id sid tid token lemma pos iajs-320 1 1 microsoft microsoft PROPN iajs-320 1 2 word word NOUN iajs-320 1 3 1 1 NUM iajs-320 1 4 556 556 NUM iajs-320 1 5 | | NOUN iajs-320 1 6 computer computer NOUN iajs-320 1 7 science science NOUN iajs-320 1 8 2014 2014 NUM iajs-320 1 9 ) ) PUNCT iajs-320 1 10 عام عام ADP iajs-320 1 11 3(العدد 3(العدد NUM iajs-320 1 12 27المجلد 27المجلد NUM iajs-320 1 13 مجلة مجلة VERB iajs-320 1 14 إبن إبن NOUN iajs-320 1 15 الھيثم الھيثم NOUN iajs-320 1 16 للعلوم للعلوم NOUN iajs-320 1 17 الصرفة الصرفة NOUN iajs-320 2 1 و و PRON iajs-320 2 2 التطبيقية التطبيقية ADJ iajs-320 2 3 ibn ibn PROPN iajs-320 2 4 al al PROPN iajs-320 2 5 - - PUNCT iajs-320 2 6 haitham haitham PROPN iajs-320 2 7 jour jour X iajs-320 2 8 . . PROPN iajs-320 2 9 for for ADP iajs-320 2 10 pure pure ADJ iajs-320 2 11 & & CCONJ iajs-320 2 12 appl appl PROPN iajs-320 2 13 . . PUNCT iajs-320 3 1 sci sci PROPN iajs-320 3 2 . . PUNCT iajs-320 3 3 vol vol NOUN iajs-320 3 4 . . PROPN iajs-320 4 1 27 27 NUM iajs-320 4 2 ( ( PUNCT iajs-320 4 3 3 3 NUM iajs-320 4 4 ) ) PUNCT iajs-320 4 5 2014 2014 NUM iajs-320 5 1 reducing reduce VERB iajs-320 5 2 false false ADJ iajs-320 5 3 notification notification NOUN iajs-320 5 4 in in ADP iajs-320 5 5 identifying identify VERB iajs-320 5 6 malicious malicious ADJ iajs-320 5 7 application application NOUN iajs-320 5 8 programming programming NOUN iajs-320 5 9 interface(api interface(api NOUN iajs-320 5 10 ) ) PUNCT iajs-320 5 11 to to PART iajs-320 5 12 detect detect VERB iajs-320 5 13 malwares malware NOUN iajs-320 5 14 using use VERB iajs-320 5 15 artificial artificial ADJ iajs-320 5 16 neural neural ADJ iajs-320 5 17 network network NOUN iajs-320 5 18 with with ADP iajs-320 5 19 discriminant discriminant ADJ iajs-320 5 20 analysis analysis NOUN iajs-320 5 21 abbas abbas PROPN iajs-320 5 22 m. m. PROPN iajs-320 5 23 al al PROPN iajs-320 5 24 - - PUNCT iajs-320 5 25 bakri bakri PROPN iajs-320 5 26 college college NOUN iajs-320 5 27 of of ADP iajs-320 5 28 computer computer NOUN iajs-320 5 29 and and CCONJ iajs-320 5 30 mathematics/ mathematics/ PROPN iajs-320 5 31 university university NOUN iajs-320 5 32 of of ADP iajs-320 5 33 kuffa kuffa PROPN iajs-320 5 34 hussein hussein PROPN iajs-320 5 35 l. l. PROPN iajs-320 5 36 hussein hussein PROPN iajs-320 5 37 dept.of dept.of PROPN iajs-320 5 38 computer computer NOUN iajs-320 5 39 science science NOUN iajs-320 5 40 / / SYM iajs-320 5 41 college college NOUN iajs-320 5 42 of of ADP iajs-320 5 43 eduucationfor eduucationfor PROPN iajs-320 5 44 pure pure ADJ iajs-320 5 45 science(ibnalhaitham)/universityof science(ibnalhaitham)/universityof PROPN iajs-320 5 46 baghdad baghdad PROPN iajs-320 5 47 received receive VERB iajs-320 5 48 in:7 in:7 PROPN iajs-320 5 49 september september PROPN iajs-320 5 50 2014 2014 NUM iajs-320 5 51 accepted accept VERB iajs-320 5 52 in in ADP iajs-320 5 53 : : PUNCT iajs-320 5 54 24 24 NUM iajs-320 5 55 november2014 november2014 NOUN iajs-320 5 56 abstract abstract ADV iajs-320 5 57 this this DET iajs-320 5 58 paper paper NOUN iajs-320 5 59 argues argue VERB iajs-320 5 60 the the DET iajs-320 5 61 accuracy accuracy NOUN iajs-320 5 62 of of ADP iajs-320 5 63 behavior behavior NOUN iajs-320 5 64 based base VERB iajs-320 5 65 detection detection NOUN iajs-320 5 66 systems system NOUN iajs-320 5 67 , , PUNCT iajs-320 5 68 in in ADP iajs-320 5 69 which which PRON iajs-320 5 70 the the DET iajs-320 5 71 application application NOUN iajs-320 5 72 programming programming NOUN iajs-320 5 73 interfaces interface NOUN iajs-320 5 74 ( ( PUNCT iajs-320 5 75 api api NOUN iajs-320 5 76 ) ) PUNCT iajs-320 5 77 calls call NOUN iajs-320 5 78 are be AUX iajs-320 5 79 analyzed analyze VERB iajs-320 5 80 and and CCONJ iajs-320 5 81 monitored monitor VERB iajs-320 5 82 . . PUNCT iajs-320 6 1 the the DET iajs-320 6 2 work work NOUN iajs-320 6 3 identifies identify VERB iajs-320 6 4 the the DET iajs-320 6 5 problems problem NOUN iajs-320 6 6 that that PRON iajs-320 6 7 affecting affect VERB iajs-320 6 8 the the DET iajs-320 6 9 accuracy accuracy NOUN iajs-320 6 10 of of ADP iajs-320 6 11 such such ADJ iajs-320 6 12 detection detection NOUN iajs-320 6 13 models model NOUN iajs-320 6 14 . . PUNCT iajs-320 7 1 the the DET iajs-320 7 2 work work NOUN iajs-320 7 3 was be AUX iajs-320 7 4 extracted extract VERB iajs-320 7 5 ( ( PUNCT iajs-320 7 6 4744 4744 NUM iajs-320 7 7 ) ) PUNCT iajs-320 7 8 api api NOUN iajs-320 7 9 call call NOUN iajs-320 7 10 through through ADP iajs-320 7 11 analyzing analyzing NOUN iajs-320 7 12 . . PUNCT iajs-320 8 1 the the DET iajs-320 8 2 new new ADJ iajs-320 8 3 approach approach NOUN iajs-320 8 4 provides provide VERB iajs-320 8 5 an an DET iajs-320 8 6 accurate accurate ADJ iajs-320 8 7 discriminator discriminator NOUN iajs-320 8 8 and and CCONJ iajs-320 8 9 can can AUX iajs-320 8 10 reveal reveal VERB iajs-320 8 11 malicious malicious ADJ iajs-320 8 12 api api NOUN iajs-320 8 13 in in ADP iajs-320 8 14 pe pe PROPN iajs-320 8 15 malware malware NOUN iajs-320 8 16 up up ADV iajs-320 8 17 to to PART iajs-320 8 18 83.2 83.2 NUM iajs-320 8 19 % % NOUN iajs-320 8 20 . . PUNCT iajs-320 9 1 results result NOUN iajs-320 9 2 of of ADP iajs-320 9 3 this this DET iajs-320 9 4 work work NOUN iajs-320 9 5 evaluated evaluate VERB iajs-320 9 6 with with ADP iajs-320 9 7 discriminant discriminant ADJ iajs-320 9 8 analysis analysis NOUN iajs-320 9 9 . . PUNCT iajs-320 9 10     SPACE iajs-320 10 1 keywords keyword NOUN iajs-320 10 2 : : PUNCT iajs-320 10 3     SPACE iajs-320 10 4 pe pe PROPN iajs-320 10 5 malwares malware NOUN iajs-320 10 6 , , PUNCT iajs-320 10 7 malicious malicious ADJ iajs-320 10 8 api api NOUN iajs-320 10 9 , , PUNCT iajs-320 10 10 ann ann PROPN iajs-320 10 11 , , PUNCT iajs-320 10 12 discriminant discriminant ADJ iajs-320 10 13 analysis analysis NOUN iajs-320 10 14 . . PUNCT iajs-320 11 1 557 557 NUM iajs-320 11 2 | | ADV iajs-320 11 3 computer computer NOUN iajs-320 11 4 science science NOUN iajs-320 11 5 2014 2014 NUM iajs-320 11 6 ) ) PUNCT iajs-320 11 7 عام عام ADP iajs-320 11 8 3(العدد 3(العدد NUM iajs-320 11 9 27المجلد 27المجلد NUM iajs-320 11 10 مجلة مجلة VERB iajs-320 11 11 إبن إبن NOUN iajs-320 11 12 الھيثم الھيثم NOUN iajs-320 11 13 للعلوم للعلوم NOUN iajs-320 11 14 الصرفة الصرفة NOUN iajs-320 12 1 و و PRON iajs-320 12 2 التطبيقية التطبيقية ADJ iajs-320 12 3 ibn ibn PROPN iajs-320 12 4 al al PROPN iajs-320 12 5 - - PUNCT iajs-320 12 6 haitham haitham PROPN iajs-320 12 7 jour jour X iajs-320 12 8 . . PROPN iajs-320 12 9 for for ADP iajs-320 12 10 pure pure ADJ iajs-320 12 11 & & CCONJ iajs-320 12 12 appl appl PROPN iajs-320 12 13 . . PUNCT iajs-320 13 1 sci sci PROPN iajs-320 13 2 . . PUNCT iajs-320 13 3 vol vol NOUN iajs-320 13 4 . . PROPN iajs-320 14 1 27 27 NUM iajs-320 14 2 ( ( PUNCT iajs-320 14 3 3 3 NUM iajs-320 14 4 ) ) PUNCT iajs-320 14 5 2014 2014 NUM iajs-320 14 6 introduction introduction NOUN iajs-320 14 7 at at ADP iajs-320 14 8 present present ADJ iajs-320 14 9 , , PUNCT iajs-320 14 10 most most ADV iajs-320 14 11 widely widely ADV iajs-320 14 12 used use VERB iajs-320 14 13 malicious malicious ADJ iajs-320 14 14 executables executable NOUN iajs-320 14 15 detections detection NOUN iajs-320 14 16 adopt adopt VERB iajs-320 14 17 the the DET iajs-320 14 18 technique technique NOUN iajs-320 14 19 of of ADP iajs-320 14 20 signature signature NOUN iajs-320 14 21 - - PUNCT iajs-320 14 22 based base VERB iajs-320 14 23 pattern pattern NOUN iajs-320 14 24 matching matching NOUN iajs-320 14 25 . . PUNCT iajs-320 15 1 it it PRON iajs-320 15 2 is be AUX iajs-320 15 3 simple simple ADJ iajs-320 15 4 and and CCONJ iajs-320 15 5 highly highly ADV iajs-320 15 6 efficient efficient ADJ iajs-320 15 7 , , PUNCT iajs-320 15 8 but but CCONJ iajs-320 15 9 only only ADV iajs-320 15 10 works work VERB iajs-320 15 11 for for ADP iajs-320 15 12 the the DET iajs-320 15 13 malicious malicious ADJ iajs-320 15 14 executables executable NOUN iajs-320 15 15 which which PRON iajs-320 15 16 we we PRON iajs-320 15 17 have have AUX iajs-320 15 18 already already ADV iajs-320 15 19 known know VERB iajs-320 15 20 . . PUNCT iajs-320 16 1 for for ADP iajs-320 16 2 the the DET iajs-320 16 3 unknown unknown ADJ iajs-320 16 4 ones one NOUN iajs-320 16 5 , , PUNCT iajs-320 16 6 this this DET iajs-320 16 7 approach approach NOUN iajs-320 16 8 is be AUX iajs-320 16 9 ineffective ineffective ADJ iajs-320 16 10 . . PUNCT iajs-320 17 1 thus thus ADV iajs-320 17 2 an an DET iajs-320 17 3 alternative alternative ADJ iajs-320 17 4 way way NOUN iajs-320 17 5 has have AUX iajs-320 17 6 been be AUX iajs-320 17 7 brought bring VERB iajs-320 17 8 into into ADP iajs-320 17 9 focus focus NOUN iajs-320 17 10 to to PART iajs-320 17 11 resolve resolve VERB iajs-320 17 12 this this DET iajs-320 17 13 problemidentify problemidentify VERB iajs-320 17 14 the the DET iajs-320 17 15 malicious malicious ADJ iajs-320 17 16 executables executable NOUN iajs-320 17 17 based base VERB iajs-320 17 18 on on ADP iajs-320 17 19 their their PRON iajs-320 17 20 behaviors behavior NOUN iajs-320 17 21 [ [ X iajs-320 17 22 1 1 NUM iajs-320 17 23 ] ] PUNCT iajs-320 17 24 . . PUNCT iajs-320 18 1 with with ADP iajs-320 18 2 the the DET iajs-320 18 3 improvement improvement NOUN iajs-320 18 4 of of ADP iajs-320 18 5 the the DET iajs-320 18 6 techniques technique NOUN iajs-320 18 7 used use VERB iajs-320 18 8 by by ADP iajs-320 18 9 malwares malware NOUN iajs-320 18 10 like like ADP iajs-320 18 11 virus virus NOUN iajs-320 18 12 , , PUNCT iajs-320 18 13 trojan trojan NOUN iajs-320 18 14 and and CCONJ iajs-320 18 15 worm worm NOUN iajs-320 18 16 , , PUNCT iajs-320 18 17 traditional traditional ADJ iajs-320 18 18 malware malware NOUN iajs-320 18 19 detection detection NOUN iajs-320 18 20 approaches approach NOUN iajs-320 18 21 based base VERB iajs-320 18 22 on on ADP iajs-320 18 23 signatures signature NOUN iajs-320 18 24 , , PUNCT iajs-320 18 25 were be AUX iajs-320 18 26 not not PART iajs-320 18 27 effectively effectively ADV iajs-320 18 28 enough enough ADJ iajs-320 18 29 to to PART iajs-320 18 30 detect detect VERB iajs-320 18 31 variables variable NOUN iajs-320 18 32 of of ADP iajs-320 18 33 known know VERB iajs-320 18 34 malwares malware NOUN iajs-320 18 35 [ [ X iajs-320 18 36 2 2 NUM iajs-320 18 37 ] ] PUNCT iajs-320 18 38 . . PUNCT iajs-320 19 1 today today NOUN iajs-320 19 2 security security NOUN iajs-320 19 3 threats threat NOUN iajs-320 19 4 like like ADP iajs-320 19 5 malware malware NOUN iajs-320 19 6 are be AUX iajs-320 19 7 more more ADV iajs-320 19 8 sophisticated sophisticated ADJ iajs-320 19 9 and and CCONJ iajs-320 19 10 targeted target VERB iajs-320 19 11 than than ADP iajs-320 19 12 ever ever ADV iajs-320 19 13 , , PUNCT iajs-320 19 14 and and CCONJ iajs-320 19 15 they they PRON iajs-320 19 16 are be AUX iajs-320 19 17 growing grow VERB iajs-320 19 18 at at ADP iajs-320 19 19 an an DET iajs-320 19 20 unprecedented unprecedented ADJ iajs-320 19 21 rate rate NOUN iajs-320 19 22 . . PUNCT iajs-320 20 1 to to PART iajs-320 20 2 deal deal VERB iajs-320 20 3 with with ADP iajs-320 20 4 them they PRON iajs-320 20 5 , , PUNCT iajs-320 20 6 various various ADJ iajs-320 20 7 approaches approach NOUN iajs-320 20 8 are be AUX iajs-320 20 9 introduced introduce VERB iajs-320 20 10 . . PUNCT iajs-320 21 1 one one NUM iajs-320 21 2 of of ADP iajs-320 21 3 them they PRON iajs-320 21 4 is be AUX iajs-320 21 5 signature signature NOUN iajs-320 21 6 - - PUNCT iajs-320 21 7 based base VERB iajs-320 21 8 detection detection NOUN iajs-320 21 9 , , PUNCT iajs-320 21 10 which which PRON iajs-320 21 11 is be AUX iajs-320 21 12 an an DET iajs-320 21 13 effective effective ADJ iajs-320 21 14 method method NOUN iajs-320 21 15 and and CCONJ iajs-320 21 16 widely widely ADV iajs-320 21 17 used use VERB iajs-320 21 18 to to PART iajs-320 21 19 detect detect VERB iajs-320 21 20 malware malware NOUN iajs-320 21 21 ; ; PUNCT iajs-320 21 22 however however ADV iajs-320 21 23 , , PUNCT iajs-320 21 24 there there PRON iajs-320 21 