 62 6 employ employ VERB fcis-13109 62 7 tactics tactic NOUN fcis-13109 62 8 to to PART fcis-13109 62 9 obfuscate obfuscate VERB fcis-13109 62 10 the the DET fcis-13109 62 11 javascript javascript NOUN fcis-13109 62 12 code code PROPN fcis-13109 62 13 , , PUNCT fcis-13109 62 14 making make VERB fcis-13109 62 15 it it PRON fcis-13109 62 16 elusive elusive ADJ fcis-13109 62 17 for for ADP fcis-13109 62 18 standard standard ADJ fcis-13109 62 19 parsers parser NOUN fcis-13109 62 20 , , PUNCT fcis-13109 62 21 thus thus ADV fcis-13109 62 22 rendering render VERB fcis-13109 62 23 this this DET fcis-13109 62 24 approach approach NOUN fcis-13109 62 25 ineffective ineffective ADJ fcis-13109 62 26 . . PUNCT fcis-13109 63 1 during during ADP fcis-13109 63 2 the the DET fcis-13109 63 3 malicious malicious ADJ fcis-13109 63 4 pdf pdf NOUN fcis-13109 63 5 document document NOUN fcis-13109 63 6 detection detection NOUN fcis-13109 63 7 phase phase NOUN fcis-13109 63 8 , , PUNCT fcis-13109 63 9 parsers parser NOUN fcis-13109 63 10 such such ADJ fcis-13109 63 11 as as ADP fcis-13109 63 12 peepdf peepdf NOUN fcis-13109 63 13 and and CCONJ fcis-13109 63 14 pjscan pjscan ADJ fcis-13109 63 15 can can AUX fcis-13109 63 16 be be AUX fcis-13109 63 17 used use VERB fcis-13109 63 18 to to PART fcis-13109 63 19 analyze analyze VERB fcis-13109 63 20 pdf pdf NOUN fcis-13109 63 21 documents document NOUN fcis-13109 63 22 , , PUNCT fcis-13109 63 23 determining determine VERB fcis-13109 63 24 the the DET fcis-13109 63 25 presence presence NOUN fcis-13109 63 26 of of ADP fcis-13109 63 27 javascript javascript NOUN fcis-13109 63 28 code code PROPN fcis-13109 63 29 . . PUNCT fcis-13109 64 1 if if SCONJ fcis-13109 64 2 concealed conceal VERB fcis-13109 64 3 javascript javascript NOUN fcis-13109 64 4 code code NOUN fcis-13109 64 5 is be AUX fcis-13109 64 6 detected detect VERB fcis-13109 64 7 within within ADP fcis-13109 64 8 a a DET fcis-13109 64 9 pdf pdf NOUN fcis-13109 64 10 , , PUNCT fcis-13109 64 11 it it PRON fcis-13109 64 12 is be AUX fcis-13109 64 13 deemed deem VERB fcis-13109 64 14 malicious malicious ADJ fcis-13109 64 15 . . PUNCT fcis-13109 65 1 the the DET fcis-13109 65 2 spider spider NOUN fcis-13109 65 3 monkey monkey NOUN fcis-13109 65 4 tool tool NOUN fcis-13109 65 5 can can AUX fcis-13109 65 6 be be AUX fcis-13109 65 7 used use VERB fcis-13109 65 8 to to PART fcis-13109 65 9 convert convert VERB fcis-13109 65 10 javascript javascript NOUN fcis-13109 65 11 code code NOUN fcis-13109 65 12 into into ADP fcis-13109 65 13 token token ADJ fcis-13109 65 14 representations representation NOUN fcis-13109 65 15 , , PUNCT fcis-13109 65 16 where where SCONJ fcis-13109 65 17 86 86 NUM fcis-13109 65 18 tokens token NOUN fcis-13109 65 19 are be AUX fcis-13109 65 20 defined define VERB fcis-13109 65 21 to to PART fcis-13109 65 22 represent represent VERB fcis-13109 65 23 keywords keyword NOUN fcis-13109 65 24 , , PUNCT fcis-13109 65 25 operators operator NOUN fcis-13109 65 26 , , PUNCT fcis-13109 65 27 and and CCONJ fcis-13109 65 28 data datum NOUN fcis-13109 65 29 within within ADP fcis-13109 65 30 the the DET fcis-13109 65 31 javascript javascript NOUN fcis-13109 65 32 code code PROPN fcis-13109 65 33 . . PUNCT fcis-13109 66 1 semantic semantic ADJ fcis-13109 66 2 and and CCONJ fcis-13109 66 3 malicious malicious ADJ fcis-13109 66 4 - - PUNCT fcis-13109 66 5 associated associate VERB fcis-13109 66 6 information information NOUN fcis-13109 66 7 are be AUX fcis-13109 66 8 extracted extract VERB fcis-13109 66 9 and and CCONJ fcis-13109 66 10 combined combine VERB fcis-13109 66 11 into into ADP fcis-13109 66 12 token token VERB fcis-13109 66 13 sequences sequence NOUN fcis-13109 66 14 . . PUNCT fcis-13109 67 1 using use VERB fcis-13109 67 2 the the DET fcis-13109 67 3 ngram ngram NOUN fcis-13109 67 4 model model NOUN fcis-13109 67 5 , , PUNCT fcis-13109 67 6 these these DET fcis-13109 67 7 token token VERB fcis-13109 67 8 sequences sequence NOUN fcis-13109 67 9 are be AUX fcis-13109 67 10 transformed transform VERB fcis-13109 67 11 into into ADP fcis-13109 67 12 sets set NOUN fcis-13109 67 13 of of ADP fcis-13109 67 14 token token ADJ fcis-13109 67 15 segments segment NOUN fcis-13109 67 16 of of ADP fcis-13109 67 17 length length NOUN fcis-13109 67 18 n. n. PROPN fcis-13109 67 19 binary binary PROPN fcis-13109 67 20 encoding encoding NOUN fcis-13109 67 21 is be AUX fcis-13109 67 22 applied apply VERB fcis-13109 67 23 to to ADP fcis-13109 67 24 these these DET fcis-13109 67 25 token token ADJ fcis-13109 67 26 segment segment NOUN fcis-13109 67 27 sequences sequence NOUN fcis-13109 67 28 , , PUNCT fcis-13109 67 29 resulting result VERB fcis-13109 67 30 in in ADP fcis-13109 67 31 vectorized vectorize VERB fcis-13109 67 32 javascript javascript NOUN fcis-13109 67 33 features feature NOUN fcis-13109 67 34 . . PUNCT fcis-13109 68 1 these these DET fcis-13109 68 2 javascript javascript NOUN fcis-13109 68 3 features feature NOUN fcis-13109 68 4 are be AUX fcis-13109 68 5 then then ADV fcis-13109 68 6 normalized normalize VERB fcis-13109 68 7 in in ADP fcis-13109 68 8 preparation preparation NOUN fcis-13109 68 9 for for ADP fcis-13109 68 10 subsequent subsequent ADJ fcis-13109 68 11 malicious malicious ADJ fcis-13109 68 12 pdf pdf NOUN fcis-13109 68 13 document document NOUN fcis-13109 68 14 detection detection NOUN fcis-13109 68 15 and and CCONJ fcis-13109 68 16 classification classification NOUN fcis-13109 68 17 . . PUNCT fcis-13109 69 1 106 106 NUM fcis-13109 69 2 figure figure NOUN fcis-13109 69 3 2 2 NUM fcis-13109 69 4 . . PUNCT fcis-13109 69 5 detection detection NOUN fcis-13109 69 6 model model NOUN fcis-13109 69 7 of of ADP fcis-13109 69 8 javascript javascript NOUN fcis-13109 69 9 feature feature NOUN fcis-13109 69 10 and and CCONJ fcis-13109 69 11 single single ADJ fcis-13109 69 12 classification classification NOUN fcis-13109 69 13 support support NOUN fcis-13109 69 14 vector vector NOUN fcis-13109 69 15 machine machine NOUN fcis-13109 69 16 additionally additionally ADV fcis-13109 70 1 , , PUNCT fcis-13109 70 2 attackers attacker NOUN fcis-13109 70 3 can can AUX fcis-13109 70 4 also also ADV fcis-13109 70 5 employ employ VERB fcis-13109 70 6 other other ADJ fcis-13109 70 7 methods method NOUN fcis-13109 70 8 to to PART fcis-13109 70 9 evade evade VERB fcis-13109 70 10 this this DET fcis-13109 70 11 detection detection NOUN fcis-13109 70 12 model model NOUN fcis-13109 70 13 , , PUNCT fcis-13109 70 14 such such ADJ fcis-13109 70 15 as as ADP fcis-13109 70 16 targeting target VERB fcis-13109 70 17 parsers parser NOUN fcis-13109 70 18 to to PART fcis-13109 70 19 hinder hinder VERB fcis-13109 70 20 javascript javascript NOUN fcis-13109 70 21 code code NOUN fcis-13109 70 22 extraction extraction NOUN fcis-13109 70 23 or or CCONJ fcis-13109 70 24 intentionally intentionally ADV fcis-13109 70 25 causing cause VERB fcis-13109 70 26 classifiers classifier NOUN fcis-13109 70 27 to to PART fcis-13109 70 28 misclassify misclassify VERB fcis-13109 70 29 extracted extract VERB fcis-13109 70 30 code code NOUN fcis-13109 70 31 as as ADP fcis-13109 70 32 benign benign ADJ fcis-13109 70 33 . . PUNCT fcis-13109 71 1 the the DET fcis-13109 71 2 robustness robustness NOUN fcis-13109 71 3 of of ADP fcis-13109 71 4 the the DET fcis-13109 71 5 model model NOUN fcis-13109 71 6 can can AUX fcis-13109 71 7 also also ADV fcis-13109 71 8 be be AUX fcis-13109 71 9 tested test VERB fcis-13109 71 10 by by ADP fcis-13109 71 11 carrying carry VERB fcis-13109 71 12 out out ADP fcis-13109 71 13 mimicry mimicry NOUN fcis-13109 71 14 attacks attack NOUN fcis-13109 71 15 or or CCONJ fcis-13109 71 16 anti anti ADJ fcis-13109 71 17 - - ADJ fcis-13109 71 18 mimicry mimicry ADJ fcis-13109 71 19 attacks attack NOUN fcis-13109 71 20 , , PUNCT fcis-13109 71 21 altering alter VERB fcis-13109 71 22 malicious malicious ADJ fcis-13109 71 23 samples sample NOUN fcis-13109 71 24 to to PART fcis-13109 71 25 resemble resemble VERB fcis-13109 71 26 benign benign ADJ fcis-13109 71 27 samples sample NOUN fcis-13109 71 28 , , PUNCT fcis-13109 71 29 or or CCONJ fcis-13109 71 30 injecting inject VERB fcis-13109 71 31 malicious malicious ADJ fcis-13109 71 32 content content NOUN fcis-13109 71 33 into into ADP fcis-13109 71 34 benign benign ADJ fcis-13109 71 35 samples sample NOUN fcis-13109 71 36 , , PUNCT fcis-13109 71 37 turning turn VERB fcis-13109 71 38 them they PRON fcis-13109 71 39 into into ADP fcis-13109 71 40 malicious malicious ADJ fcis-13109 71 41 documents document NOUN fcis-13109 71 42 . . PUNCT fcis-13109 72 1 furthermore furthermore ADV fcis-13109 72 2 , , PUNCT fcis-13109 72 3 an an DET fcis-13109 72 4 efficient efficient ADJ fcis-13109 72 5 method method NOUN fcis-13109 72 6 to to PART fcis-13109 72 7 produce produce VERB fcis-13109 72 8 malicious malicious ADJ fcis-13109 72 9 samples sample NOUN fcis-13109 72 10 can can AUX fcis-13109 72 11 be be AUX fcis-13109 72 12 implemented implement VERB fcis-13109 72 13 by by ADP fcis-13109 72 14 directly directly ADV fcis-13109 72 15 constructing construct VERB fcis-13109 72 16 javascript javascript NOUN fcis-13109 72 17 code code NOUN fcis-13109 72 18 in in ADP fcis-13109 72 19 the the DET fcis-13109 72 20 feature feature NOUN fcis-13109 72 21 space space NOUN fcis-13109 72 22 , , PUNCT fcis-13109 72 23 achieving achieve VERB fcis-13109 72 24 the the DET fcis-13109 72 25 objective objective NOUN fcis-13109 72 26 of of ADP fcis-13109 72 27 rapidly rapidly ADV fcis-13109 72 28 generating generate VERB fcis-13109 72 29 attack attack NOUN fcis-13109 72 30 samples sample NOUN fcis-13109 72 31 . . PUNCT fcis-13109 73 1 in in ADP fcis-13109 73 2 conclusion conclusion NOUN fcis-13109 73 3 , , PUNCT fcis-13109 73 4 the the DET fcis-13109 73 5 training training NOUN fcis-13109 73 6 phase phase NOUN fcis-13109 73 7 of of ADP fcis-13109 73 8 the the DET fcis-13109 73 9 malicious malicious ADJ fcis-13109 73 10 document document NOUN fcis-13109 73 11 detection detection NOUN fcis-13109 73 12 model model NOUN fcis-13109 73 13 encompasses encompass VERB fcis-13109 73 14 the the DET fcis-13109 73 15 extraction extraction NOUN fcis-13109 73 16 of of ADP fcis-13109 73 17 javascript javascript NOUN fcis-13109 73 18 code code NOUN fcis-13109 73 19 , , PUNCT fcis-13109 73 20 feature feature NOUN fcis-13109 73 21 construction construction NOUN fcis-13109 73 22 , , PUNCT fcis-13109 73 23 and and CCONJ fcis-13109 73 24 the the DET fcis-13109 73 25 training training NOUN fcis-13109 73 26 of of ADP fcis-13109 73 27 the the DET fcis-13109 73 28 support support NOUN fcis-13109 73 29 vector vector NOUN fcis-13109 73 30 machine machine NOUN fcis-13109 73 31 ; ; PUNCT fcis-13109 73 32 while while SCONJ fcis-13109 73 33 the the DET fcis-13109 73 34 detection detection NOUN fcis-13109 73 35 phase phase NOUN fcis-13109 73 36 includes include VERB fcis-13109 73 37 preliminary preliminary ADJ fcis-13109 73 38 detection detection NOUN fcis-13109 73 39 , , PUNCT fcis-13109 73 40 javascript javascript NOUN fcis-13109 73 41 code code NOUN fcis-13109 73 42 extraction extraction NOUN fcis-13109 73 43 , , PUNCT fcis-13109 73 44 feature feature NOUN fcis-13109 73 45 construction construction NOUN fcis-13109 73 46 , , PUNCT fcis-13109 73 47 and and CCONJ fcis-13109 73 48 classification classification NOUN fcis-13109 73 49 using use VERB fcis-13109 73 50 the the DET fcis-13109 73 51 support support NOUN fcis-13109 73 52 vector vector NOUN fcis-13109 73 53 machine machine NOUN fcis-13109 73 54 . . PUNCT fcis-13109 74 1 attackers attacker NOUN fcis-13109 74 2 could could AUX fcis-13109 74 3 potentially potentially ADV fcis-13109 74 4 evade evade VERB fcis-13109 74 5 this this DET fcis-13109 74 6 detection detection NOUN fcis-13109 74 7 model model NOUN fcis-13109 74 8 by by ADP fcis-13109 74 9 methods method NOUN fcis-13109 74 10 like like ADP fcis-13109 74 11 obscuring obscure VERB fcis-13109 74 12 javascript javascript NOUN fcis-13109 74 13 code code NOUN fcis-13109 74 14 , , PUNCT fcis-13109 74 15 targeting target VERB fcis-13109 74 16 parsers parser NOUN fcis-13109 74 17 , , PUNCT fcis-13109 74 18 or or CCONJ fcis-13109 74 19 launching launch VERB fcis-13109 74 20 mimicry mimicry NOUN fcis-13109 74 21 attacks attack NOUN fcis-13109 74 22 . . PUNCT fcis-13109 75 1 3.3 3.3 NUM fcis-13109 75 2 . . PUNCT fcis-13109 76 1 entropy entropy PROPN fcis-13109 76 2 network network PROPN fcis-13109 76 3 full full ADJ fcis-13109 76 4 - - PUNCT fcis-13109 76 5 flow flow NOUN fcis-13109 76 6 analysis analysis NOUN fcis-13109 76 7 technology technology NOUN fcis-13109 76 8 integrates integrate VERB fcis-13109 76 9 deep deep ADJ fcis-13109 76 10 flow flow NOUN fcis-13109 76 11 inspection inspection NOUN fcis-13109 76 12 ( ( PUNCT fcis-13109 76 13 dfi dfi PROPN fcis-13109 76 14 ) ) PUNCT fcis-13109 76 15 and and CCONJ fcis-13109 76 16 deep deep ADJ fcis-13109 76 17 packet packet NOUN fcis-13109 76 18 inspection inspection NOUN fcis-13109 76 19 ( ( PUNCT fcis-13109 76 20 dpi dpi NOUN fcis-13109 76 21 ) ) PUNCT fcis-13109 76 22 techniques technique NOUN fcis-13109 76 23 , , PUNCT fcis-13109 76 24 aiming aim VERB fcis-13109 76 25 to to PART fcis-13109 76 26 address address VERB fcis-13109 76 27 data datum NOUN fcis-13109 76 28 features feature NOUN fcis-13109 76 29 associated associate VERB fcis-13109 76 30 with with ADP fcis-13109 76 31 network network NOUN fcis-13109 76 32 intrusion intrusion NOUN fcis-13109 76 33 attacks attack NOUN fcis-13109 76 34 and and CCONJ fcis-13109 76 35 0 0 NUM fcis-13109 76 36 - - PUNCT fcis-13109 76 37 day day NOUN fcis-13109 76 38 vulnerability vulnerability NOUN fcis-13109 76 39 threats threat NOUN fcis-13109 76 40 . . PUNCT fcis-13109 77 1 extracting extract VERB fcis-13109 77 2 data datum NOUN fcis-13109 77 3 information information NOUN fcis-13109 77 4 from from ADP fcis-13109 77 5 different different ADJ fcis-13109 77 6 network network NOUN fcis-13109 77 7 layers layer NOUN fcis-13109 77 8 , , PUNCT fcis-13109 77 9 link link NOUN fcis-13109 77 10 layers layer NOUN fcis-13109 77 11 , , PUNCT fcis-13109 77 12 and and CCONJ fcis-13109 77 13 application application NOUN fcis-13109 77 14 layers layer NOUN fcis-13109 77 15 , , PUNCT fcis-13109 77 16 facilitates facilitate VERB fcis-13109 77 17 the the DET fcis-13109 77 18 identification identification NOUN fcis-13109 77 19 of of ADP fcis-13109 77 20 anomalous anomalous ADJ fcis-13109 77 21 network network NOUN fcis-13109 77 22 traffic traffic NOUN fcis-13109 77 23 packets packet NOUN fcis-13109 77 24 