25 is be VERB iajs-320 21 26 a a DET iajs-320 21 27 substantial substantial ADJ iajs-320 21 28 problem problem NOUN iajs-320 21 29 in in ADP iajs-320 21 30 detecting detect VERB iajs-320 21 31 new new ADJ iajs-320 21 32 instances instance NOUN iajs-320 21 33 . . PUNCT iajs-320 22 1 in in ADP iajs-320 22 2 other other ADJ iajs-320 22 3 words word NOUN iajs-320 22 4 , , PUNCT iajs-320 22 5 it it PRON iajs-320 22 6 is be AUX iajs-320 22 7 solely solely ADV iajs-320 22 8 useful useful ADJ iajs-320 22 9 for for ADP iajs-320 22 10 the the DET iajs-320 22 11 second second ADJ iajs-320 22 12 malware malware NOUN iajs-320 22 13 attack attack NOUN iajs-320 22 14 . . PUNCT iajs-320 23 1 due due ADP iajs-320 23 2 to to ADP iajs-320 23 3 the the DET iajs-320 23 4 rapid rapid ADJ iajs-320 23 5 proliferation proliferation NOUN iajs-320 23 6 of of ADP iajs-320 23 7 malware malware NOUN iajs-320 23 8 and and CCONJ iajs-320 23 9 the the DET iajs-320 23 10 desperate desperate ADJ iajs-320 23 11 need need NOUN iajs-320 23 12 for for ADP iajs-320 23 13 human human ADJ iajs-320 23 14 effort effort NOUN iajs-320 23 15 to to PART iajs-320 23 16 extract extract VERB iajs-320 23 17 some some DET iajs-320 23 18 kinds kind NOUN iajs-320 23 19 of of ADP iajs-320 23 20 signature signature NOUN iajs-320 23 21 , , PUNCT iajs-320 23 22 this this DET iajs-320 23 23 approach approach NOUN iajs-320 23 24 is be AUX iajs-320 23 25 a a DET iajs-320 23 26 tedious tedious ADJ iajs-320 23 27 solution solution NOUN iajs-320 23 28 ; ; PUNCT iajs-320 23 29 thus thus ADV iajs-320 23 30 , , PUNCT iajs-320 23 31 an an DET iajs-320 23 32 intelligent intelligent ADJ iajs-320 23 33 malware malware NOUN iajs-320 23 34 detection detection NOUN iajs-320 23 35 system system NOUN iajs-320 23 36 is be AUX iajs-320 23 37 required require VERB iajs-320 23 38 to to PART iajs-320 23 39 deal deal VERB iajs-320 23 40 with with ADP iajs-320 23 41 new new ADJ iajs-320 23 42 malware malware NOUN iajs-320 23 43 threats threat NOUN iajs-320 23 44 . . PUNCT iajs-320 24 1 most most ADJ iajs-320 24 2 of of ADP iajs-320 24 3 intelligent intelligent ADJ iajs-320 24 4 detection detection NOUN iajs-320 24 5 systems system NOUN iajs-320 24 6 utilize utilize VERB iajs-320 24 7 some some DET iajs-320 24 8 data datum NOUN iajs-320 24 9 mining mining NOUN iajs-320 24 10 techniques technique NOUN iajs-320 24 11 in in ADP iajs-320 24 12 order order NOUN iajs-320 24 13 to to PART iajs-320 24 14 distinguish distinguish VERB iajs-320 24 15 malware malware NOUN iajs-320 24 16 from from ADP iajs-320 24 17 sane sane ADJ iajs-320 24 18 programs program NOUN iajs-320 24 19 . . PUNCT iajs-320 25 1 one one NUM iajs-320 25 2 of of ADP iajs-320 25 3 the the DET iajs-320 25 4 pivotal pivotal ADJ iajs-320 25 5 phases phase NOUN iajs-320 25 6 of of ADP iajs-320 25 7 these these DET iajs-320 25 8 systems system NOUN iajs-320 25 9 is be AUX iajs-320 25 10 extracting extract VERB iajs-320 25 11 features feature NOUN iajs-320 25 12 from from ADP iajs-320 25 13 malware malware NOUN iajs-320 25 14 samples sample NOUN iajs-320 25 15 and and CCONJ iajs-320 25 16 benign benign ADJ iajs-320 25 17 ones one NOUN iajs-320 25 18 in in ADP iajs-320 25 19 order order NOUN iajs-320 25 20 to to PART iajs-320 25 21 make make VERB iajs-320 25 22 at at ADP iajs-320 25 23 least least ADJ iajs-320 25 24 a a DET iajs-320 25 25 learning learning NOUN iajs-320 25 26 model model NOUN iajs-320 25 27 . . PUNCT iajs-320 26 1 this this DET iajs-320 26 2 phase phase NOUN iajs-320 26 3 is be AUX iajs-320 26 4 called call VERB iajs-320 26 5 “ " PUNCT iajs-320 26 6 malware malware NOUN iajs-320 26 7 analysis analysis NOUN iajs-320 26 8 ” " PUNCT iajs-320 26 9 which which PRON iajs-320 26 10 plays play VERB iajs-320 26 11 a a DET iajs-320 26 12 significant significant ADJ iajs-320 26 13 role role NOUN iajs-320 26 14 in in ADP iajs-320 26 15 these these DET iajs-320 26 16 systems system NOUN iajs-320 26 17 . . PUNCT iajs-320 27 1 since since SCONJ iajs-320 27 2 api api NOUN iajs-320 27 3 call call NOUN iajs-320 27 4 sequence sequence NOUN iajs-320 27 5 is be AUX iajs-320 27 6 an an DET iajs-320 27 7 effective effective ADJ iajs-320 27 8 feature feature NOUN iajs-320 27 9 for for ADP iajs-320 27 10 realizing realize VERB iajs-320 27 11 unknown unknown ADJ iajs-320 27 12 malware malware NOUN iajs-320 27 13 , , PUNCT iajs-320 27 14 this this DET iajs-320 27 15 paper paper NOUN iajs-320 27 16 is be AUX iajs-320 27 17 focused focus VERB iajs-320 27 18 on on ADP iajs-320 27 19 extracting extract VERB iajs-320 27 20 this this DET iajs-320 27 21 feature feature NOUN iajs-320 27 22 from from ADP iajs-320 27 23 executable executable ADJ iajs-320 27 24 files file NOUN iajs-320 27 25 . . PUNCT iajs-320 28 1 there there PRON iajs-320 28 2 are be VERB iajs-320 28 3 two two NUM iajs-320 28 4 major major ADJ iajs-320 28 5 kinds kind NOUN iajs-320 28 6 of of ADP iajs-320 28 7 approach approach NOUN iajs-320 28 8 to to PART iajs-320 28 9 analyze analyze VERB iajs-320 28 10 executable executable ADJ iajs-320 28 11 file file NOUN iajs-320 28 12 . . PUNCT iajs-320 29 1 the the DET iajs-320 29 2 first first ADJ iajs-320 29 3 type type NOUN iajs-320 29 4 of of ADP iajs-320 29 5 analysis analysis NOUN iajs-320 29 6 is be AUX iajs-320 29 7 “ " PUNCT iajs-320 29 8 static static ADJ iajs-320 29 9 analysis analysis NOUN iajs-320 29 10 ” " PUNCT iajs-320 29 11 which which PRON iajs-320 29 12 analyzes analyze VERB iajs-320 29 13 a a DET iajs-320 29 14 program program NOUN iajs-320 29 15 in in ADP iajs-320 29 16 source source NOUN iajs-320 29 17 code code NOUN iajs-320 29 18 level level NOUN iajs-320 29 19 . . PUNCT iajs-320 30 1 the the DET iajs-320 30 2 second second ADJ iajs-320 30 3 one one NOUN iajs-320 30 4 is be AUX iajs-320 30 5 “ " PUNCT iajs-320 30 6 dynamic dynamic ADJ iajs-320 30 7 analysis analysis NOUN iajs-320 30 8 ” " PUNCT iajs-320 30 9 that that PRON iajs-320 30 10 extracts extract VERB iajs-320 30 11 features feature NOUN iajs-320 30 12 by by ADP iajs-320 30 13 observing observe VERB iajs-320 30 14 program program NOUN iajs-320 30 15 activities activity NOUN iajs-320 30 16 such such ADJ iajs-320 30 17 as as ADP iajs-320 30 18 system system NOUN iajs-320 30 19 requests request NOUN iajs-320 30 20 during during ADP iajs-320 30 21 its its PRON iajs-320 30 22 execution execution NOUN iajs-320 30 23 time time NOUN iajs-320 30 24 . . PUNCT iajs-320 31 1 static static ADJ iajs-320 31 2 analysis analysis NOUN iajs-320 31 3 has have VERB iajs-320 31 4 to to PART iajs-320 31 5 traverse traverse VERB iajs-320 31 6 the the DET iajs-320 31 7 program program NOUN iajs-320 31 8 execution execution NOUN iajs-320 31 9 path path NOUN iajs-320 31 10 in in ADP iajs-320 31 11 order order NOUN iajs-320 31 12 to to PART iajs-320 31 13 find find VERB iajs-320 31 14 called call VERB iajs-320 31 15 apis apis PROPN iajs-320 31 16 . . PUNCT iajs-320 32 1 because because SCONJ iajs-320 32 2 it it PRON iajs-320 32 3 does do AUX iajs-320 32 4 not not PART iajs-320 32 5 have have VERB iajs-320 32 6 sufficient sufficient ADJ iajs-320 32 7 information information NOUN iajs-320 32 8 about about ADP iajs-320 32 9 decision decision NOUN iajs-320 32 10 making make VERB iajs-320 32 11 points point NOUN iajs-320 32 12 in in ADP iajs-320 32 13 the the DET iajs-320 32 14 given give VERB iajs-320 32 15 executable executable ADJ iajs-320 32 16 file file NOUN iajs-320 32 17 , , PUNCT iajs-320 32 18 it it PRON iajs-320 32 19 is be AUX iajs-320 32 20 not not PART iajs-320 32 21 able able ADJ iajs-320 32 22 to to PART iajs-320 32 23 extract extract VERB iajs-320 32 24 the the DET iajs-320 32 25 real real ADJ iajs-320 32 26 sequence sequence NOUN iajs-320 32 27 of of ADP iajs-320 32 28 called call VERB iajs-320 32 29 apis apis PROPN iajs-320 32 30 . . PUNCT iajs-320 33 1 although although SCONJ iajs-320 33 2 dynamic dynamic ADJ iajs-320 33 3 analysis analysis NOUN iajs-320 33 4 does do AUX iajs-320 33 5 not not PART iajs-320 33 6 have have VERB iajs-320 33 7 this this DET iajs-320 33 8 drawback drawback NOUN iajs-320 33 9 , , PUNCT iajs-320 33 10 it it PRON iajs-320 33 11 suffers suffer VERB iajs-320 33 12 from from ADP iajs-320 33 13 execution execution NOUN iajs-320 33 14 overhead overhead ADV iajs-320 34 1 [ [ X iajs-320 34 2 3 3 NUM iajs-320 34 3 ] ] PUNCT iajs-320 34 4 . . PUNCT iajs-320 35 1 code code NOUN iajs-320 35 2 analysis analysis NOUN iajs-320 35 3 techniques technique NOUN iajs-320 35 4 can can AUX iajs-320 35 5 be be AUX iajs-320 35 6 categorized categorize VERB iajs-320 35 7 into into ADP iajs-320 35 8 two two NUM iajs-320 35 9 main main ADJ iajs-320 35 10 classes class NOUN iajs-320 35 11 : : PUNCT iajs-320 35 12 dynamic dynamic ADJ iajs-320 35 13 techniques technique NOUN iajs-320 35 14 and and CCONJ iajs-320 35 15 static static ADJ iajs-320 35 16 techniques technique NOUN iajs-320 35 17 . . PUNCT iajs-320 36 1 approaches approach NOUN iajs-320 36 2 that that PRON iajs-320 36 3 belong belong VERB iajs-320 36 4 to to ADP iajs-320 36 5 the the DET iajs-320 36 6 first first ADJ iajs-320 36 7 category category NOUN iajs-320 36 8 rely rely VERB iajs-320 36 9 on on ADP iajs-320 36 10 monitoring monitor VERB iajs-320 36 11 execution execution NOUN iajs-320 36 12 traces trace NOUN iajs-320 36 13 of of ADP iajs-320 36 14 an an DET iajs-320 36 15 application application NOUN iajs-320 36 16 to to PART iajs-320 36 17 identify identify VERB iajs-320 36 18 the the DET iajs-320 36 19 executed execute VERB iajs-320 36 20 instructions instruction NOUN iajs-320 36 21 and and CCONJ iajs-320 36 22 their their PRON iajs-320 36 23 actions action NOUN iajs-320 36 24 , , PUNCT iajs-320 36 25 or or CCONJ iajs-320 36 26 behavior behavior NOUN iajs-320 36 27 . . PUNCT iajs-320 37 1 approaches approach VERB iajs-320 37 2 that that PRON iajs-320 37 3 belong belong VERB iajs-320 37 4 to to ADP iajs-320 37 5 the the DET iajs-320 37 6 second second ADJ iajs-320 37 7 category category NOUN iajs-320 37 8 analyze analyze VERB iajs-320 37 9 the the DET iajs-320 37 10 binary binary ADJ iajs-320 37 11 structure structure NOUN iajs-320 37 12 statically statically ADV iajs-320 37 13 , , PUNCT iajs-320 37 14 parsing parse VERB iajs-320 37 15 the the DET iajs-320 37 16 instructions instruction NOUN iajs-320 37 17 as as SCONJ iajs-320 37 18 they they PRON iajs-320 37 19 are be AUX iajs-320 37 20 found find VERB iajs-320 37 21 in in ADP iajs-320 37 22 the the DET iajs-320 37 23 binary binary ADJ iajs-320 37 24 image image NOUN iajs-320 37 25 and and CCONJ iajs-320 37 26 attempting attempt VERB iajs-320 37 27 to to PART iajs-320 37 28 determine determine VERB iajs-320 37 29 a a DET iajs-320 37 30 ( ( PUNCT iajs-320 37 31 possibly possibly ADV iajs-320 37 32 over over ADV iajs-320 37 33 - - PUNCT iajs-320 37 34 approximated approximate VERB iajs-320 37 35 ) ) PUNCT iajs-320 37 36 set set NOUN iajs-320 37 37 of of ADP iajs-320 37 38 all all DET iajs-320 37 39 possible possible ADJ iajs-320 37 40 behaviors behavior NOUN iajs-320 37 41 . . PUNCT iajs-320 38 1 both both CCONJ iajs-320 38 2 static static ADJ iajs-320 38 3 and and CCONJ iajs-320 38 4 dynamic dynamic ADJ iajs-320 38 5 approaches approach NOUN iajs-320 38 6 have have VERB iajs-320 38 7 advantages advantage NOUN iajs-320 38 8 and and CCONJ iajs-320 38 9 disadvantages disadvantage NOUN iajs-320 38 10 . . PUNCT iajs-320 39 1 static static ADJ iajs-320 39 2 analysis analysis NOUN iajs-320 39 3 takes take VERB iajs-320 39 4 into into ADP iajs-320 39 5 account account NOUN iajs-320 39 6 the the DET iajs-320 39 7 complete complete ADJ iajs-320 39 8 program program NOUN iajs-320 39 9 , , PUNCT iajs-320 39 10 while while SCONJ iajs-320 39 11 dynamic dynamic ADJ iajs-320 39 12 analysis analysis NOUN iajs-320 39 13 can can AUX iajs-320 39 14 only only ADV iajs-320 39 15 operate operate VERB iajs-320 39 16 on on ADP iajs-320 39 17 the the DET iajs-320 39 18 instructions instruction NOUN iajs-320 39 19 that that PRON iajs-320 39 20 were be AUX iajs-320 39 21 executed execute VERB iajs-320 39 22 in in ADP iajs-320 39 23 