and and CCONJ fcis-13109 77 25 comprehensive comprehensive ADJ fcis-13109 77 26 network network NOUN fcis-13109 77 27 data datum NOUN fcis-13109 77 28 flow flow NOUN fcis-13109 77 29 . . PUNCT fcis-13109 78 1 figure figure NOUN fcis-13109 78 2 3 3 NUM fcis-13109 78 3 . . PUNCT fcis-13109 79 1 the the DET fcis-13109 79 2 execution execution NOUN fcis-13109 79 3 flow flow NOUN fcis-13109 79 4 of of ADP fcis-13109 79 5 network network NOUN fcis-13109 79 6 full full ADJ fcis-13109 79 7 traffic traffic NOUN fcis-13109 79 8 analysis analysis NOUN fcis-13109 79 9 technology technology NOUN fcis-13109 79 10 the the DET fcis-13109 79 11 main main ADJ fcis-13109 79 12 components component NOUN fcis-13109 79 13 of of ADP fcis-13109 79 14 network network NOUN fcis-13109 79 15 full full ADJ fcis-13109 79 16 - - PUNCT fcis-13109 79 17 flow flow NOUN fcis-13109 79 18 analysis analysis NOUN fcis-13109 79 19 technology technology NOUN fcis-13109 79 20 can can AUX fcis-13109 79 21 be be AUX fcis-13109 79 22 summarized summarize VERB fcis-13109 79 23 into into ADP fcis-13109 79 24 three three NUM fcis-13109 79 25 points point NOUN fcis-13109 79 26 : : PUNCT fcis-13109 79 27 network network NOUN fcis-13109 79 28 full full ADJ fcis-13109 79 29 - - PUNCT fcis-13109 79 30 flow flow NOUN fcis-13109 79 31 collection collection NOUN fcis-13109 79 32 : : PUNCT fcis-13109 79 33 it it PRON fcis-13109 79 34 senses sense VERB fcis-13109 79 35 the the DET fcis-13109 79 36 ip ip NOUN fcis-13109 79 37 and and CCONJ fcis-13109 79 38 mac mac NOUN fcis-13109 79 39 addresses address NOUN fcis-13109 79 40 of of ADP fcis-13109 79 41 different different ADJ fcis-13109 79 42 traffic traffic NOUN fcis-13109 79 43 data datum NOUN fcis-13109 79 44 . . PUNCT fcis-13109 80 1 it it PRON fcis-13109 80 2 gathers gather VERB fcis-13109 80 3 and and CCONJ fcis-13109 80 4 integrates integrate VERB fcis-13109 80 5 comprehensive comprehensive ADJ fcis-13109 80 6 network network NOUN fcis-13109 80 7 traffic traffic NOUN fcis-13109 80 8 , , PUNCT fcis-13109 80 9 total total ADJ fcis-13109 80 10 packets packet NOUN fcis-13109 80 11 , , PUNCT fcis-13109 80 12 total total ADJ fcis-13109 80 13 bytes byte NOUN fcis-13109 80 14 , , PUNCT fcis-13109 80 15 if if SCONJ fcis-13109 80 16 endpoints endpoint NOUN fcis-13109 80 17 , , PUNCT fcis-13109 80 18 and and CCONJ fcis-13109 80 19 other other ADJ fcis-13109 80 20 multi multi ADJ fcis-13109 80 21 - - ADJ fcis-13109 80 22 dimensional dimensional ADJ fcis-13109 80 23 traffic traffic NOUN fcis-13109 80 24 information information NOUN fcis-13109 80 25 . . PUNCT fcis-13109 81 1 network network NOUN fcis-13109 81 2 protocol protocol NOUN fcis-13109 81 3 identification identification NOUN fcis-13109 81 4 : : PUNCT fcis-13109 81 5 utilizing utilize VERB fcis-13109 81 6 ip ip DET fcis-13109 81 7 protocols protocol NOUN fcis-13109 81 8 and and CCONJ fcis-13109 81 9 tcp tcp PROPN fcis-13109 81 10 / / SYM fcis-13109 81 11 udp udp NOUN fcis-13109 81 12 protocols protocol NOUN fcis-13109 81 13 , , PUNCT fcis-13109 81 14 operations operation NOUN fcis-13109 81 15 are be AUX fcis-13109 81 16 conducted conduct VERB fcis-13109 81 17 according accord VERB fcis-13109 81 18 to to ADP fcis-13109 81 19 the the DET fcis-13109 81 20 rules rule NOUN fcis-13109 81 21 of of ADP fcis-13109 81 22 the the DET fcis-13109 81 23 network network NOUN fcis-13109 81 24 protocol protocol NOUN fcis-13109 81 25 stack stack NOUN fcis-13109 81 26 . . PUNCT fcis-13109 82 1 it it PRON fcis-13109 82 2 provides provide VERB fcis-13109 82 3 an an DET fcis-13109 82 4 in in ADP fcis-13109 82 5 - - PUNCT fcis-13109 82 6 depth depth NOUN fcis-13109 82 7 view view NOUN fcis-13109 82 8 of of ADP fcis-13109 82 9 network network NOUN fcis-13109 82 10 traffic traffic NOUN fcis-13109 82 11 and and CCONJ fcis-13109 82 12 new new ADJ fcis-13109 82 13 sessions session NOUN fcis-13109 82 14 ' ' PART fcis-13109 82 15 data datum NOUN fcis-13109 82 16 packet packet NOUN fcis-13109 82 17 compositions composition NOUN fcis-13109 82 18 over over ADP fcis-13109 82 19 any any DET fcis-13109 82 20 given give VERB fcis-13109 82 21 time time NOUN fcis-13109 82 22 range range NOUN fcis-13109 82 23 . . PUNCT fcis-13109 83 1 this this PRON fcis-13109 83 2 involves involve VERB fcis-13109 83 3 detecting detect VERB fcis-13109 83 4 , , PUNCT fcis-13109 83 5 parsing parsing NOUN fcis-13109 83 6 , , PUNCT fcis-13109 83 7 and and CCONJ fcis-13109 83 8 bifurcating bifurcate VERB fcis-13109 83 9 abnormal abnormal ADJ fcis-13109 83 10 network network NOUN fcis-13109 83 11 traffic traffic NOUN fcis-13109 83 12 . . PUNCT fcis-13109 84 1 by by ADP fcis-13109 84 2 splitting split VERB fcis-13109 84 3 and and CCONJ fcis-13109 84 4 combining combine VERB fcis-13109 84 5 the the DET fcis-13109 84 6 analysis analysis NOUN fcis-13109 84 7 of of ADP fcis-13109 84 8 various various ADJ fcis-13109 84 9 data datum NOUN fcis-13109 84 10 packets packet NOUN fcis-13109 84 11 and and CCONJ fcis-13109 84 12 data datum NOUN fcis-13109 84 13 streams stream NOUN fcis-13109 84 14 , , PUNCT fcis-13109 84 15 genuine genuine ADJ fcis-13109 84 16 information information NOUN fcis-13109 84 17 about about ADP fcis-13109 84 18 user user NOUN fcis-13109 84 19 107 107 NUM fcis-13109 84 20 intrusion intrusion NOUN fcis-13109 84 21 attacks attack NOUN fcis-13109 84 22 and and CCONJ fcis-13109 84 23 network network NOUN fcis-13109 84 24 vulnerability vulnerability NOUN fcis-13109 84 25 threats threat NOUN fcis-13109 84 26 is be AUX fcis-13109 84 27 procured procure VERB fcis-13109 84 28 . . PUNCT fcis-13109 85 1 deep deep ADJ fcis-13109 85 2 decoding decoding NOUN fcis-13109 85 3 and and CCONJ fcis-13109 85 4 restoration restoration NOUN fcis-13109 85 5 of of ADP fcis-13109 85 6 network network NOUN fcis-13109 85 7 data datum NOUN fcis-13109 85 8 flow flow NOUN fcis-13109 85 9 : : PUNCT fcis-13109 85 10 the the DET fcis-13109 85 11 dfi dfi PROPN fcis-13109 85 12 data data PROPN fcis-13109 85 13 flow flow NOUN fcis-13109 85 14 detection detection NOUN fcis-13109 85 15 engine engine NOUN fcis-13109 85 16 technology technology NOUN fcis-13109 85 17 is be AUX fcis-13109 85 18 employed employ VERB fcis-13109 85 19 to to PART fcis-13109 85 20 inspect inspect VERB fcis-13109 85 21 traffic traffic NOUN fcis-13109 85 22 metrics metric NOUN fcis-13109 85 23 of of ADP fcis-13109 85 24 different different ADJ fcis-13109 85 25 network network NOUN fcis-13109 85 26 segments segment NOUN fcis-13109 85 27 and and CCONJ fcis-13109 85 28 network network NOUN fcis-13109 85 29 application application NOUN fcis-13109 85 30 entities entity NOUN fcis-13109 85 31 . . PUNCT fcis-13109 86 1 this this PRON fcis-13109 86 2 includes include VERB fcis-13109 86 3 the the DET fcis-13109 86 4 detection detection NOUN fcis-13109 86 5 of of ADP fcis-13109 86 6 network network NOUN fcis-13109 86 7 protocols protocol NOUN fcis-13109 86 8 , , PUNCT fcis-13109 86 9 ip ip DET fcis-13109 86 10 addresses address NOUN fcis-13109 86 11 , , PUNCT fcis-13109 86 12 mac mac NOUN fcis-13109 86 13 addresses address NOUN fcis-13109 86 14 , , PUNCT fcis-13109 86 15 and and CCONJ fcis-13109 86 16 ip ip NOUN fcis-13109 86 17 conversations conversation NOUN fcis-13109 86 18 , , PUNCT fcis-13109 86 19 followed follow VERB fcis-13109 86 20 by by ADP fcis-13109 86 21 issuing issue VERB fcis-13109 86 22 alerts alert NOUN fcis-13109 86 23 . . PUNCT fcis-13109 87 1 the the DET fcis-13109 87 2 dpi dpi NOUN fcis-13109 87 3 packet packet NOUN fcis-13109 87 4 detection detection NOUN fcis-13109 87 5 technology technology NOUN fcis-13109 87 6 , , PUNCT fcis-13109 87 7 in in ADP fcis-13109 87 8 conjunction conjunction NOUN fcis-13109 87 9 with with ADP fcis-13109 87 10 the the DET fcis-13109 87 11 parsing parsing NOUN fcis-13109 87 12 recognition recognition NOUN fcis-13109 87 13 capability capability NOUN fcis-13109 87 14 of of ADP fcis-13109 87 15 the the DET fcis-13109 87 16 network network NOUN fcis-13109 87 17 protocol protocol NOUN fcis-13109 87 18 stack stack NOUN fcis-13109 87 19 , , PUNCT fcis-13109 87 20 is be AUX fcis-13109 87 21 used use VERB fcis-13109 87 22 to to PART fcis-13109 87 23 analyze analyze VERB fcis-13109 87 24 network network NOUN fcis-13109 87 25 node node NOUN fcis-13109 87 26 ports port NOUN fcis-13109 87 27 , , PUNCT fcis-13109 87 28 ip ip DET fcis-13109 87 29 addresses address NOUN fcis-13109 87 30 , , PUNCT fcis-13109 87 31 data datum NOUN fcis-13109 87 32 packet packet NOUN fcis-13109 87 33 flags flag NOUN fcis-13109 87 34 , , PUNCT fcis-13109 87 35 and and CCONJ fcis-13109 87 36 data datum NOUN fcis-13109 87 37 packet packet NOUN fcis-13109 87 38 payloads payload NOUN fcis-13109 87 39 . . PUNCT fcis-13109 88 1 this this PRON fcis-13109 88 2 helps help VERB fcis-13109 88 3 in in ADP fcis-13109 88 4 identifying identify VERB fcis-13109 88 5 concealed conceal VERB fcis-13109 88 6 novel novel ADJ fcis-13109 88 7 threat threat NOUN fcis-13109 88 8 attacks attack NOUN fcis-13109 88 9 within within ADP fcis-13109 88 10 the the DET fcis-13109 88 11 network network NOUN fcis-13109 88 12 data datum NOUN fcis-13109 88 13 flow flow NOUN fcis-13109 88 14 [ [ X fcis-13109 88 15 4 4 NUM fcis-13109 88 16 ] ] PUNCT fcis-13109 88 17 . . PUNCT fcis-13109 89 1 moreover moreover ADV fcis-13109 89 2 , , PUNCT fcis-13109 89 3 an an DET fcis-13109 89 4 abnormal abnormal ADJ fcis-13109 89 5 threat threat NOUN fcis-13109 89 6 intelligence intelligence NOUN fcis-13109 89 7 analysis analysis NOUN fcis-13109 89 8 model model NOUN fcis-13109 89 9 is be AUX fcis-13109 89 10 established establish VERB fcis-13109 89 11 to to PART fcis-13109 89 12 cater cater VERB fcis-13109 89 13 to to ADP fcis-13109 89 14 the the DET