a a DET iajs-320 39 24 particular particular ADJ iajs-320 39 25 set set NOUN iajs-320 39 26 of of ADP iajs-320 39 27 runs run NOUN iajs-320 39 28 . . PUNCT iajs-320 40 1 therefore therefore ADV iajs-320 40 2 , , PUNCT iajs-320 40 3 it it PRON iajs-320 40 4 is be AUX iajs-320 40 5 impossible impossible ADJ iajs-320 40 6 to to PART iajs-320 40 7 guarantee guarantee VERB iajs-320 40 8 that that SCONJ iajs-320 40 9 the the DET iajs-320 40 10 whole whole ADJ iajs-320 40 11 executable executable NOUN iajs-320 40 12 with with ADP iajs-320 40 13 all all DET iajs-320 40 14 possible possible ADJ iajs-320 40 15 actions action NOUN iajs-320 40 16 were be AUX iajs-320 40 17 covered cover VERB iajs-320 40 18 when when SCONJ iajs-320 40 19 using use VERB iajs-320 40 20 dynamic dynamic ADJ iajs-320 40 21 analysis analysis NOUN iajs-320 40 22 . . PUNCT iajs-320 41 1 on on ADP iajs-320 41 2 the the DET iajs-320 41 3 other other ADJ iajs-320 41 4 hand hand NOUN iajs-320 41 5 , , PUNCT iajs-320 41 6 dynamic dynamic ADJ iajs-320 41 7 analysis analysis NOUN iajs-320 41 8 assures assure VERB iajs-320 41 9 that that SCONJ iajs-320 41 10 only only ADV iajs-320 41 11 actual actual ADJ iajs-320 41 12 program program NOUN iajs-320 41 13 behavior behavior NOUN iajs-320 41 14 is be AUX iajs-320 41 15 considered consider VERB iajs-320 41 16 . . PUNCT iajs-320 42 1 this this PRON iajs-320 42 2 eliminates eliminate VERB iajs-320 42 3 possible possible ADJ iajs-320 42 4 incorrect incorrect ADJ iajs-320 42 5 results result NOUN iajs-320 42 6 due due ADP iajs-320 42 7 to to ADP iajs-320 42 8 overly overly ADV iajs-320 42 9 conservative conservative ADJ iajs-320 42 10 approximations approximation NOUN iajs-320 42 11 that that PRON iajs-320 42 12 are be AUX iajs-320 42 13 often often ADV iajs-320 42 14 necessary necessary ADJ iajs-320 42 15 when when SCONJ iajs-320 42 16 performing perform VERB iajs-320 42 17 static static ADJ iajs-320 42 18 analysis analysis NOUN iajs-320 42 19 [ [ X iajs-320 42 20 4 4 NUM iajs-320 42 21 ] ] PUNCT iajs-320 42 22 . . PUNCT iajs-320 43 1 recently recently ADV iajs-320 43 2 researchers researcher NOUN iajs-320 43 3 employ employ VERB iajs-320 43 4 behavior behavior NOUN iajs-320 43 5 based base VERB iajs-320 43 6 detection detection NOUN iajs-320 43 7 models model NOUN iajs-320 43 8 that that PRON iajs-320 43 9 depend depend VERB iajs-320 43 10 on on ADP iajs-320 43 11 api api NOUN iajs-320 43 12 tracking tracking NOUN iajs-320 43 13 and and CCONJ iajs-320 43 14 analyzing analyze VERB iajs-320 43 15 to to PART iajs-320 43 16 identify identify VERB iajs-320 43 17 suspected suspect VERB iajs-320 43 18 pe pe PROPN iajs-320 43 19 applications application NOUN iajs-320 43 20 . . PUNCT iajs-320 44 1 those those DET iajs-320 44 2 behavior behavior NOUN iajs-320 44 3 models model NOUN iajs-320 44 4 become become VERB iajs-320 44 5 more more ADV iajs-320 44 6 efficient efficient ADJ iajs-320 44 7 than than ADP iajs-320 44 8 the the DET iajs-320 44 9 signature signature NOUN iajs-320 44 10 based base VERB iajs-320 44 11 detection detection NOUN iajs-320 44 12 systems system NOUN iajs-320 44 13 for for ADP iajs-320 44 14 detecting detect VERB iajs-320 44 15 zero zero NUM iajs-320 44 16 - - PUNCT iajs-320 44 17 day day NOUN iajs-320 44 18 malwares malware NOUN iajs-320 44 19 . . PUNCT iajs-320 45 1 this this PRON iajs-320 45 2 is be AUX iajs-320 45 3 because because SCONJ iajs-320 45 4 a a DET iajs-320 45 5 simple simple ADJ iajs-320 45 6 polymorphic polymorphic ADJ iajs-320 45 7 or or CCONJ iajs-320 45 8 metamorphic metamorphic ADJ iajs-320 45 9 malware malware NOUN iajs-320 45 10 can can AUX iajs-320 45 11 defeat defeat VERB iajs-320 45 12 signature signature NOUN iajs-320 45 13 based base VERB iajs-320 45 14 detection detection NOUN iajs-320 45 15 systems system NOUN iajs-320 45 16 easily easily ADV iajs-320 45 17 . . PUNCT iajs-320 46 1 moreover moreover ADV iajs-320 46 2 , , PUNCT iajs-320 46 3 it it PRON iajs-320 46 4 is be AUX iajs-320 46 5 difficult difficult ADJ iajs-320 46 6 to to PART iajs-320 46 7 keep keep VERB iajs-320 46 8 the the DET iajs-320 46 9 signature signature NOUN iajs-320 46 10 of of ADP iajs-320 46 11 all all DET iajs-320 46 12 malwares malware NOUN iajs-320 46 13 and and CCONJ iajs-320 46 14 their their PRON iajs-320 46 15 variants variant NOUN iajs-320 46 16 because because SCONJ iajs-320 46 17 the the DET iajs-320 46 18 malware malware NOUN iajs-320 46 19 number number NOUN iajs-320 46 20 becomes become VERB iajs-320 46 21 more more ADJ iajs-320 46 22 than than ADP iajs-320 46 23 five five NUM iajs-320 46 24 millions million NOUN iajs-320 46 25 , , PUNCT iajs-320 46 26 and and CCONJ iajs-320 46 27 every every DET iajs-320 46 28 day day NOUN iajs-320 46 29 ( ( PUNCT iajs-320 46 30 5000 5000 NUM iajs-320 46 31 ) ) PUNCT iajs-320 46 32 new new ADJ iajs-320 46 33 malwares malware NOUN iajs-320 46 34 or or CCONJ iajs-320 46 35 variants variant NOUN iajs-320 46 36 are be AUX iajs-320 46 37 expected expect VERB iajs-320 46 38 over over ADP iajs-320 46 39 the the DET iajs-320 46 40 internet internet NOUN iajs-320 46 41 and and CCONJ iajs-320 46 42 networks network NOUN iajs-320 46 43 [ [ X iajs-320 46 44 5 5 NUM iajs-320 46 45 ] ] PUNCT iajs-320 46 46 . . PUNCT iajs-320 47 1 558 558 NUM iajs-320 47 2 | | ADV iajs-320 47 3 computer computer NOUN iajs-320 47 4 science science NOUN iajs-320 47 5 2014 2014 NUM iajs-320 47 6 ) ) PUNCT iajs-320 47 7 عام عام ADP iajs-320 47 8 3(العدد 3(العدد NUM iajs-320 47 9 27المجلد 27المجلد NUM iajs-320 47 10 مجلة مجلة VERB iajs-320 47 11 إبن إبن NOUN iajs-320 47 12 الھيثم الھيثم NOUN iajs-320 47 13 للعلوم للعلوم NOUN iajs-320 47 14 الصرفة الصرفة NOUN iajs-320 48 1 و و PRON iajs-320 48 2 التطبيقية التطبيقية ADJ iajs-320 48 3 ibn ibn PROPN iajs-320 48 4 al al PROPN iajs-320 48 5 - - PUNCT iajs-320 48 6 haitham haitham PROPN iajs-320 48 7 jour jour X iajs-320 48 8 . . PROPN iajs-320 48 9 for for ADP iajs-320 48 10 pure pure ADJ iajs-320 48 11 & & CCONJ iajs-320 48 12 appl appl PROPN iajs-320 48 13 . . PUNCT iajs-320 49 1 sci sci PROPN iajs-320 49 2 . . PUNCT iajs-320 49 3 vol vol NOUN iajs-320 49 4 . . PROPN iajs-320 50 1 27 27 NUM iajs-320 50 2 ( ( PUNCT iajs-320 50 3 3 3 NUM iajs-320 50 4 ) ) PUNCT iajs-320 50 5 2014 2014 NUM iajs-320 50 6 related relate VERB iajs-320 50 7 works work NOUN iajs-320 50 8 in in ADP iajs-320 50 9 recent recent ADJ iajs-320 50 10 years year NOUN iajs-320 50 11 many many ADJ iajs-320 50 12 malware malware NOUN iajs-320 50 13 researchers researcher NOUN iajs-320 50 14 have have AUX iajs-320 50 15 focused focus VERB iajs-320 50 16 on on ADP iajs-320 50 17 neural neural ADJ iajs-320 50 18 network network NOUN iajs-320 50 19 and and CCONJ iajs-320 50 20 / / SYM iajs-320 50 21 or or CCONJ iajs-320 50 22 data datum NOUN iajs-320 50 23 mining mining NOUN iajs-320 50 24 to to PART iajs-320 50 25 detect detect VERB iajs-320 50 26 unknown unknown ADJ iajs-320 50 27 malwares malware NOUN iajs-320 50 28 . . PUNCT iajs-320 51 1 data datum NOUN iajs-320 51 2 mining mining NOUN iajs-320 51 3 is be AUX iajs-320 51 4 the the DET iajs-320 51 5 process process NOUN iajs-320 51 6 of of ADP iajs-320 51 7 analyzing analyze VERB iajs-320 51 8 electronically electronically ADV iajs-320 51 9 stored store VERB iajs-320 51 10 data datum NOUN iajs-320 51 11 by by ADP iajs-320 51 12 automatically automatically ADV iajs-320 51 13 searching search VERB iajs-320 51 14 for for ADP iajs-320 51 15 patterns pattern NOUN iajs-320 51 16 . . PUNCT iajs-320 52 1 machine machine NOUN iajs-320 52 2 learning learn VERB iajs-320 52 3 algorithms algorithm NOUN iajs-320 52 4 have have AUX iajs-320 52 5 been be AUX iajs-320 52 6 used use VERB iajs-320 52 7 widely widely ADV iajs-320 52 8 for for ADP iajs-320 52 9 different different ADJ iajs-320 52 10 data datum NOUN iajs-320 52 11 mining mining NOUN iajs-320 52 12 problems problem NOUN iajs-320 52 13 to to PART iajs-320 52 14 detect detect VERB iajs-320 52 15 patterns pattern NOUN iajs-320 52 16 and and CCONJ iajs-320 52 17 to to PART iajs-320 52 18 find find VERB iajs-320 52 19 correlations correlation NOUN iajs-320 52 20 between between ADP iajs-320 52 21 data datum NOUN iajs-320 52 22 instances instance NOUN iajs-320 52 23 and and CCONJ iajs-320 52 24 attributes attribute NOUN iajs-320 52 25 . . PUNCT iajs-320 53 1 many many ADJ iajs-320 53 2 researchers researcher NOUN iajs-320 53 3 have have AUX iajs-320 53 4 used use VERB iajs-320 53 5 n n NUM iajs-320 53 6 - - PUNCT iajs-320 53 7 grams gram NOUN iajs-320 53 8 or or CCONJ iajs-320 53 9 api api NOUN iajs-320 53 10 calls call NOUN iajs-320 53 11 as as ADP iajs-320 53 12 their their PRON iajs-320 53 13 primary primary ADJ iajs-320 53 14 type type NOUN iajs-320 53 15 of of ADP iajs-320 53 16 feature feature NOUN iajs-320 53 17 that that PRON iajs-320 53 18 are be AUX iajs-320 53 19 used use VERB iajs-320 53 20 to to PART iajs-320 53 21 represent represent VERB iajs-320 53 22 malware malware NOUN iajs-320 53 23 instances instance NOUN iajs-320 53 24 in in ADP iajs-320 53 25 a a DET iajs-320 53 26 suitable suitable ADJ iajs-320 53 27 format format NOUN iajs-320 53 28 for for ADP iajs-320 53 29 data data NOUN iajs-320 53 30 mining mining NOUN iajs-320 53 31 purposes purpose NOUN iajs-320 53 32 . . PUNCT iajs-320 54 1 saman saman PROPN iajs-320 54 2 mirza mirza PROPN iajs-320 54 3 abdulla1[5 abdulla1[5 PROPN iajs-320 54 4 ] ] PUNCT iajs-320 54 5 proposed propose VERB iajs-320 54 6 a a DET iajs-320 54 7 method method NOUN iajs-320 54 8 using use VERB iajs-320 54 9 multi multi ADJ iajs-320 54 10 - - ADJ iajs-320 54 11 layer layer ADJ iajs-320 54 12 neural neural ADJ iajs-320 54 13 network network NOUN iajs-320 54 14 to to PART iajs-320 54 15 classify classify VERB iajs-320 54 16 the the DET iajs-320 54 17 features feature NOUN iajs-320 54 18 of of ADP iajs-320 54 19 api api NOUN iajs-320 54 20 calls call VERB iajs-320 54 21 sequence sequence NOUN iajs-320 54 22 by by ADP iajs-320 54 23 using use VERB iajs-320 54 24 6 6 NUM iajs-320 54 25 - - PUNCT iajs-320 54 26 grams gram NOUN iajs-320 54 27 at at ADP iajs-320 54 28 least least ADJ iajs-320 54 29 to to PART iajs-320 54 30 distinguish distinguish VERB iajs-320 54 31 between between ADP iajs-320 54 32 malicious malicious ADJ iajs-320 54 33 and and CCONJ iajs-320 54 34 benign benign ADJ iajs-320 54 35 , , PUNCT iajs-320 54 36 by by ADP iajs-320 54 37 examining examine VERB iajs-320 54 38 the the DET iajs-320 54 39 output output NOUN iajs-320 54 40 of of ADP iajs-320 54 41 neural neural ADJ iajs-320 54 42 network network NOUN iajs-320 54 43 as as ADP iajs-320 54 44 : : PUNCT iajs-320 54 45 out out ADP iajs-320 54 46 < < X iajs-320 54 47 = = NOUN iajs-320 54 48 0.3 0.3 NUM iajs-320 54 49 then then ADV iajs-320 54 50 benign benign ADJ iajs-320 54 51 , , PUNCT iajs-320 54 52 or or CCONJ iajs-320 54 53 out out ADP iajs-320 54 54 > > PUNCT iajs-320 54 55 = = SYM iajs-320 54 56 0.7 0.7 NUM iajs-320 54 57 the the DET iajs-320 54 58 malicious malicious ADJ iajs-320 54 59 , , PUNCT iajs-320 54 60 and and CCONJ iajs-320 54 61 the the DET iajs-320 54 62 other other ADJ iajs-320 54 63 values value NOUN iajs-320 54 64 will will AUX iajs-320 54 65 use use VERB iajs-320 54 66 new new ADJ iajs-320 54 67 method method NOUN iajs-320 54 68 named name VERB iajs-320 54 69 costimulation costimulation NOUN iajs-320 54 70 . . PUNCT iajs-320 55 1 shultz shultz PROPN iajs-320 55 2 et et PROPN iajs-320 55 3 al al PROPN iajs-320 55 4 . . PUNCT iajs-320 56 1 [ [ X iajs-320 56 2 6 6 NUM iajs-320 56 3 ] ] PUNCT iajs-320 56 4 proposed propose VERB iajs-320 56 5 a a DET iajs-320 56 6 method method NOUN iajs-320 56 7 using use VERB iajs-320 56 8 data datum NOUN iajs-320 56 9 mining mining NOUN iajs-320 56 10 techniques technique NOUN iajs-320 56 11 for for ADP iajs-320 56 12 detecting detect VERB iajs-320 56 13 new new ADJ iajs-320 56 14 malicious malicious ADJ iajs-320 56 15 executables executable NOUN iajs-320 56 16 . . PUNCT iajs-320 57 1 three three NUM iajs-320 57 2 different different ADJ iajs-320 57 3 types type NOUN