fcis-13109 89 15 attack attack NOUN fcis-13109 89 16 chain chain NOUN fcis-13109 89 17 targeting target VERB fcis-13109 89 18 network network NOUN fcis-13109 89 19 intrusions intrusion NOUN fcis-13109 89 20 . . PUNCT fcis-13109 90 1 this this DET fcis-13109 90 2 model model NOUN fcis-13109 90 3 connects connect VERB fcis-13109 90 4 different different ADJ fcis-13109 90 5 network network NOUN fcis-13109 90 6 nodes node NOUN fcis-13109 90 7 and and CCONJ fcis-13109 90 8 the the DET fcis-13109 90 9 progression progression NOUN fcis-13109 90 10 levels level NOUN fcis-13109 90 11 of of ADP fcis-13109 90 12 intrusion intrusion NOUN fcis-13109 90 13 attacks attack NOUN fcis-13109 90 14 , , PUNCT fcis-13109 90 15 thereby thereby ADV fcis-13109 90 16 crafting craft VERB fcis-13109 90 17 a a DET fcis-13109 90 18 comprehensive comprehensive ADJ fcis-13109 90 19 attack attack NOUN fcis-13109 90 20 chain chain NOUN fcis-13109 90 21 execution execution NOUN fcis-13109 90 22 process process NOUN fcis-13109 90 23 . . PUNCT fcis-13109 91 1 the the DET fcis-13109 91 2 model model NOUN fcis-13109 91 3 encompasses encompass VERB fcis-13109 91 4 components component NOUN fcis-13109 91 5 like like ADP fcis-13109 91 6 intrusion intrusion NOUN fcis-13109 91 7 target target NOUN fcis-13109 91 8 detection detection NOUN fcis-13109 91 9 , , PUNCT fcis-13109 91 10 malicious malicious ADJ fcis-13109 91 11 attack attack NOUN fcis-13109 91 12 code code NOUN fcis-13109 91 13 detection detection NOUN fcis-13109 91 14 , , PUNCT fcis-13109 91 15 attack attack NOUN fcis-13109 91 16 code code NOUN fcis-13109 91 17 distribution distribution NOUN fcis-13109 91 18 , , PUNCT fcis-13109 91 19 trojan trojan NOUN fcis-13109 91 20 program program NOUN fcis-13109 91 21 or or CCONJ fcis-13109 91 22 link link NOUN fcis-13109 91 23 control control NOUN fcis-13109 91 24 , , PUNCT fcis-13109 91 25 and and CCONJ fcis-13109 91 26 extraction extraction NOUN fcis-13109 91 27 of of ADP fcis-13109 91 28 anomalous anomalous ADJ fcis-13109 91 29 attack attack NOUN fcis-13109 91 30 traffic traffic NOUN fcis-13109 91 31 data datum NOUN fcis-13109 91 32 . . PUNCT fcis-13109 92 1 by by ADP fcis-13109 92 2 analyzing analyze VERB fcis-13109 92 3 intrusion intrusion NOUN fcis-13109 92 4 attackers attacker NOUN fcis-13109 92 5 and and CCONJ fcis-13109 92 6 abnormal abnormal ADJ fcis-13109 92 7 threat threat NOUN fcis-13109 92 8 elements element NOUN fcis-13109 92 9 , , PUNCT fcis-13109 92 10 this this DET fcis-13109 92 11 model model NOUN fcis-13109 92 12 is be AUX fcis-13109 92 13 adept adept ADJ fcis-13109 92 14 at at ADP fcis-13109 92 15 severing sever VERB fcis-13109 92 16 the the DET fcis-13109 92 17 attack attack NOUN fcis-13109 92 18 chain chain NOUN fcis-13109 92 19 nodes node NOUN fcis-13109 92 20 and and CCONJ fcis-13109 92 21 propagation propagation NOUN fcis-13109 92 22 paths path NOUN fcis-13109 92 23 before before ADP fcis-13109 92 24 the the DET fcis-13109 92 25 successful successful ADJ fcis-13109 92 26 implementation implementation NOUN fcis-13109 92 27 of of ADP fcis-13109 92 28 an an DET fcis-13109 92 29 attack attack NOUN fcis-13109 92 30 , , PUNCT fcis-13109 92 31 thus thus ADV fcis-13109 92 32 successfully successfully ADV fcis-13109 92 33 thwarting thwart VERB fcis-13109 92 34 threats threat NOUN fcis-13109 92 35 and and CCONJ fcis-13109 92 36 safeguarding safeguard VERB fcis-13109 92 37 network network NOUN fcis-13109 92 38 security security NOUN fcis-13109 92 39 . . PUNCT fcis-13109 93 1 figure figure NOUN fcis-13109 93 2 4 4 NUM fcis-13109 93 3 . . NOUN fcis-13109 93 4 abnormal abnormal ADJ fcis-13109 93 5 threat threat NOUN fcis-13109 93 6 intelligence intelligence NOUN fcis-13109 93 7 analysis analysis NOUN fcis-13109 93 8 model model NOUN fcis-13109 93 9 based base VERB fcis-13109 93 10 on on ADP fcis-13109 93 11 attack attack NOUN fcis-13109 93 12 chain chain NOUN fcis-13109 93 13 first first ADV fcis-13109 93 14 and and CCONJ fcis-13109 93 15 foremost foremost ADV fcis-13109 93 16 , , PUNCT fcis-13109 93 17 intrusion intrusion NOUN fcis-13109 93 18 target target NOUN fcis-13109 93 19 detection detection NOUN fcis-13109 93 20 is be AUX fcis-13109 93 21 carried carry VERB fcis-13109 93 22 out out ADP fcis-13109 93 23 using use VERB fcis-13109 93 24 network network NOUN fcis-13109 93 25 full full ADJ fcis-13109 93 26 - - PUNCT fcis-13109 93 27 flow flow NOUN fcis-13109 93 28 analysis analysis NOUN fcis-13109 93 29 technology technology NOUN fcis-13109 93 30 , , PUNCT fcis-13109 93 31 encompassing encompass VERB fcis-13109 93 32 port port NOUN fcis-13109 93 33 scanning scanning NOUN fcis-13109 93 34 and and CCONJ fcis-13109 93 35 node node NOUN fcis-13109 93 36 scanning scanning NOUN fcis-13109 93 37 . . PUNCT fcis-13109 94 1 this this PRON fcis-13109 94 2 aims aim VERB fcis-13109 94 3 to to PART fcis-13109 