iajs-320 57 4 of of ADP iajs-320 57 5 features feature NOUN iajs-320 57 6 are be AUX iajs-320 57 7 extracted extract VERB iajs-320 57 8 from from ADP iajs-320 57 9 the the DET iajs-320 57 10 executables executable NOUN iajs-320 57 11 , , PUNCT iajs-320 57 12 i.e. i.e. X iajs-320 57 13 the the DET iajs-320 57 14 list list NOUN iajs-320 57 15 of of ADP iajs-320 57 16 dlls dll NOUN iajs-320 57 17 used use VERB iajs-320 57 18 by by ADP iajs-320 57 19 the the DET iajs-320 57 20 binary binary NOUN iajs-320 57 21 , , PUNCT iajs-320 57 22 the the DET iajs-320 57 23 list list NOUN iajs-320 57 24 of of ADP iajs-320 57 25 dll dll NOUN iajs-320 57 26 function function NOUN iajs-320 57 27 calls call NOUN iajs-320 57 28 , , PUNCT iajs-320 57 29 and and CCONJ iajs-320 57 30 number number NOUN iajs-320 57 31 of of ADP iajs-320 57 32 different different ADJ iajs-320 57 33 system system NOUN iajs-320 57 34 calls call NOUN iajs-320 57 35 used use VERB iajs-320 57 36 within within ADP iajs-320 57 37 each each DET iajs-320 57 38 dll dll NOUN iajs-320 57 39 . . PUNCT iajs-320 58 1 also also ADV iajs-320 58 2 they they PRON iajs-320 58 3 analyze analyze VERB iajs-320 58 4 byte byte NOUN iajs-320 58 5 sequences sequence NOUN iajs-320 58 6 extracted extract VERB iajs-320 58 7 from from ADP iajs-320 58 8 the the DET iajs-320 58 9 hex hex PROPN iajs-320 58 10 dump dump NOUN iajs-320 58 11 of of ADP iajs-320 58 12 an an DET iajs-320 58 13 executable executable NOUN iajs-320 58 14 . . PUNCT iajs-320 59 1 the the DET iajs-320 59 2 data datum NOUN iajs-320 59 3 set set VERB iajs-320 59 4 consisted consist VERB iajs-320 59 5 of of ADP iajs-320 59 6 4,266 4,266 NUM iajs-320 59 7 files file NOUN iajs-320 59 8 out out ADP iajs-320 59 9 of of ADP iajs-320 59 10 which which PRON iajs-320 59 11 3,265 3,265 NUM iajs-320 59 12 were be AUX iajs-320 59 13 malicious malicious ADJ iajs-320 59 14 and and CCONJ iajs-320 59 15 1,001 1,001 NUM iajs-320 59 16 were be AUX iajs-320 59 17 legitimate legitimate ADJ iajs-320 59 18 or or CCONJ iajs-320 59 19 benign benign ADJ iajs-320 59 20 programs program NOUN iajs-320 59 21 . . PUNCT iajs-320 60 1 a a DET iajs-320 60 2 rule rule NOUN iajs-320 60 3 induction induction NOUN iajs-320 60 4 algorithm algorithm NOUN iajs-320 60 5 called call VERB iajs-320 60 6 ripper ripper NOUN iajs-320 60 7 [ [ X iajs-320 60 8 7 7 NUM iajs-320 60 9 ] ] PUNCT iajs-320 60 10 was be AUX iajs-320 60 11 applied apply VERB iajs-320 60 12 to to PART iajs-320 60 13 find find VERB iajs-320 60 14 patterns pattern NOUN iajs-320 60 15 in in ADP iajs-320 60 16 the the DET iajs-320 60 17 dll dll NOUN iajs-320 60 18 data datum NOUN iajs-320 60 19 . . PUNCT iajs-320 61 1 a a DET iajs-320 61 2 learning learn VERB iajs-320 61 3 algorithm algorithm NOUN iajs-320 61 4 naïve naïve ADJ iajs-320 61 5 bayes bayes PROPN iajs-320 61 6 ( ( PUNCT iajs-320 61 7 nb nb PROPN iajs-320 61 8 ) ) PUNCT iajs-320 61 9 , , PUNCT iajs-320 61 10 which which PRON iajs-320 61 11 is be AUX iajs-320 61 12 based base VERB iajs-320 61 13 on on ADP iajs-320 61 14 bayesian bayesian NOUN iajs-320 61 15 statistics statistic NOUN iajs-320 61 16 , , PUNCT iajs-320 61 17 was be AUX iajs-320 61 18 used use VERB iajs-320 61 19 to to PART iajs-320 61 20 find find VERB iajs-320 61 21 patterns pattern NOUN iajs-320 61 22 in in ADP iajs-320 61 23 the the DET iajs-320 61 24 string string NOUN iajs-320 61 25 data datum NOUN iajs-320 61 26 and and CCONJ iajs-320 61 27 n n CCONJ iajs-320 61 28 - - PUNCT iajs-320 61 29 grams gram NOUN iajs-320 61 30 of of ADP iajs-320 61 31 byte byte NOUN iajs-320 61 32 sequences sequence NOUN iajs-320 61 33 were be AUX iajs-320 61 34 used use VERB iajs-320 61 35 as as ADP iajs-320 61 36 input input NOUN iajs-320 61 37 data datum NOUN iajs-320 61 38 for for ADP iajs-320 61 39 the the DET iajs-320 61 40 multinomial multinomial ADJ iajs-320 61 41 naïve naïve ADJ iajs-320 61 42 bayes bayes PROPN iajs-320 61 43 algorithm algorithm PROPN iajs-320 61 44 . . PUNCT iajs-320 62 1 a a DET iajs-320 62 2 data datum NOUN iajs-320 62 3 set set VERB iajs-320 62 4 is be AUX iajs-320 62 5 partitioned partition VERB iajs-320 62 6 in in ADP iajs-320 62 7 two two NUM iajs-320 62 8 data datum NOUN iajs-320 62 9 sets set NOUN iajs-320 62 10 , , PUNCT iajs-320 62 11 i.e. i.e. X iajs-320 62 12 , , PUNCT iajs-320 62 13 a a DET iajs-320 62 14 test test NOUN iajs-320 62 15 data datum NOUN iajs-320 62 16 set set VERB iajs-320 62 17 and and CCONJ iajs-320 62 18 a a DET iajs-320 62 19 training training NOUN iajs-320 62 20 data datum NOUN iajs-320 62 21 set set VERB iajs-320 62 22 . . PUNCT iajs-320 63 1 this this PRON iajs-320 63 2 is be AUX iajs-320 63 3 to to PART iajs-320 63 4 allow allow VERB iajs-320 63 5 for for ADP iajs-320 63 6 performance performance NOUN iajs-320 63 7 testing testing NOUN iajs-320 63 8 on on ADP iajs-320 63 9 data datum NOUN iajs-320 63 10 that that PRON iajs-320 63 11 are be AUX iajs-320 63 12 independent independent ADJ iajs-320 63 13 from from ADP iajs-320 63 14 the the DET iajs-320 63 15 data datum NOUN iajs-320 63 16 used use VERB iajs-320 63 17 to to PART iajs-320 63 18 generate generate VERB iajs-320 63 19 the the DET iajs-320 63 20 classifiers classifier NOUN iajs-320 63 21 . . PUNCT iajs-320 64 1 the the DET iajs-320 64 2 naïve naïve ADJ iajs-320 64 3 bayes bayes PROPN iajs-320 64 4 algorithm algorithm PROPN iajs-320 64 5 , , PUNCT iajs-320 64 6 using use VERB iajs-320 64 7 strings string NOUN iajs-320 64 8 as as ADP iajs-320 64 9 input input NOUN iajs-320 64 10 data datum NOUN iajs-320 64 11 , , PUNCT iajs-320 64 12 yielded yield VERB iajs-320 64 13 the the DET iajs-320 64 14 highest high ADJ iajs-320 64 15 classification classification NOUN iajs-320 64 16 performance performance NOUN iajs-320 64 17 with with ADP iajs-320 64 18 an an DET iajs-320 64 19 accuracy accuracy NOUN iajs-320 64 20 of of ADP iajs-320 64 21 97.11 97.11 NUM iajs-320 64 22 % % NOUN iajs-320 64 23 . . PUNCT iajs-320 65 1 the the DET iajs-320 65 2 authors author NOUN iajs-320 65 3 compared compare VERB iajs-320 65 4 their their PRON iajs-320 65 5 results result NOUN iajs-320 65 6 with with ADP iajs-320 65 7 traditional traditional ADJ iajs-320 65 8 signaturebased signaturebase VERB iajs-320 65 9 methods method NOUN iajs-320 65 10 and and CCONJ iajs-320 65 11 claimed claim VERB iajs-320 65 12 that that SCONJ iajs-320 65 13 the the DET iajs-320 65 14 data datum NOUN iajs-320 65 15 mining mining NOUN iajs-320 65 16 - - PUNCT iajs-320 65 17 based base VERB iajs-320 65 18 detection detection NOUN iajs-320 65 19 rate rate NOUN iajs-320 65 20 of of ADP iajs-320 65 21 new new ADJ iajs-320 65 22 malware malware NOUN iajs-320 65 23 was be AUX iajs-320 65 24 twice twice ADV iajs-320 65 25 as as ADV iajs-320 65 26 high high ADJ iajs-320 65 27 in in ADP iajs-320 65 28 comparison comparison NOUN iajs-320 65 29 to to ADP iajs-320 65 30 the the DET iajs-320 65 31 signature signature NOUN iajs-320 65 32 - - PUNCT iajs-320 65 33 based base VERB iajs-320 65 34 algorithm algorithm NOUN iajs-320 65 35 . . PUNCT iajs-320 66 1 dataset dataset ADJ iajs-320 66 2 description description NOUN iajs-320 66 3 our our PRON iajs-320 66 4 dataset dataset NOUN iajs-320 66 5 consists consist VERB iajs-320 66 6 of of ADP iajs-320 66 7 a a DET iajs-320 66 8 total total NOUN iajs-320 66 9 of of ADP iajs-320 66 10 4744 4744 NUM iajs-320 66 11 windows window NOUN iajs-320 66 12 programs program NOUN iajs-320 66 13 in in ADP iajs-320 66 14 pe pe NOUN iajs-320 66 15 file file NOUN iajs-320 66 16 format format NOUN iajs-320 66 17 that that PRON iajs-320 66 18 are be AUX iajs-320 66 19 1736 1736 NUM iajs-320 66 20 malicious malicious ADJ iajs-320 66 21 and and CCONJ iajs-320 66 22 3008 3008 NUM iajs-320 66 23 clean clean ADJ iajs-320 66 24 programs program NOUN iajs-320 66 25 . . PUNCT iajs-320 67 1 there there PRON iajs-320 67 2 were be VERB iajs-320 67 3 no no DET iajs-320 67 4 duplicate duplicate ADJ iajs-320 67 5 api api NOUN iajs-320 67 6 vectors vector NOUN iajs-320 67 7 in in ADP iajs-320 67 8 our our PRON iajs-320 67 9 dataset dataset NOUN iajs-320 67 10 . . PUNCT iajs-320 68 1 the the DET iajs-320 68 2 malicious malicious ADJ iajs-320 68 3 and and CCONJ iajs-320 68 4 benign benign ADJ iajs-320 68 5 excel excel NOUN iajs-320 68 6 sheet sheet NOUN iajs-320 68 7 were be AUX iajs-320 68 8 obtained obtain VERB iajs-320 68 9 from from ADP iajs-320 68 10 [ [ X iajs-320 68 11 8 8 NUM iajs-320 68 12 ] ] PUNCT iajs-320 68 13 , , PUNCT iajs-320 68 14 windows window NOUN iajs-320 68 15 ’ ' PUNCT iajs-320 68 16 system system NOUN iajs-320 68 17 files file NOUN iajs-320 68 18 and and CCONJ iajs-320 68 19 our our PRON iajs-320 68 20 local local ADJ iajs-320 68 21 laboratory laboratory NOUN iajs-320 68 22 ’s ’s PART iajs-320 68 23 program program NOUN iajs-320 68 24 files file NOUN iajs-320 68 25 [ [ PUNCT iajs-320 68 26 8].we 8].we NUM iajs-320 68 27 only only ADV iajs-320 68 28 consider consider VERB iajs-320 68 29 non non ADJ iajs-320 68 30 - - ADJ iajs-320 68 31 packed packed ADJ iajs-320 68 32 windows window NOUN iajs-320 68 33 binary binary ADJ iajs-320 68 34 files file NOUN iajs-320 68 35 in in ADP iajs-320 68 36 pe pe PROPN iajs-320 68 37 format format NOUN iajs-320 68 38 . . PUNCT iajs-320 69 1 some some DET iajs-320 69 2 malware malware NOUN iajs-320 69 3 writers writer NOUN iajs-320 69 4 compress compress VERB iajs-320 69 5 their their PRON iajs-320 69 6 code code NOUN iajs-320 69 7 to to PART iajs-320 69 8 make make VERB iajs-320 69 9 them they PRON iajs-320 69 10 undetectable undetectable ADJ iajs-320 69 11 by by ADP iajs-320 69 12 antivirus antivirus NOUN iajs-320 69 13 programs program NOUN iajs-320 69 14 . . PUNCT iajs-320 70 1 this this DET iajs-320 70 2 work work NOUN iajs-320 70 3 argued argue VERB iajs-320 70 4 the the DET iajs-320 70 5 problems problem NOUN iajs-320 70 6 and and CCONJ iajs-320 70 7 challenges challenge NOUN iajs-320 70 8 that that PRON iajs-320 70 9 may may AUX iajs-320 70 10 affect affect VERB iajs-320 70 11 the the DET iajs-320 70 12 accuracy accuracy NOUN iajs-320 70 13 of of ADP iajs-320 70 14 api api NOUN iajs-320 70 15 calls call NOUN iajs-320 70 16 behavior behavior NOUN iajs-320 70 17 detection detection NOUN iajs-320 70 18 models model NOUN iajs-320 70 19 . . PUNCT iajs-320 71 1 the the DET iajs-320 71 2 work work NOUN iajs-320 71 3 analyzed analyze VERB iajs-320 71 4 the the DET iajs-320 71 5 api api NOUN iajs-320 71 6 calls call NOUN iajs-320 71 7 using use VERB iajs-320 71 8 supervised supervised ADJ iajs-320 71 9 neural neural ADJ iajs-320 71 10 network network NOUN iajs-320 71 11 ( ( PUNCT iajs-320 71 12 nn nn NOUN iajs-320 71 13 ) ) PUNCT iajs-320 71 14 . . PUNCT iajs-320 72 1 the the DET iajs-320 72 2 work work NOUN iajs-320 72 3 will will AUX iajs-320 72 4 compare compare VERB iajs-320 72 5 the the DET iajs-320 72 6 results result NOUN iajs-320 72 7 for for ADP iajs-320 72 8 all all DET iajs-320 72 9 these these DET iajs-320 72 10 classifier classifier NOUN iajs-320 72 11 techniques technique NOUN iajs-320 72 12 with with ADP iajs-320 72 13 the the DET iajs-320 72 14 result result NOUN iajs-320 72 15 that that PRON iajs-320 72 16 are be AUX iajs-320 72 17 obtained obtain VERB iajs-320 72 18 from from ADP iajs-320 72 19 nn nn PROPN iajs-320 72 20 with with ADP iajs-320 72 21 the the DET iajs-320 72 22 discriminant discriminant ADJ iajs-320 72 23 analysis analysis NOUN iajs-320 72 24 ( ( PUNCT iajs-320 72 25 da da NOUN iajs-320 72 26 ) ) PUNCT iajs-320 72 27 . . PUNCT iajs-320 73 1 methods method NOUN iajs-320 73 2 for for ADP iajs-320 73 3 detecting detect VERB iajs-320 73 4 unknown unknown ADJ iajs-320 73 5 malware malware NOUN iajs-320 73 6 we we PRON iajs-320 73 7 selected select VERB iajs-320 73 8 the the DET iajs-320 73 9 static static ADJ iajs-320 73 10 analysis analysis NOUN iajs-320 73 11 method method NOUN iajs-320 73 12 as as ADP iajs-320 73 13 the the DET iajs-320 73 14 focus focus NOUN iajs-320 73 15 of of ADP iajs-320 73 16 this this DET iajs-320 73 17 research research NOUN iajs-320 73 18 . . PUNCT iajs-320 74 1 this this PRON iajs-320 74 2 is be AUX iajs-320 74 3 due due ADJ iajs-320 74 4 to to ADP iajs-320 74 5 the the DET iajs-320 74 6 technical technical ADJ iajs-320 74 7 limitations limitation NOUN iajs-320 74 8 of of ADP iajs-320 74 9 the the DET iajs-320 74 10 dynamic dynamic ADJ iajs-320 74 11 method method NOUN iajs-320 74 12 , , PUNCT iajs-320 74 13 and and CCONJ iajs-320 74 14 also also ADV iajs-320 74 15 to to ADP iajs-320 74 16 the the DET iajs-320 74 17 fact fact NOUN iajs-320 74 18 that that SCONJ iajs-320 74 19 constant constant ADJ iajs-320 74 20 monitoring monitoring NOUN iajs-320 74 21 on on ADP iajs-320 74 22 every every DET iajs-320 74 23 computer computer NOUN iajs-320 74 24 is be AUX iajs-320 74 25 necessary necessary ADJ iajs-320 74 26 to to PART iajs-320 74 27 prevent prevent VERB iajs-320 74 28 malware malware NOUN iajs-320 74 29 . . PUNCT iajs-320 75 1 to to PART iajs-320 75 2 develop develop VERB iajs-320 75 3 a a DET iajs-320 75 4 detection detection NOUN iajs-320 75 5 method method NOUN iajs-320 75 6 based base VERB iajs-320 75 7 on on ADP iajs-320 75 8 static static ADJ iajs-320 75 9 analysis analysis NOUN iajs-320 75 10 , , PUNCT iajs-320 75 11 we we PRON iajs-320 75 12 must must AUX iajs-320 75 13 overcome overcome VERB iajs-320 75 14 a a DET iajs-320 75 15 number number NOUN iajs-320 75 16 of of ADP iajs-320 75 17 challenges challenge NOUN iajs-320 75 18 , , PUNCT iajs-320 75 19 such such ADJ iajs-320 75 20 that that PRON iajs-320 75 21 . . PUNCT iajs-320 76 1 most most ADJ iajs-320 76 2 viruses virus NOUN iajs-320 76 3 today today NOUN iajs-320 76 4 feature feature VERB iajs-320 76 5 a a DET iajs-320 76 6 mechanism mechanism NOUN iajs-320 76 7 for for ADP iajs-320 76 8 self self NOUN iajs-320 76 9 - - PUNCT iajs-320 76 10 encryption encryption NOUN iajs-320 76 11 to to PART iajs-320 76 12 circumvent circumvent VERB iajs-320 76 13 simple simple ADJ iajs-320 76 14 file file NOUN iajs-320 76 15 checking checking NOUN iajs-320 76 16 or or CCONJ iajs-320 76 17 detection detection NOUN iajs-320 76 18 by by ADP iajs-320 76 19 pattern pattern NOUN iajs-320 76 20 matching matching NOUN iajs-320 76 21 . . PUNCT iajs-320 77 1 559 559 NUM iajs-320 78 1 | | ADV iajs-320 78 2 computer computer NOUN iajs-320 78 3 science science NOUN iajs-320 78 4 2014 2014 NUM iajs-320 78 5 ) ) PUNCT iajs-320 78 6 عام عام ADP iajs-320 78 7 3(العدد 3(العدد NUM iajs-320 78 8 27المجلد 27المجلد NUM iajs-320 79 1 مجلة مجلة VERB iajs-320 79 2 إبن إبن NOUN iajs-320 79 3 الھيثم الھيثم NOUN iajs-320 79 4 للعلوم للعلوم NOUN iajs-320 79 5 الصرفة الصرفة NOUN iajs-320 80 1 و و PRON iajs-320 80 2 التطبيقية التطبيقية ADJ iajs-320 80 3 ibn ibn PROPN iajs-320 80 4 al al PROPN iajs-320 80 5 - - PUNCT iajs-320 80 6 haitham haitham PROPN iajs-320 80 7 jour jour X iajs-320 80 8 . . PROPN iajs-320 80 9 for for ADP iajs-320 80 10 pure pure ADJ iajs-320 80 11 & & CCONJ iajs-320 80 12 appl appl PROPN iajs-320 80 13 . . PUNCT iajs-320 81 1 sci sci PROPN iajs-320 81 2 . . PUNCT iajs-320 81 3 vol vol NOUN iajs-320 81 4 . . PROPN iajs-320 82 1 27 27 NUM iajs-320 82 2 ( ( PUNCT iajs-320 82 3 3 3 NUM iajs-320 82 4 ) ) PUNCT iajs-320 82 5 2014 2014 NUM iajs-320 82 6 there there PRON iajs-320 82 7 are be VERB iajs-320 82 8 only only ADV iajs-320 82 9 two two NUM iajs-320 82 10 ways way NOUN iajs-320 82 11 to to PART iajs-320 82 12 detect detect VERB iajs-320 82 13 such such ADJ iajs-320 82 14 viruses virus NOUN iajs-320 82 15 when when SCONJ iajs-320 82 16 these these PRON iajs-320 82 17 are be AUX iajs-320 82 18 unrecognized unrecognize VERB iajs-320 82 19 : : PUNCT iajs-320 82 20 by by ADP iajs-320 82 21 cracking crack VERB iajs-320 82 22 the the DET iajs-320 82 23 encrypted encrypt VERB iajs-320 82 24 code code NOUN iajs-320 82 25 or or CCONJ iajs-320 82 26 by by ADP iajs-320 82 27 allowing allow VERB iajs-320 82 28 the the DET iajs-320 82 29 viruses virus NOUN iajs-320 82 30 to to PART iajs-320 82 31 activate activate VERB iajs-320 82 32 decryption decryption NOUN iajs-320 82 33 on on ADP iajs-320 82 34 their their PRON iajs-320 82 35 own own ADJ iajs-320 82 36 . . PUNCT iajs-320 83 1 to to PART iajs-320 83 2 determine determine VERB iajs-320 83 3 whether whether SCONJ iajs-320 83 4 an an DET iajs-320 83 5 executable executable ADJ iajs-320 83 6 program program NOUN iajs-320 83 7 will will AUX iajs-320 83 8 exhibit exhibit VERB iajs-320 83 9 malicious malicious ADJ iajs-320 83 10 behaviour behaviour NOUN iajs-320 83 11 ( ( PUNCT iajs-320 83 12 corruption corruption NOUN iajs-320 83 13 of of ADP iajs-320 83 14 files file NOUN iajs-320 83 15 , , PUNCT iajs-320 83 16 mailing mailing NOUN iajs-320 83 17 of of ADP iajs-320 83 18 confidential confidential ADJ iajs-320 83 19 documents document NOUN iajs-320 83 20 , , PUNCT iajs-320 83 21 etc etc X iajs-320 83 22 . . X iajs-320 83 23 ) ) PUNCT iajs-320 83 24 , , PUNCT iajs-320 83 25 it it PRON iajs-320 83 26 is be AUX iajs-320 83 27 necessary necessary ADJ iajs-320 83 28 to to PART iajs-320 83 29 analyse analyse VERB iajs-320 83 30 the the DET iajs-320 83 31 special special ADJ iajs-320 83 32 function function NOUN iajs-320 83 33 calls call NOUN iajs-320 83 34 requested request VERB iajs-320 83 35 by by ADP iajs-320 83 36 the the DET iajs-320 83 37 program program NOUN iajs-320 83 38 from from ADP iajs-320 83 39 the the DET iajs-320 83 40 operating operating NOUN iajs-320 83 41 system system NOUN iajs-320 83 42 . . PUNCT iajs-320 84 1 operating operate VERB iajs-320 84 2 systems system NOUN iajs-320 84 3 such such ADJ iajs-320 84 4 as as ADP iajs-320 84 5 windows window NOUN iajs-320 84 6 and and CCONJ iajs-320 84 7 unix unix PROPN iajs-320 84 8 protect protect VERB iajs-320 84 9 files file NOUN iajs-320 84 10 and and CCONJ iajs-320 84 11 other other ADJ iajs-320 84 12 resources resource NOUN iajs-320 84 13 from from ADP iajs-320 84 14 direct direct ADJ iajs-320 84 15 manipulation manipulation NOUN iajs-320 84 16 by by ADP iajs-320 84 17 ordinary ordinary ADJ iajs-320 84 18 programs program NOUN iajs-320 84 19 . . PUNCT iajs-320 85 1 even even ADV iajs-320 85 2 malwares malware NOUN iajs-320 85 3 must must AUX iajs-320 85 4 call call VERB iajs-320 85 5 functions function NOUN iajs-320 85 6 from from ADP iajs-320 85 7 the the DET iajs-320 85 8 operating operating NOUN iajs-320 85 9 system system NOUN iajs-320 85 10 in in ADP iajs-320 85 11 order order NOUN iajs-320 85 12 to to PART iajs-320 85 13 perform perform VERB iajs-320 85 14 any any DET iajs-320 85 15 given give VERB iajs-320 85 16 malicious malicious ADJ iajs-320 85 17 action action NOUN iajs-320 85 18 . . PUNCT iajs-320 86 1 a a DET iajs-320 86 2 mechanism mechanism NOUN iajs-320 86 3 is be AUX iajs-320 86 4 therefore therefore ADV iajs-320 86 5 required require VERB iajs-320 86 6 to to PART iajs-320 86 7 identify identify VERB iajs-320 86 8 sets set NOUN iajs-320 86 9 of of ADP iajs-320 86 10 function function NOUN iajs-320 86 11 calls call NOUN iajs-320 86 12 that that PRON iajs-320 86 13 are be AUX iajs-320 86 14 indicative indicative ADJ iajs-320 86 15 of of ADP iajs-320 86 16 malicious malicious ADJ iajs-320 86 17 behaviours behaviour NOUN iajs-320 86 18 [ [ X iajs-320 86 19 9 9 NUM iajs-320 86 20 ] ] PUNCT iajs-320 86 21 . . PUNCT iajs-320 87 1 research research NOUN iajs-320 87 2 motivation motivation NOUN iajs-320 87 3 in in ADP iajs-320 87 4 this this DET iajs-320 87 5 section section NOUN iajs-320 87 6 , , PUNCT iajs-320 87 7 we we PRON iajs-320 87 8 will will AUX iajs-320 87 9 review review VERB iajs-320 87 10 the the DET iajs-320 87 11 core core ADJ iajs-320 87 12 computational computational ADJ iajs-320 87 13 intelligence intelligence NOUN iajs-320 87 14 approaches approach NOUN iajs-320 87 15 that that PRON iajs-320 87 16 have have AUX iajs-320 87 17 been be AUX iajs-320 87 18 proposed propose VERB iajs-320 87 19 to to PART iajs-320 87 20 solve solve VERB iajs-320 87 21 malware malware NOUN iajs-320 87 22 detection detection NOUN iajs-320 87 23 problems problem NOUN iajs-320 87 24 . . PUNCT iajs-320 88 1 we we PRON iajs-320 88 2 shall shall AUX iajs-320 88 3 discuss discuss VERB iajs-320 88 4 data data NOUN iajs-320 88 5 collection collection NOUN iajs-320 88 6 , , PUNCT iajs-320 88 7 artificial artificial ADJ iajs-320 88 8 neural neural ADJ iajs-320 88 9 networks network NOUN iajs-320 88 10 , , PUNCT iajs-320 88 11 as as ADP iajs-320 88 12 soft soft ADJ iajs-320 88 13 computing computing NOUN iajs-320 88 14 and and CCONJ iajs-320 88 15 discriminant discriminant ADJ iajs-320 88 16 analysis analysis NOUN iajs-320 88 17 as as ADP iajs-320 88 18 data data NOUN iajs-320 88 19 mining mining NOUN iajs-320 88 20 method method NOUN iajs-320 88 21 as as SCONJ iajs-320 88 22 shown show VERB iajs-320 88 23 in in ADP iajs-320 88 24 fig-1 fig-1 NOUN iajs-320 88 25 . . PUNCT iajs-320 89 1 -data -data ADJ iajs-320 89 2 collection collection NOUN iajs-320 89 3 and and CCONJ iajs-320 89 4 pre pre ADJ iajs-320 89 5 - - ADJ iajs-320 89 6 processing process VERB iajs-320 89 7 the the DET iajs-320 89 8 work work NOUN iajs-320 89 9 analyzed analyze VERB iajs-320 89 10 ( ( PUNCT iajs-320 89 11 4744 4744 NUM iajs-320 89 12 ) ) PUNCT iajs-320 89 13 of of ADP iajs-320 89 14 pe pe PROPN iajs-320 89 15 applications application NOUN iajs-320 89 16 . . PUNCT iajs-320 90 1 samples sample NOUN iajs-320 90 2 have have AUX iajs-320 90 3 been be AUX iajs-320 90 4 collected collect VERB iajs-320 90 5 from from ADP iajs-320 90 6 [ [ PUNCT iajs-320 90 7 8].as 8].as NUM iajs-320 90 8 the the DET iajs-320 90 9 work work NOUN iajs-320 90 10 will will AUX iajs-320 90 11 classify classify VERB iajs-320 90 12 the the DET iajs-320 90 13 api api NOUN iajs-320 90 14 functions function NOUN iajs-320 90 15 of of ADP iajs-320 90 16 each each DET iajs-320 90 17 suspected suspect VERB iajs-320 90 18 application application NOUN iajs-320 90 19 . . PUNCT iajs-320 91 1 as as ADP iajs-320 91 2 a a DET iajs-320 91 3 result result NOUN iajs-320 91 4 of of ADP iajs-320 91 5 this this DET iajs-320 91 6 stage stage NOUN iajs-320 91 7 , , PUNCT iajs-320 91 8 the the DET iajs-320 91 9 window window NOUN iajs-320 91 10 size size NOUN iajs-320 91 11 of of ADP iajs-320 91 12 each each DET iajs-320 91 13 vector vector NOUN iajs-320 91 14 is be AUX iajs-320 91 15 ranged range VERB iajs-320 91 16 from from ADP iajs-320 91 17 4 4 NUM iajs-320 91 18 to to PART iajs-320 91 19 8 8 NUM iajs-320 91 20 api api NOUN iajs-320 91 21 elements element NOUN iajs-320 91 22 , , PUNCT iajs-320 91 23 the the DET iajs-320 91 24 vectors vector NOUN iajs-320 91 25 which which PRON iajs-320 91 26 are be AUX iajs-320 91 27 collected collect VERB iajs-320 91 28 according accord VERB iajs-320 91 29 to to ADP iajs-320 91 30 this this DET iajs-320 91 31 research research NOUN iajs-320 91 32 are be AUX iajs-320 91 33 : : PUNCT iajs-320 91 34 938 938 NUM iajs-320 91 35 vectors vector NOUN iajs-320 91 36 of of ADP iajs-320 91 37 api api NOUN iajs-320 91 38 calls call NOUN iajs-320 91 39 have have AUX iajs-320 91 40 been be AUX iajs-320 91 41 prepared prepare VERB iajs-320 91 42 after after SCONJ iajs-320 91 43 duplicated duplicate VERB iajs-320 91 44 vectors vector NOUN iajs-320 91 45 have have AUX iajs-320 91 46 been be AUX iajs-320 91 47 deleted delete VERB iajs-320 91 48 . . PUNCT iajs-320 92 1 1218 1218 NUM iajs-320 92 2 vectors vector NOUN iajs-320 92 3 of of ADP iajs-320 92 4 api api NOUN iajs-320 92 5 calls call NOUN iajs-320 92 6 have have AUX iajs-320 92 7 been be AUX iajs-320 92 8 prepared prepare VERB iajs-320 92 9 after after SCONJ iajs-320 92 10 duplicated duplicate VERB iajs-320 92 11 vectors vector NOUN iajs-320 92 12 have have AUX iajs-320 92 13 been be AUX iajs-320 92 14 deleted delete VERB iajs-320 92 15 . . PUNCT iajs-320 93 1 1410 1410 NUM iajs-320 93 2 vectors vector NOUN iajs-320 93 3 of of ADP iajs-320 93 4 api api NOUN iajs-320 93 5 calls call NOUN iajs-320 93 6 have have AUX iajs-320 93 7 been be AUX iajs-320 93 8 prepared prepare VERB iajs-320 93 9 after after SCONJ iajs-320 93 10 duplicated duplicate VERB iajs-320 93 11 vectors vector NOUN iajs-320 93 12 have have AUX iajs-320 93 13 been be AUX iajs-320 93 14 deleted delete VERB iajs-320 93 15 . . PUNCT iajs-320 94 1 1520 1520 NUM iajs-320 94 2 vectors vector NOUN iajs-320 94 3 of of ADP iajs-320 94 4 api api NOUN iajs-320 94 5 calls call NOUN iajs-320 94 6 have have AUX iajs-320 94 7 been be AUX iajs-320 94 8 prepared prepare VERB iajs-320 94 9 after after SCONJ iajs-320 94 10 duplicated duplicate VERB iajs-320 94 11 vectors vector NOUN iajs-320 94 12 have have AUX iajs-320 94 13 been be AUX iajs-320 94 14 deleted delete VERB iajs-320 94 15 . . PUNCT iajs-320 95 1 1602 1602 NUM iajs-320 95 2 vectors vector NOUN iajs-320 95 3 of of ADP iajs-320 95 4 api api NOUN iajs-320 95 5 calls call NOUN iajs-320 95 6 have have AUX iajs-320 95 7 been be AUX iajs-320 95 8 prepared prepare VERB iajs-320 95 9 after after SCONJ iajs-320 95 10 duplicated duplicate VERB iajs-320 95 11 vectors vector NOUN iajs-320 95 12 have have AUX iajs-320 95 13 been be AUX iajs-320 95 14 deleted delete VERB iajs-320 95 15 . . PUNCT iajs-320 96 1 -artificial -artificial ADJ iajs-320 96 2 neural neural ADJ iajs-320 96 3 networks network NOUN iajs-320 96 4 this this DET iajs-320 96 5 work work NOUN iajs-320 96 6 tries try VERB iajs-320 96 7 to to PART iajs-320 96 8 do do VERB iajs-320 96 9 two two NUM iajs-320 96 10 tests test NOUN iajs-320 96 11 on on ADP iajs-320 96 12 the the DET iajs-320 96 13 prepared prepare VERB iajs-320 96 14 vectors vector NOUN iajs-320 96 15 of of ADP iajs-320 96 16 api api NOUN iajs-320 96 17 calls call NOUN iajs-320 96 18 to to PART iajs-320 96 19 check check VERB iajs-320 96 20 the the DET iajs-320 96 21 conditions condition NOUN iajs-320 96 22 that that PRON iajs-320 96 23 affect affect VERB iajs-320 96 24 the the DET iajs-320 96 25 accuracy accuracy NOUN iajs-320 96 26 of of ADP iajs-320 96 27 classifiers classifier NOUN iajs-320 96 28 and and CCONJ iajs-320 96 29 to to PART iajs-320 96 30 check check VERB iajs-320 96 31 their their PRON iajs-320 96 32 accuracy accuracy NOUN iajs-320 96 33 rates rate NOUN iajs-320 96 34 . . PUNCT iajs-320 97 1 an an DET iajs-320 97 2 artificial artificial ADJ iajs-320 97 3 neural neural ADJ iajs-320 97 4 network network NOUN iajs-320 97 5 ( ( PUNCT iajs-320 97 6 ann ann PROPN iajs-320 97 7 ) ) PUNCT iajs-320 97 8 consists consist VERB iajs-320 97 9 of of ADP iajs-320 97 10 a a DET iajs-320 97 11 collection collection NOUN iajs-320 97 12 of of ADP iajs-320 97 13 processing processing NOUN iajs-320 97 14 units unit NOUN iajs-320 97 15 called call VERB iajs-320 97 16 neurons neuron NOUN iajs-320 97 17 that that PRON iajs-320 97 18 are be AUX iajs-320 97 19 highly highly ADV iajs-320 97 20 interconnected interconnected ADJ iajs-320 97 21 in in ADP iajs-320 97 22 a a DET iajs-320 97 23 given give VERB iajs-320 97 24 topology topology NOUN iajs-320 97 25 . . PUNCT iajs-320 98 1 anns anns PROPN iajs-320 98 2 have have VERB iajs-320 98 3 the the DET iajs-320 98 4 ability ability NOUN iajs-320 98 5 of of ADP iajs-320 98 6 learning learning NOUN iajs-320 98 7 - - PUNCT iajs-320 98 8 byexample byexample NOUN iajs-320 98 9 and and CCONJ iajs-320 98 10 generalizing generalize VERB iajs-320 98 11 from from ADP iajs-320 98 12 limited limited ADJ iajs-320 98 13 ; ; PUNCT iajs-320 98 14 they they PRON iajs-320 98 15 have have AUX iajs-320 98 16 been be AUX iajs-320 98 17 successfully successfully ADV iajs-320 98 18 employed employ VERB iajs-320 98 19 in in ADP iajs-320 98 20 a a DET iajs-320 98 21 broad broad ADJ iajs-320 98 22 spectrum spectrum NOUN iajs-320 98 23 of of ADP iajs-320 98 24 data datum NOUN iajs-320 98 25 intensive intensive ADJ iajs-320 98 26 applications application NOUN iajs-320 98 27 . . PUNCT iajs-320 99 1 in in ADP iajs-320 99 2 this this DET iajs-320 99 3 section section NOUN iajs-320 99 4 , , PUNCT iajs-320 99 5 the the DET iajs-320 99 6 research research NOUN iajs-320 99 7 will will AUX iajs-320 99 8 review review VERB iajs-320 99 9 the the DET iajs-320 99 10 contribution contribution NOUN iajs-320 99 11 to to ADP iajs-320 99 12 and and CCONJ iajs-320 99 13 performance performance NOUN iajs-320 99 14 in in ADP iajs-320 99 15 the the DET iajs-320 99 16 malware malware NOUN iajs-320 99 17 detection detection NOUN iajs-320 99 18 domain domain NOUN iajs-320 99 19 . . PUNCT iajs-320 100 1 to to PART iajs-320 100 2 predict predict VERB iajs-320 100 3 the the DET iajs-320 100 4 status status NOUN iajs-320 100 5 of of ADP iajs-320 100 6 an an DET iajs-320 100 7 api api NOUN iajs-320 100 8 call call NOUN iajs-320 100 9 vector vector NOUN iajs-320 100 10 , , PUNCT iajs-320 100 11 this this DET iajs-320 100 12 work work NOUN iajs-320 100 13 has have AUX iajs-320 100 14 applied apply VERB iajs-320 100 15 vectors vector NOUN iajs-320 100 16 to to ADP iajs-320 100 17 a a DET iajs-320 100 18 supervised supervised ADJ iajs-320 100 19 neural neural ADJ iajs-320 100 20 network network NOUN iajs-320 100 21 that that PRON iajs-320 100 22 depend depend VERB iajs-320 100 23 on on ADP iajs-320 100 24 feed feed NOUN iajs-320 100 25 forward forward ADV iajs-320 100 26 back back ADJ iajs-320 100 27 - - PUNCT iajs-320 100 28 propagation propagation NOUN iajs-320 100 29 ( ( PUNCT iajs-320 100 30 ffbp ffbp ADV iajs-320 100 31 ) ) PUNCT iajs-320 100 32 as as ADP iajs-320 100 33 a a DET iajs-320 100 34 training training NOUN iajs-320 100 35 algorithm algorithm NOUN iajs-320 100 36 . . PUNCT iajs-320 101 1 the the DET iajs-320 101 2 structure structure NOUN iajs-320 101 3 of of ADP iajs-320 101 4 the the DET iajs-320 101 5 neural neural ADJ iajs-320 101 6 network network NOUN iajs-320 101 7 contains contain VERB iajs-320 101 8 ( ( PUNCT iajs-320 101 9 4 4 NUM iajs-320 101 10 - - SYM iajs-320 101 11 8) 8) NUM iajs-320 101 12 nodes node NOUN iajs-320 101 13 at at ADP iajs-320 101 14 input input NOUN iajs-320 101 15 layer layer NOUN iajs-320 101 16 , , PUNCT iajs-320 101 17 two two NUM iajs-320 101 18 hidden hidden ADJ iajs-320 101 19 layers layer NOUN iajs-320 101 20 , , PUNCT iajs-320 101 21 the the DET iajs-320 101 22 first first ADJ iajs-320 101 23 hidden hide VERB iajs-320 101 24 layer layer NOUN iajs-320 101 25 ranged range VERB iajs-320 101 26 from from ADP iajs-320 101 27 4 4 NUM iajs-320 101 28 to to PART iajs-320 101 29 15 15 NUM iajs-320 101 30 nodes node NOUN iajs-320 101 31 and and CCONJ iajs-320 101 32 the the DET iajs-320 101 33 second second ADJ iajs-320 101 34 hidden hide VERB iajs-320 101 35 layer layer NOUN iajs-320 101 36 ranged range VERB iajs-320 101 37 from from ADP iajs-320 101 38 8 8 NUM iajs-320 101 39 to to PART iajs-320 101 40 30 30 NUM iajs-320 101 41 nodes node NOUN iajs-320 101 42 hidden hide VERB iajs-320 101 43 , , PUNCT iajs-320 101 44 and and CCONJ iajs-320 101 45 one one NUM iajs-320 101 46 node node NOUN iajs-320 101 47 at at ADP iajs-320 101 48 output output NOUN iajs-320 101 49 layer layer NOUN iajs-320 101 50 . . PUNCT iajs-320 102 1 the the DET iajs-320 102 2 output output NOUN iajs-320 102 3 range range NOUN iajs-320 102 4 of of ADP iajs-320 102 5 the the DET iajs-320 102 6 neural neural ADJ iajs-320 102 7 network network NOUN iajs-320 102 8 will will AUX iajs-320 102 9 be be AUX iajs-320 102 10 between between ADP iajs-320 102 11 ( ( PUNCT iajs-320 102 12 0 0 NUM iajs-320 102 13 , , PUNCT iajs-320 102 14 1 1 NUM iajs-320 102 15 ) ) PUNCT iajs-320 102 16 ; ; PUNCT iajs-320 102 17 the the DET iajs-320 102 18 case case NOUN iajs-320 102 19 ( ( PUNCT iajs-320 102 20 0 0 NUM iajs-320 102 21 ) ) PUNCT iajs-320 102 22 indicates indicate VERB iajs-320 102 23 beingn beingn ADJ iajs-320 102 24 and and CCONJ iajs-320 102 25 ( ( PUNCT iajs-320 102 26 1 1 X iajs-320 102 27 ) ) PUNCT iajs-320 102 28 indicates indicate VERB iajs-320 102 29 malwares malware NOUN iajs-320 102 30 . . PUNCT iajs-320 103 1 560 560 NUM iajs-320 103 2 | | NOUN iajs-320 103 3 computer computer NOUN iajs-320 103 4 science science NOUN iajs-320 103 5 2014 2014 NUM iajs-320 103 6 ) ) PUNCT iajs-320 103 7 عام عام ADP iajs-320 103 8 3(العدد 3(العدد NUM iajs-320 103 9 27المجلد 27المجلد NUM iajs-320 103 10 مجلة مجلة VERB iajs-320 103 11 إبن إبن NOUN iajs-320 103 12 الھيثم الھيثم NOUN iajs-320 103 13 للعلوم للعلوم NOUN iajs-320 103 14 الصرفة الصرفة NOUN iajs-320 104 1 و و PRON iajs-320 104 2 التطبيقية التطبيقية ADJ iajs-320 104 3 ibn ibn PROPN iajs-320 104 4 al al PROPN iajs-320 104 5 - - PUNCT iajs-320 104 6 haitham haitham PROPN iajs-320 104 7 jour jour X iajs-320 104 8 . . PROPN iajs-320 104 9 for for ADP iajs-320 104 10 pure pure ADJ iajs-320 104 11 & & CCONJ iajs-320 104 12 appl appl PROPN iajs-320 104 13 . . PUNCT iajs-320 105 1 sci sci PROPN iajs-320 105 2 . . PUNCT iajs-320 105 3 vol vol NOUN iajs-320 105 4 . . PROPN iajs-320 106 1 27 27 NUM iajs-320 106 2 ( ( PUNCT iajs-320 106 3 3 3 NUM iajs-320 106 4 ) ) PUNCT iajs-320 106 5 2014 2014 NUM iajs-320 106 6 we we PRON iajs-320 106 7 have have AUX iajs-320 106 8 divided divide VERB iajs-320 106 9 the the DET iajs-320 106 10 data datum NOUN iajs-320 106 11 set set VERB iajs-320 106 12 into into ADP iajs-320 106 13 two two NUM iajs-320 106 14 parts part NOUN iajs-320 106 15 ; ; PUNCT iajs-320 106 16 first first ADJ iajs-320 106 17 part part NOUN iajs-320 106 18 has have VERB iajs-320 106 19 number number NOUN iajs-320 106 20 of of ADP iajs-320 106 21 vectors vector NOUN iajs-320 106 22 used use VERB iajs-320 106 23 during during ADP iajs-320 106 24 training training NOUN iajs-320 106 25 phase phase NOUN iajs-320 106 26 , , PUNCT iajs-320 106 27 while while SCONJ iajs-320 106 28 remain remain ADJ iajs-320 106 29 vectors vector NOUN iajs-320 106 30 has have AUX iajs-320 106 31 used use VERB iajs-320 106 32 for for ADP iajs-320 106 33 testing testing NOUN iajs-320 106 34 . . PUNCT iajs-320 107 1 each each DET iajs-320 107 2 point point NOUN iajs-320 107 3 in in ADP iajs-320 107 4 this this DET iajs-320 107 5 figure figure NOUN iajs-320 107 6 indicates indicate VERB iajs-320 107 7 how how SCONJ iajs-320 107 8 many many ADJ iajs-320 107 9 vectors vector NOUN iajs-320 107 10 that that PRON iajs-320 107 11 labelled label VERB iajs-320 107 12 as as ADV iajs-320 107 13 normal normal ADJ iajs-320 107 14 or or CCONJ iajs-320 107 15 malware malware NOUN iajs-320 107 16 has have VERB iajs-320 107 17 the the DET iajs-320 107 18 same same ADJ iajs-320 107 19 prediction prediction NOUN iajs-320 107 20 output output NOUN iajs-320 107 21 . . PUNCT iajs-320 108 1 the the DET iajs-320 108 2 threshold threshold NOUN iajs-320 108 3 used use VERB iajs-320 108 4 for for ADP iajs-320 108 5 each each DET iajs-320 108 6 neural neural ADJ iajs-320 108 7 network network NOUN iajs-320 108 8 is be AUX iajs-320 108 9 different different ADJ iajs-320 108 10 according accord VERB iajs-320 108 11 to to ADP iajs-320 108 12 the the DET iajs-320 108 13 output output NOUN iajs-320 108 14 . . PUNCT iajs-320 109 1 cases case NOUN iajs-320 109 2 in in ADP iajs-320 109 3 such such DET iajs-320 109 4 a a DET iajs-320 109 5 situation situation NOUN iajs-320 109 6 probably probably ADV iajs-320 109 7 lead lead VERB iajs-320 109 8 to to PART iajs-320 109 9 generate generate VERB iajs-320 109 10 false false ADJ iajs-320 109 11 alarm alarm NOUN iajs-320 109 12 ( ( PUNCT iajs-320 109 13 fa fa NOUN iajs-320 109 14 ) ) PUNCT iajs-320 109 15 as as SCONJ iajs-320 109 16 shown show VERB iajs-320 109 17 in in ADP iajs-320 109 18 fig-2 fig-2 ADJ iajs-320 109 19 . . PUNCT iajs-320 109 20 -discriminant -discriminant ADJ iajs-320 109 21 analysis analysis NOUN iajs-320 109 22 ( ( PUNCT iajs-320 109 23 da da ADJ iajs-320 109 24 ) ) PUNCT iajs-320 109 25 discriminant discriminant NOUN iajs-320 109 26 function function NOUN iajs-320 109 27 analysis analysis NOUN iajs-320 109 28 is be AUX iajs-320 109 29 used use VERB iajs-320 109 30 to to PART iajs-320 109 31 determine determine VERB iajs-320 109 32 which which PRON iajs-320 109 33 variables variable NOUN iajs-320 109 34 discriminate discriminate VERB iajs-320 109 35 between between ADP iajs-320 109 36 two two NUM iajs-320 109 37 or or CCONJ iajs-320 109 38 more more ADJ iajs-320 109 