94 4 identify identify VERB fcis-13109 94 5 external external ADJ fcis-13109 94 6 attackers attacker NOUN fcis-13109 94 7 and and CCONJ fcis-13109 94 8 exploitable exploitable ADJ fcis-13109 94 9 data datum NOUN fcis-13109 94 10 resources resource NOUN fcis-13109 94 11 , , PUNCT fcis-13109 94 12 thereby thereby ADV fcis-13109 94 13 completing complete VERB fcis-13109 94 14 the the DET fcis-13109 94 15 probe probe NOUN fcis-13109 94 16 into into ADP fcis-13109 94 17 the the DET fcis-13109 94 18 network network NOUN fcis-13109 94 19 system system NOUN fcis-13109 94 20 nodes nod VERB fcis-13109 94 21 . . PUNCT fcis-13109 95 1 subsequently subsequently ADV fcis-13109 95 2 , , PUNCT fcis-13109 95 3 malicious malicious ADJ fcis-13109 95 4 attack attack NOUN fcis-13109 95 5 codes code NOUN fcis-13109 95 6 and and CCONJ fcis-13109 95 7 their their PRON fcis-13109 95 8 distribution distribution NOUN fcis-13109 95 9 are be AUX fcis-13109 95 10 detected detect VERB fcis-13109 95 11 for for ADP fcis-13109 95 12 the the DET fcis-13109 95 13 targeted target VERB fcis-13109 95 14 network network NOUN fcis-13109 95 15 nodes node NOUN fcis-13109 95 16 . . PUNCT fcis-13109 96 1 this this PRON fcis-13109 96 2 involves involve VERB fcis-13109 96 3 detecting detect VERB fcis-13109 96 4 the the DET fcis-13109 96 5 malicious malicious ADJ fcis-13109 96 6 code code NOUN fcis-13109 96 7 developed develop VERB fcis-13109 96 8 and and CCONJ fcis-13109 96 9 executed execute VERB fcis-13109 96 10 by by ADP fcis-13109 96 11 attackers attacker NOUN fcis-13109 96 12 as as ADV fcis-13109 96 13 well well ADV fcis-13109 96 14 as as ADP fcis-13109 96 15 identifying identify VERB fcis-13109 96 16 malicious malicious ADJ fcis-13109 96 17 code code NOUN fcis-13109 96 18 disseminated disseminate VERB fcis-13109 96 19 through through ADP fcis-13109 96 20 web web NOUN fcis-13109 96 21 vulnerabilities vulnerability NOUN fcis-13109 96 22 or or CCONJ fcis-13109 96 23 phishing phishe VERB fcis-13109 96 24 techniques technique NOUN fcis-13109 96 25 . . PUNCT fcis-13109 97 1 following follow VERB fcis-13109 97 2 that that PRON fcis-13109 97 3 , , PUNCT fcis-13109 97 4 after after SCONJ fcis-13109 97 5 the the DET fcis-13109 97 6 attacker attacker NOUN fcis-13109 97 7 breaches breach VERB fcis-13109 97 8 the the DET fcis-13109 97 9 target target NOUN fcis-13109 97 10 network network NOUN fcis-13109 97 11 , , PUNCT fcis-13109 97 12 there there PRON fcis-13109 97 13 's be VERB fcis-13109 97 14 the the DET fcis-13109 97 15 detection detection NOUN fcis-13109 97 16 of of ADP fcis-13109 97 17 the the DET fcis-13109 97 18 utilization utilization NOUN fcis-13109 97 19 of of ADP fcis-13109 97 20 trojan trojan NOUN fcis-13109 97 21 programs program NOUN fcis-13109 97 22 or or CCONJ fcis-13109 97 23 link link NOUN fcis-13109 97 24 controls control NOUN fcis-13109 97 25 . . PUNCT fcis-13109 98 1 this this PRON fcis-13109 98 2 includes include VERB fcis-13109 98 3 identifying identify VERB fcis-13109 98 4 the the DET fcis-13109 98 5 installation installation NOUN fcis-13109 98 6 of of ADP fcis-13109 98 7 malicious malicious ADJ fcis-13109 98 8 software software NOUN fcis-13109 98 9 or or CCONJ fcis-13109 98 10 trojan trojan NOUN fcis-13109 98 11 programs program NOUN fcis-13109 98 12 and and CCONJ fcis-13109 98 13 the the DET fcis-13109 98 14 execution execution NOUN fcis-13109 98 15 of of ADP fcis-13109 98 16 malicious malicious ADJ fcis-13109 98 17 codes code NOUN fcis-13109 98 18 . . PUNCT fcis-13109 99 1 it it PRON fcis-13109 99 2 also also ADV fcis-13109 99 3 involves involve VERB fcis-13109 99 4 analyzing analyze VERB fcis-13109 99 5 the the DET fcis-13109 99 6 execution execution NOUN fcis-13109 99 7 of of ADP fcis-13109 99 8 attack attack NOUN fcis-13109 99 9 commands command NOUN fcis-13109 99 10 by by ADP fcis-13109 99 11 monitoring monitor VERB fcis-13109 99 12 the the DET fcis-13109 99 13 attacker attacker NOUN fcis-13109 99 14 's 's PART fcis-13109 99 15 links link NOUN fcis-13109 99 16 to to ADP fcis-13109 99 17 the the DET fcis-13109 99 18 target target NOUN fcis-13109 99 19 host host NOUN fcis-13109 99 20 . . PUNCT fcis-13109 100 1 lastly lastly ADV fcis-13109 100 2 , , PUNCT fcis-13109 100 3 concerning concern VERB fcis-13109 100 4 each each DET fcis-13109 100 5 stage stage NOUN fcis-13109 100 6 of of ADP fcis-13109 100 7 the the DET fcis-13109 100 8 attack attack NOUN fcis-13109 100 9 chain chain NOUN fcis-13109 100 10 , , PUNCT fcis-13109 100 11 the the DET fcis-13109 100 12 anomalous anomalous ADJ fcis-13109 100 13 traffic traffic NOUN fcis-13109 100 14 data datum NOUN fcis-13109 100 15 undergoes undergo VERB fcis-13109 100 16 data datum NOUN fcis-13109 100 17 attribute attribute NOUN fcis-13109 100 18 feature feature NOUN fcis-13109 100 19 extraction extraction NOUN fcis-13109 100 20 and and CCONJ fcis-13109 100 21 the the DET fcis-13109 100 22 reconstruction reconstruction NOUN fcis-13109 100 23 of of ADP fcis-13109 100 24 the the DET fcis-13109 100 25 attack attack NOUN fcis-13109 100 26 process process NOUN fcis-13109 100 27 . . PUNCT fcis-13109 101 1 this this PRON fcis-13109 101 2 facilitates facilitate VERB fcis-13109 101 3 indirect indirect ADJ fcis-13109 101 4 determination determination NOUN fcis-13109 101 5 of of ADP fcis-13109 101 6 the the DET fcis-13109 101 7 progression progression NOUN fcis-13109 101 8 of of ADP fcis-13109 101 9 network network NOUN fcis-13109 101 10 threat threat NOUN fcis-13109 101 11 attacks attack NOUN fcis-13109 101 12 and and CCONJ fcis-13109 101 13 the the DET fcis-13109 101 14 degree degree NOUN fcis-13109 101 15 of of ADP fcis-13109 101 16 harm harm NOUN fcis-13109 101 17 to to ADP fcis-13109 101 18 the the DET fcis-13109 101 19 target target NOUN fcis-13109 101 20 network network NOUN fcis-13109 101 21 . . PUNCT fcis-13109 102 1 references reference NOUN fcis-13109 102 2 [ [ X fcis-13109 102 3 1 1 NUM fcis-13109 102 4 ] ] X fcis-13109 102 5 yue yue PROPN fcis-13109 102 6 , , PUNCT fcis-13109 102 7 m. m. NOUN fcis-13109 102 8 ( ( PUNCT fcis-13109 102 9 2021 2021 NUM fcis-13109 102 10 ) ) PUNCT fcis-13109 102 11 . . PUNCT fcis-13109 103 1 a a DET fcis-13109 103 2 survey survey NOUN fcis-13109 103 3 of of ADP fcis-13109 103 4 research research NOUN fcis-13109 103 5 on on ADP fcis-13109 103 6 malicious malicious ADJ fcis-13109 103 7 document document NOUN fcis-13109 103 8 detection detection NOUN fcis-13109 103 9 . . PUNCT fcis-13109 104 1 journal journal NOUN fcis-13109 104 2 of of ADP fcis-13109 104 3 cyber cyber PROPN fcis-13109 104 4 security security NOUN fcis-13109 104 5 , , PUNCT fcis-13109 104 6 6(03):54 6(03):54 NOUN fcis-13109 104 7 - - SYM fcis-13109 104 8 76 76 NUM fcis-13109 104 9 . . PUNCT fcis-13109 105 1 [ [ X fcis-13109 105 2 2 2 NUM fcis-13109 105 3 ] ] SYM fcis-13109 105 4 yang yang PROPN fcis-13109 105 5 , , PUNCT fcis-13109 105 6 s. s. PROPN fcis-13109 105 7 j. j. PROPN fcis-13109 105 8 ( ( PUNCT fcis-13109 105 9 2014 2014 NUM fcis-13109 105 10 ) ) PUNCT fcis-13109 105 11 . . PUNCT fcis-13109 106 1 detection detection NOUN fcis-13109 106 2 of of ADP fcis-13109 106 3 malicious malicious ADJ fcis-13109 106 4 web web NOUN fcis-13109 106 5 pages page NOUN fcis-13109 106 6 and and CCONJ fcis-13109 106 7 pdf pdf NOUN fcis-13109 106 8 documents document NOUN fcis-13109 106 9 based base VERB fcis-13109 106 10 on on ADP fcis-13109 106 11 svm svm PROPN fcis-13109 106 12 model model NOUN fcis-13109 106 13 . . PUNCT fcis-13109 107 1 technical technical ADJ fcis-13109 107 2 research research NOUN fcis-13109 107 3 , , PUNCT fcis-13109 107 4 26 26 NUM fcis-13109 107 5 - - SYM fcis-13109 107 6 45 45 NUM fcis-13109 107 7 . . PUNCT fcis-13109 108 1 [ [ X fcis-13109 108 2 3 3 NUM fcis-13109 108 3 ] ] X fcis-13109 108 4 gu gu NOUN fcis-13109 108 5 , , PUNCT fcis-13109 108 6 j. j. PROPN fcis-13109 108 7 x. x. PROPN fcis-13109 108 8 ( ( PUNCT fcis-13109 108 9 2021 2021 NUM fcis-13109 108 10 ) ) PUNCT fcis-13109 108 11 . . PUNCT fcis-13109 109 1 malicious malicious ADJ fcis-13109 109 2 pdf pdf NOUN fcis-13109 109 3 document document NOUN fcis-13109 109 4 detection detection NOUN fcis-13109 109 5 based base VERB fcis-13109 109 6 on on ADP fcis-13109 109 7 positive positive ADJ fcis-13109 109 8 sample sample NOUN fcis-13109 109 9 and and CCONJ fcis-13109 109 10 single single ADJ fcis-13109 109 11 classification classification NOUN fcis-13109 109 12 algorithm algorithm NOUN fcis-13109 109 13 . . PUNCT fcis-13109 110 1 technical technical ADJ fcis-13109 110 2 research research NOUN fcis-13109 110 3 , , PUNCT fcis-13109 110 4 20 20 NUM fcis-13109 110 5 - - SYM fcis-13109 110 6 40 40 NUM fcis-13109 110 7 . . PUNCT fcis-13109 111 1 [ [ X fcis-13109 111 2 4 4 NUM fcis-13109 111 3 ] ] X fcis-13109 111 4 yuan yuan NOUN fcis-13109 111 5 , , PUNCT fcis-13109 111 6 h. h. PROPN fcis-13109 111 7 h. h. PROPN fcis-13109 111 8 ( ( PUNCT fcis-13109 111 9 2022 2022 NUM fcis-13109 111 10 ) ) PUNCT fcis-13109 111 11 . . PUNCT fcis-13109 112 1 research research NOUN fcis-13109 112 2 on on ADP fcis-13109 112 3 abnormal abnormal ADJ fcis-13109 112 4 threat threat NOUN fcis-13109 112 5 detection detection NOUN fcis-13109 112 6 based base VERB fcis-13109 112 7 on on ADP fcis-13109 112 8 network network NOUN fcis-13109 112 9 full full ADJ fcis-13109 112 10 traffic traffic NOUN fcis-13109 112 11 analysis analysis NOUN fcis-13109 112 12 technology technology NOUN fcis-13109 112 13 . . PUNCT fcis-13109 113 1 technical technical ADJ fcis-13109 113 2 research research NOUN fcis-13109 113 3 , , PUNCT fcis-13109 113 4 11 11 NUM fcis-13109 113 5 : : SYM fcis-13109 113 6 137 137 NUM fcis-13109 113 7 - - SYM fcis-13109 113 8 140 140 NUM fcis-13109 113 9 . . PUNCT