39 naturally naturally ADV iajs-320 109 40 occurring occur VERB iajs-320 109 41 groups group NOUN iajs-320 109 42 . . PUNCT iajs-320 110 1 computationally computationally ADV iajs-320 110 2 , , PUNCT iajs-320 110 3 discriminant discriminant ADJ iajs-320 110 4 function function NOUN iajs-320 110 5 analysis analysis NOUN iajs-320 110 6 is be AUX iajs-320 110 7 very very ADV iajs-320 110 8 similar similar ADJ iajs-320 110 9 to to ADP iajs-320 110 10 analysis analysis NOUN iajs-320 110 11 of of ADP iajs-320 110 12 variance variance NOUN iajs-320 110 13 ( ( PUNCT iajs-320 110 14 anova anova PROPN iajs-320 110 15 ) ) PUNCT iajs-320 110 16 . . PUNCT iajs-320 111 1 improving improve VERB iajs-320 111 2 api api NOUN iajs-320 111 3 behavior behavior NOUN iajs-320 111 4 based base VERB iajs-320 111 5 models model NOUN iajs-320 111 6 going go VERB iajs-320 111 7 through through ADP iajs-320 111 8 api api NOUN iajs-320 111 9 classifying classify VERB iajs-320 111 10 problems problem NOUN iajs-320 111 11 and and CCONJ iajs-320 111 12 doing do VERB iajs-320 111 13 more more ADJ iajs-320 111 14 evaluations evaluation NOUN iajs-320 111 15 will will AUX iajs-320 111 16 direct direct VERB iajs-320 111 17 such such ADJ iajs-320 111 18 models model NOUN iajs-320 111 19 toward toward ADP iajs-320 111 20 improving improve VERB iajs-320 111 21 their their PRON iajs-320 111 22 accuracy accuracy NOUN iajs-320 111 23 and and CCONJ iajs-320 111 24 minimizing minimize VERB iajs-320 111 25 false false ADJ iajs-320 111 26 alarm alarm NOUN iajs-320 111 27 ( ( PUNCT iajs-320 111 28 fa fa NOUN iajs-320 111 29 ) ) PUNCT iajs-320 111 30 rates rate NOUN iajs-320 111 31 . . PUNCT iajs-320 112 1 therefore therefore ADV iajs-320 112 2 , , PUNCT iajs-320 112 3 minimizing minimize VERB iajs-320 112 4 the the DET iajs-320 112 5 number number NOUN iajs-320 112 6 of of ADP iajs-320 112 7 cases case NOUN iajs-320 112 8 in in ADP iajs-320 112 9 this this DET iajs-320 112 10 area area NOUN iajs-320 112 11 means mean VERB iajs-320 112 12 minimizing minimize VERB iajs-320 112 13 errors error NOUN iajs-320 112 14 and and CCONJ iajs-320 112 15 will will AUX iajs-320 112 16 improve improve VERB iajs-320 112 17 the the DET iajs-320 112 18 accuracy accuracy NOUN iajs-320 112 19 of of ADP iajs-320 112 20 identification identification NOUN iajs-320 112 21 and and CCONJ iajs-320 112 22 classification classification NOUN iajs-320 112 23 rate rate NOUN iajs-320 112 24 . . PUNCT iajs-320 113 1 to to PART iajs-320 113 2 do do VERB iajs-320 113 3 that that PRON iajs-320 113 4 , , PUNCT iajs-320 113 5 this this DET iajs-320 113 6 work work NOUN iajs-320 113 7 employed employ VERB iajs-320 113 8 a a DET iajs-320 113 9 double double ADJ iajs-320 113 10 checking checking NOUN iajs-320 113 11 or or CCONJ iajs-320 113 12 scanning scan VERB iajs-320 113 13 process process NOUN iajs-320 113 14 on on ADP iajs-320 113 15 the the DET iajs-320 113 16 same same ADJ iajs-320 113 17 suspected suspect VERB iajs-320 113 18 vectors vector NOUN iajs-320 113 19 of of ADP iajs-320 113 20 api api NOUN iajs-320 113 21 calls call NOUN iajs-320 113 22 , , PUNCT iajs-320 113 23 but but CCONJ iajs-320 113 24 in in ADP iajs-320 113 25 two two NUM iajs-320 113 26 different different ADJ iajs-320 113 27 directions direction NOUN iajs-320 113 28 . . PUNCT iajs-320 114 1 this this DET iajs-320 114 2 ides ide NOUN iajs-320 114 3 has have AUX iajs-320 114 4 been be AUX iajs-320 114 5 taken take VERB iajs-320 114 6 out out ADP iajs-320 114 7 from from ADP iajs-320 114 8 the the DET iajs-320 114 9 co co ADJ iajs-320 114 10 - - ADJ iajs-320 114 11 stimulation stimulation ADJ iajs-320 114 12 phenomenon phenomenon NOUN iajs-320 114 13 that that PRON iajs-320 114 14 occurred occur VERB iajs-320 114 15 inside inside ADP iajs-320 114 16 the the DET iajs-320 114 17 human human ADJ iajs-320 114 18 immune immune ADJ iajs-320 114 19 system system NOUN iajs-320 114 20 ( ( PUNCT iajs-320 114 21 his his NOUN iajs-320 114 22 ) ) PUNCT iajs-320 114 23 . . PUNCT iajs-320 115 1 the the DET iajs-320 115 2 process process NOUN iajs-320 115 3 of of ADP iajs-320 115 4 co co NOUN iajs-320 115 5 - - NOUN iajs-320 115 6 stimulation stimulation NOUN iajs-320 115 7 provides provide VERB iajs-320 115 8 a a DET iajs-320 115 9 very very ADV iajs-320 115 10 good good ADJ iajs-320 115 11 discrimination discrimination NOUN iajs-320 115 12 procedure procedure NOUN iajs-320 115 13 to to ADP iajs-320 115 14 his his PRON iajs-320 115 15 . . PUNCT iajs-320 116 1 it it PRON iajs-320 116 2 displaces displace VERB iajs-320 116 3 the the DET iajs-320 116 4 self self NOUN iajs-320 116 5 - - PUNCT iajs-320 116 6 cells cell NOUN iajs-320 116 7 from from ADP iajs-320 116 8 non non ADJ iajs-320 116 9 - - ADJ iajs-320 116 10 self self NOUN iajs-320 116 11 - - PUNCT iajs-320 116 12 cells cell NOUN iajs-320 116 13 with with ADP iajs-320 116 14 zero zero NUM iajs-320 116 15 rates rate NOUN iajs-320 116 16 of of ADP iajs-320 116 17 fa fa PROPN iajs-320 116 18 . . PUNCT iajs-320 117 1 it it PRON iajs-320 117 2 achieves achieve VERB iajs-320 117 3 that that SCONJ iajs-320 117 4 by by ADP iajs-320 117 5 involving involve VERB iajs-320 117 6 two two NUM iajs-320 117 7 different different ADJ iajs-320 117 8 immune immune ADJ iajs-320 117 9 cells cell NOUN iajs-320 117 10 in in ADP iajs-320 117 11 checking check VERB iajs-320 117 12 a a DET iajs-320 117 13 foreign foreign ADJ iajs-320 117 14 body body NOUN iajs-320 117 15 . . PUNCT iajs-320 118 1 the the DET iajs-320 118 2 first first ADJ iajs-320 118 3 cell cell NOUN iajs-320 118 4 checks check VERB iajs-320 118 5 the the DET iajs-320 118 6 normality normality NOUN iajs-320 118 7 , , PUNCT iajs-320 118 8 while while SCONJ iajs-320 118 9 the the DET iajs-320 118 10 second second ADJ iajs-320 118 11 cell cell NOUN iajs-320 118 12 checks check VERB iajs-320 118 13 the the DET iajs-320 118 14 viral viral ADJ iajs-320 118 15 degree degree NOUN iajs-320 118 16 of of ADP iajs-320 118 17 the the DET iajs-320 118 18 same same ADJ iajs-320 118 19 suspected suspect VERB iajs-320 118 20 foreign foreign ADJ iajs-320 118 21 body body NOUN iajs-320 118 22 . . PUNCT iajs-320 119 1 after after ADP iajs-320 119 2 that that PRON iajs-320 119 3 , , PUNCT iajs-320 119 4 both both DET iajs-320 119 5 cells cell NOUN iajs-320 119 6 will will AUX iajs-320 119 7 send send VERB iajs-320 119 8 back back ADV iajs-320 119 9 their their PRON iajs-320 119 10 results result NOUN iajs-320 119 11 to to ADP iajs-320 119 12 immune immune ADJ iajs-320 119 13 system system NOUN iajs-320 119 14 ( ( PUNCT iajs-320 119 15 is be AUX iajs-320 119 16 ) ) PUNCT iajs-320 119 17 . . PUNCT iajs-320 120 1 then then ADV iajs-320 120 2 , , PUNCT iajs-320 120 3 the the DET iajs-320 120 4 final final ADJ iajs-320 120 5 decision decision NOUN iajs-320 120 6 to to PART iajs-320 120 7 identify identify VERB iajs-320 120 8 or or CCONJ iajs-320 120 9 classify classify VERB iajs-320 120 10 a a DET iajs-320 120 11 foreign foreign ADJ iajs-320 120 12 body body NOUN iajs-320 120 13 will will AUX iajs-320 120 14 depend depend VERB iajs-320 120 15 on on ADP iajs-320 120 16 the the DET iajs-320 120 17 checking checking NOUN iajs-320 120 18 results result NOUN iajs-320 120 19 that that PRON iajs-320 120 20 came come VERB iajs-320 120 21 from from ADP iajs-320 120 22 both both DET iajs-320 120 23 immune immune ADJ iajs-320 120 24 cells cell NOUN iajs-320 120 25 [ [ X iajs-320 120 26 5 5 NUM iajs-320 120 27 ] ] PUNCT iajs-320 120 28 . . PUNCT iajs-320 121 1 our our PRON iajs-320 121 2 model model NOUN iajs-320 121 3 framework framework NOUN iajs-320 121 4 that that PRON iajs-320 121 5 simulates simulate VERB iajs-320 121 6 as as ADP iajs-320 121 7 co co ADJ iajs-320 121 8 - - ADJ iajs-320 121 9 stimulation stimulation ADJ iajs-320 121 10 phenomenon phenomenon NOUN iajs-320 121 11 is be AUX iajs-320 121 12 illustrated illustrate VERB iajs-320 121 13 in in ADP iajs-320 121 14 figure figure NOUN iajs-320 121 15 4 4 NUM iajs-320 121 16 . . PUNCT iajs-320 122 1 the the DET iajs-320 122 2 model model NOUN iajs-320 122 3 has have VERB iajs-320 122 4 two two NUM iajs-320 122 5 main main ADJ iajs-320 122 6 lines line NOUN iajs-320 122 7 . . PUNCT iajs-320 123 1 each each DET iajs-320 123 2 line line NOUN iajs-320 123 3 , , PUNCT iajs-320 123 4 differently differently ADV iajs-320 123 5 , , PUNCT iajs-320 123 6 will will AUX iajs-320 123 7 scan scan VERB iajs-320 123 8 api api NOUN iajs-320 123 9 call call NOUN iajs-320 123 10 vectors vector NOUN iajs-320 123 11 . . PUNCT iajs-320 124 1 after after ADP iajs-320 124 2 that that PRON iajs-320 124 3 , , PUNCT iajs-320 124 4 results result NOUN iajs-320 124 5 that that PRON iajs-320 124 6 obtained obtain VERB iajs-320 124 7 from from ADP iajs-320 124 8 both both DET iajs-320 124 9 lines line NOUN iajs-320 124 10 will will AUX iajs-320 124 11 be be AUX iajs-320 124 12 sent send VERB iajs-320 124 13 to to ADP iajs-320 124 14 co co ADJ iajs-320 124 15 - - ADJ iajs-320 124 16 stimulation stimulation ADJ iajs-320 124 17 unit unit NOUN iajs-320 124 18 . . PUNCT iajs-320 125 1 there there ADV iajs-320 125 2 , , PUNCT iajs-320 125 3 both both DET iajs-320 125 4 results result NOUN iajs-320 125 5 will will AUX iajs-320 125 6 be be AUX iajs-320 125 7 considered consider VERB iajs-320 125 8 for for ADP iajs-320 125 9 identification identification NOUN iajs-320 125 10 or or CCONJ iajs-320 125 11 classification classification NOUN iajs-320 125 12 . . PUNCT iajs-320 126 1 -the -the DET iajs-320 126 2 first first ADJ iajs-320 126 3 scanning scanning NOUN iajs-320 126 4 method method NOUN iajs-320 126 5 in in ADP iajs-320 126 6 this this DET iajs-320 126 7 method method NOUN iajs-320 126 8 , , PUNCT iajs-320 126 9 the the DET iajs-320 126 10 sequence sequence NOUN iajs-320 126 11 of of ADP iajs-320 126 12 api api NOUN iajs-320 126 13 functions function NOUN iajs-320 126 14 that that PRON iajs-320 126 15 called call VERB iajs-320 126 16 by by ADP iajs-320 126 17 a a DET iajs-320 126 18 suspected suspect VERB iajs-320 126 19 application application NOUN iajs-320 126 20 will will AUX iajs-320 126 21 be be AUX iajs-320 126 22 scanned scan VERB iajs-320 126 23 . . PUNCT iajs-320 127 1 each each DET iajs-320 127 2 time time NOUN iajs-320 127 3 , , PUNCT iajs-320 127 4 the the DET iajs-320 127 5 scanner scanner NOUN iajs-320 127 6 will will AUX iajs-320 127 7 read read VERB iajs-320 127 8 number number NOUN iajs-320 127 9 of of ADP iajs-320 127 10 elements element NOUN iajs-320 127 11 ( ( PUNCT iajs-320 127 12 n n CCONJ iajs-320 127 13 - - PUNCT iajs-320 127 14 grams gram NOUN iajs-320 127 15 ) ) PUNCT iajs-320 127 16 as as ADP iajs-320 127 17 vector vector NOUN iajs-320 127 18 ; ; PUNCT iajs-320 127 19 the the DET iajs-320 127 20 ngrams ngrams PROPN iajs-320 127 21 will will AUX iajs-320 127 22 be be AUX iajs-320 127 23 rated rate VERB iajs-320 127 24 from from ADP iajs-320 127 25 4 4 NUM iajs-320 127 26 to to PART iajs-320 127 27 8 8 NUM iajs-320 127 28 elements element NOUN iajs-320 127 29 . . PUNCT iajs-320 128 1 later later ADV iajs-320 128 2 , , PUNCT iajs-320 128 3 the the DET iajs-320 128 4 vector vector NOUN iajs-320 128 5 will will AUX iajs-320 128 6 be be AUX iajs-320 128 7 compared compare VERB iajs-320 128 8 with with ADP iajs-320 128 9 many many ADJ iajs-320 128 10 predefined predefine VERB iajs-320 128 11 normal normal ADJ iajs-320 128 12 and and CCONJ iajs-320 128 13 abnormal abnormal ADJ iajs-320 128 14 vectors vector NOUN iajs-320 128 15 . . PUNCT iajs-320 129 1 a a DET iajs-320 129 2 threshold threshold NOUN iajs-320 129 3 set set VERB iajs-320 129 4 to to PART iajs-320 129 5 classify classify VERB iajs-320 129 6 vectors vector NOUN iajs-320 129 7 into into ADP iajs-320 129 8 three three NUM iajs-320 129 9 groups group NOUN iajs-320 129 10 . . PUNCT iajs-320 130 1 vectors vector NOUN iajs-320 130 2 will will AUX iajs-320 130 3 be be AUX iajs-320 130 4 labelled label VERB iajs-320 130 5 as as ADP iajs-320 130 6 normal normal ADJ iajs-320 130 7 , , PUNCT iajs-320 130 8 if if SCONJ iajs-320 130 9 their their PRON iajs-320 130 10 output output NOUN iajs-320 130 11 result result NOUN iajs-320 130 12 ( ( PUNCT iajs-320 130 13 output<=threshold-1 output<=threshold-1 NOUN iajs-320 130 14 ) ) PUNCT iajs-320 130 15 , , PUNCT iajs-320 130 16 or or CCONJ iajs-320 130 17 as as ADP iajs-320 130 18 malware malware NOUN iajs-320 130 19 if if SCONJ iajs-320 130 20 ( ( PUNCT iajs-320 130 21 output>=threshold-2 output>=threshold-2 PROPN iajs-320 130 22 ) ) PUNCT iajs-320 130 23 , , PUNCT iajs-320 130 24 otherwise otherwise ADV iajs-320 130 25 they they PRON iajs-320 130 26 are be AUX iajs-320 130 27 considered consider VERB iajs-320 130 28 as as ADP iajs-320 130 29 ambiguous ambiguous ADJ iajs-320 130 30 vectors vector NOUN iajs-320 130 31 and and CCONJ iajs-320 130 32 labelled label VERB iajs-320 130 33 as as ADP iajs-320 130 34 fa fa PROPN iajs-320 130 35 . . PUNCT iajs-320 131 1 then then ADV iajs-320 131 2 , , PUNCT iajs-320 131 3 the the DET iajs-320 131 4 mean mean ADJ iajs-320 131 5 percentage percentage NOUN iajs-320 131 6 of of ADP iajs-320 131 7 each each DET iajs-320 131 8 group group NOUN iajs-320 131 9 will will AUX iajs-320 131 10 be be AUX iajs-320 131 11 calculated calculate VERB iajs-320 131 12 . . PUNCT iajs-320 132 1 another another DET iajs-320 132 2 thing thing NOUN iajs-320 132 3 that that PRON iajs-320 132 4 should should AUX iajs-320 132 5 be be AUX iajs-320 132 6 kept keep VERB iajs-320 132 7 at at ADP iajs-320 132 8 output output NOUN iajs-320 132 9 stage stage NOUN iajs-320 132 10 is be AUX iajs-320 132 11 the the DET iajs-320 132 12 vectors vector NOUN iajs-320 132 13 in in ADP iajs-320 132 14 fa fa PROPN iajs-320 132 15 for for ADP iajs-320 132 16 further far ADV iajs-320 132 17 checking checking NOUN iajs-320 132 18 . . PUNCT iajs-320 133 1 to to PART iajs-320 133 2 achieve achieve VERB iajs-320 133 3 this this DET iajs-320 133 4 scanning scanning NOUN iajs-320 133 5 line line NOUN iajs-320 133 6 , , PUNCT iajs-320 133 7 this this DET iajs-320 133 8 work work NOUN iajs-320 133 9 has have AUX iajs-320 133 10 employed employ VERB iajs-320 133 11 a a DET iajs-320 133 12 feed feed NOUN iajs-320 133 13 forward forward ADV iajs-320 133 14 back back ADJ iajs-320 133 15 - - PUNCT iajs-320 133 16 propagation propagation NOUN iajs-320 133 17 ( ( PUNCT iajs-320 133 18 ff ff NOUN iajs-320 133 19 - - PUNCT iajs-320 133 20 bp bp NOUN iajs-320 133 21 ) ) PUNCT iajs-320 133 22 neural neural ADJ iajs-320 133 23 network network NOUN iajs-320 133 24 tool tool NOUN iajs-320 133 25 , , PUNCT iajs-320 133 26 because because SCONJ iajs-320 133 27 it it PRON iajs-320 133 28 can can AUX iajs-320 133 29 solve solve VERB iajs-320 133 30 very very ADV iajs-320 133 31 complex complex ADJ iajs-320 133 32 and and CCONJ iajs-320 133 33 nonlinear nonlinear ADJ iajs-320 133 34 problems problem NOUN iajs-320 133 35 . . PUNCT iajs-320 134 1 the the DET iajs-320 134 2 structure structure NOUN iajs-320 134 3 of of ADP iajs-320 134 4 the the DET iajs-320 134 5 used use VERB iajs-320 134 6 neural neural ADJ iajs-320 134 7 network network NOUN iajs-320 134 8 is be AUX iajs-320 134 9 illustrated illustrate VERB iajs-320 134 10 in in ADP iajs-320 134 11 figure-2 figure-2 NUM iajs-320 134 12 which which PRON iajs-320 134 13 determined determine VERB iajs-320 134 14 that that SCONJ iajs-320 134 15 the the DET iajs-320 134 16 input input NOUN iajs-320 134 17 layer layer NOUN iajs-320 134 18 will will AUX iajs-320 134 19 be be AUX iajs-320 134 20 ranged range VERB iajs-320 134 21 from from ADP iajs-320 134 22 4 4 NUM iajs-320 134 23 to to PART iajs-320 134 24 8 8 NUM iajs-320 134 25 input input NOUN iajs-320 134 26 elements element NOUN iajs-320 134 27 in in ADP iajs-320 134 28 each each DET iajs-320 134 29 vector vector NOUN iajs-320 134 30 while while SCONJ iajs-320 134 31 the the DET iajs-320 134 32 first first ADJ iajs-320 134 33 and and CCONJ iajs-320 134 34 second second ADJ iajs-320 134 35 hidden hide VERB iajs-320 134 36 layer layer NOUN iajs-320 134 37 will will AUX iajs-320 134 38 be be AUX iajs-320 134 39 ranged range VERB iajs-320 134 40 from from ADP iajs-320 134 41 4 4 NUM iajs-320 134 42 to to PART iajs-320 134 43 15 15 NUM iajs-320 134 44 for for ADP iajs-320 134 45 first first ADJ iajs-320 134 46 hidden hide VERB iajs-320 134 47 layer layer NOUN iajs-320 134 48 and and CCONJ iajs-320 134 49 from from ADP iajs-320 134 50 8 8 NUM iajs-320 134 51 to to ADP iajs-320 134 52 30 30 NUM iajs-320 134 53 for for ADP iajs-320 134 54 second second ADJ iajs-320 134 55 hidden hide VERB iajs-320 134 56 layer layer NOUN iajs-320 134 57 . . PUNCT iajs-320 135 1 through through ADP iajs-320 135 2 this this DET iajs-320 135 3 line line NOUN iajs-320 135 4 of of ADP iajs-320 135 5 scanning scanning NOUN iajs-320 135 6 , , PUNCT iajs-320 135 7 the the DET iajs-320 135 8 normality normality NOUN iajs-320 135 9 and and CCONJ iajs-320 135 10 viral viral ADJ iajs-320 135 11 degree degree NOUN iajs-320 135 12 of of ADP iajs-320 135 13 a a DET iajs-320 135 14 suspected suspect VERB iajs-320 135 15 file file NOUN iajs-320 135 16 somehow somehow ADV iajs-320 135 17 can can AUX iajs-320 135 18 be be AUX iajs-320 135 19 estimated estimate VERB iajs-320 135 20 . . PUNCT iajs-320 136 1 this this DET iajs-320 136 2 work work NOUN iajs-320 136 3 tests test VERB iajs-320 136 4 the the DET iajs-320 136 5 first first ADJ iajs-320 136 6 line line NOUN iajs-320 136 7 using use VERB iajs-320 136 8 ( ( PUNCT iajs-320 136 9 1736 1736 NUM iajs-320 136 10 ) ) PUNCT iajs-320 136 11 malicious malicious ADJ iajs-320 136 12 api api NOUN iajs-320 136 13 calls call NOUN iajs-320 136 14 ; ; PUNCT iajs-320 136 15 vector vector NOUN iajs-320 136 16 still still ADV iajs-320 136 17 needs need VERB iajs-320 136 18 improvement improvement NOUN iajs-320 136 19 , , PUNCT iajs-320 136 20 because because SCONJ iajs-320 136 21 the the DET iajs-320 136 22 possibility possibility NOUN iajs-320 136 23 of of ADP iajs-320 136 24 fa fa NOUN iajs-320 136 25 generation generation NOUN iajs-320 136 26 is be AUX iajs-320 136 27 high high ADJ iajs-320 136 28 . . PUNCT iajs-320 137 1 561 561 NUM iajs-320 138 1 | | ADV iajs-320 138 2 computer computer NOUN iajs-320 138 3 science science NOUN iajs-320 138 4 2014 2014 NUM iajs-320 138 5 ) ) PUNCT iajs-320 138 6 عام عام ADP iajs-320 138 7 3(العدد 3(العدد NUM iajs-320 138 8 27المجلد 27المجلد NUM iajs-320 139 1 مجلة مجلة VERB iajs-320 139 2 إبن إبن NOUN iajs-320 139 3 الھيثم الھيثم NOUN iajs-320 139 4 للعلوم للعلوم NOUN iajs-320 139 5 الصرفة الصرفة NOUN iajs-320 140 1 و و PRON iajs-320 140 2 التطبيقية التطبيقية ADJ iajs-320 140 3 ibn ibn PROPN iajs-320 140 4 al al PROPN iajs-320 140 5 - - PUNCT iajs-320 140 6 haitham haitham PROPN iajs-320 140 7 jour jour X iajs-320 140 8 . . PROPN iajs-320 140 9 for for ADP iajs-320 140 10 pure pure ADJ iajs-320 140 11 & & CCONJ iajs-320 140 12 appl appl PROPN iajs-320 140 13 . . PUNCT iajs-320 141 1 sci sci PROPN iajs-320 141 2 . . PUNCT iajs-320 141 3 vol vol NOUN iajs-320 141 4 . . PROPN iajs-320 142 1 27 27 NUM iajs-320 142 2 ( ( PUNCT iajs-320 142 3 3 3 NUM iajs-320 142 4 ) ) PUNCT iajs-320 142 5 2014 2014 NUM iajs-320 142 6 the the DET iajs-320 142 7 second second ADJ iajs-320 142 8 scanning scanning NOUN iajs-320 142 9 method method NOUN iajs-320 142 10 the the DET iajs-320 142 11 aim aim NOUN iajs-320 142 12 of of ADP iajs-320 142 13 the the DET iajs-320 142 14 second second ADJ iajs-320 142 15 scanning scanning NOUN iajs-320 142 16 is be AUX iajs-320 142 17 to to PART iajs-320 142 18 improve improve VERB iajs-320 142 19 or or CCONJ iajs-320 142 20 to to PART iajs-320 142 21 support support VERB iajs-320 142 22 what what PRON iajs-320 142 23 have have AUX iajs-320 142 24 been be AUX iajs-320 142 25 obtained obtain VERB iajs-320 142 26 through through ADP iajs-320 142 27 the the DET iajs-320 142 28 first first ADJ iajs-320 142 29 line line NOUN iajs-320 142 30 . . PUNCT iajs-320 143 1 here here ADV iajs-320 143 2 , , PUNCT iajs-320 143 3 vectors vector NOUN iajs-320 143 4 will will AUX iajs-320 143 5 be be AUX iajs-320 143 6 compared compare VERB iajs-320 143 7 with with ADP iajs-320 143 8 behaviors behavior NOUN iajs-320 143 9 that that PRON iajs-320 143 10 a a DET iajs-320 143 11 malware malware NOUN iajs-320 143 12 may may AUX iajs-320 143 13 perform perform VERB iajs-320 143 14 during during ADP iajs-320 143 15 execution execution NOUN iajs-320 143 16 . . PUNCT iajs-320 144 1 we we PRON iajs-320 144 2 can can AUX iajs-320 144 3 classify classify VERB iajs-320 144 4 the the DET iajs-320 144 5 behaviors behavior NOUN iajs-320 144 6 that that PRON iajs-320 144 7 are be AUX iajs-320 144 8 expected expect VERB iajs-320 144 9 by by ADP iajs-320 144 10 using use VERB iajs-320 144 11 a a DET iajs-320 144 12 special special ADJ iajs-320 144 13 data data NOUN iajs-320 144 14 mining mining NOUN iajs-320 144 15 method method NOUN iajs-320 144 16 named name VERB iajs-320 144 17 discriminant discriminant ADJ iajs-320 144 18 analysis analysis NOUN iajs-320 144 19 ( ( PUNCT iajs-320 144 20 da da NOUN iajs-320 144 21 ) ) PUNCT iajs-320 144 22 which which DET iajs-320 144 23 results result NOUN iajs-320 144 24 are be AUX iajs-320 144 25 obtained obtain VERB iajs-320 144 26 by by ADP iajs-320 144 27 tables table NOUN iajs-320 144 28 ( ( PUNCT iajs-320 144 29 1 1 NUM iajs-320 144 30 , , PUNCT iajs-320 144 31 2 2 NUM iajs-320 144 32 , , PUNCT iajs-320 144 33 3 3 NUM iajs-320 144 34 , , PUNCT iajs-320 144 35 4 4 NUM iajs-320 144 36 and and CCONJ iajs-320 144 37 5 5 NUM iajs-320 144 38 ) ) PUNCT iajs-320 144 39 for for ADP iajs-320 144 40 different different ADJ iajs-320 144 41 input input NOUN iajs-320 144 42 vectors vector NOUN iajs-320 144 43 . . PUNCT iajs-320 145 1 conclusions conclusion NOUN iajs-320 145 2 the the DET iajs-320 145 3 problem problem NOUN iajs-320 145 4 of of ADP iajs-320 145 5 accurate accurate ADJ iajs-320 145 6 discrimination discrimination NOUN iajs-320 145 7 between between ADP iajs-320 145 8 normal normal ADJ iajs-320 145 9 and and CCONJ iajs-320 145 10 malware malware NOUN iajs-320 145 11 ( ( PUNCT iajs-320 145 12 api api NOUN iajs-320 145 13 ) ) PUNCT iajs-320 145 14 function function NOUN iajs-320 145 15 calls call NOUN iajs-320 145 16 have have AUX iajs-320 145 17 been be AUX iajs-320 145 18 explained explain VERB iajs-320 145 19 in in ADP iajs-320 145 20 this this DET iajs-320 145 21 paper paper NOUN iajs-320 145 22 . . PUNCT iajs-320 146 1 this this DET iajs-320 146 2 problem problem NOUN iajs-320 146 3 challenges challenge VERB iajs-320 146 4 the the DET iajs-320 146 5 most most ADJ iajs-320 146 6 malware malware NOUN iajs-320 146 7 behavior behavior NOUN iajs-320 146 8 detection detection NOUN iajs-320 146 9 models model NOUN iajs-320 146 10 that that PRON iajs-320 146 11 depend depend VERB iajs-320 146 12 on on ADP iajs-320 146 13 ( ( PUNCT iajs-320 146 14 api api NOUN iajs-320 146 15 ) ) PUNCT iajs-320 146 16 tracing trace VERB iajs-320 146 17 and and CCONJ iajs-320 146 18 analyzing analyzing NOUN iajs-320 146 19 . . PUNCT iajs-320 147 1 the the DET iajs-320 147 2 problem problem NOUN iajs-320 147 3 affects affect VERB iajs-320 147 4 the the DET iajs-320 147 5 accuracy accuracy NOUN iajs-320 147 6 of of ADP iajs-320 147 7 detection detection NOUN iajs-320 147 8 and and CCONJ iajs-320 147 9 increases increase VERB iajs-320 147 10 the the DET iajs-320 147 11 rate rate NOUN iajs-320 147 12 of of ADP iajs-320 147 13 ( ( PUNCT iajs-320 147 14 fa fa NOUN iajs-320 147 15 ) ) PUNCT iajs-320 147 16 . . PUNCT iajs-320 148 1 based base VERB iajs-320 148 2 on on ADP iajs-320 148 3 the the DET iajs-320 148 4 biological biological ADJ iajs-320 148 5 co co ADJ iajs-320 148 6 - - ADJ iajs-320 148 7 stimulation stimulation ADJ iajs-320 148 8 process process NOUN iajs-320 148 9 , , PUNCT iajs-320 148 10 this this DET iajs-320 148 11 paper paper NOUN iajs-320 148 12 advised advise VERB iajs-320 148 13 a a DET iajs-320 148 14 new new ADJ iajs-320 148 15 detection detection NOUN iajs-320 148 16 model model NOUN iajs-320 148 17 that that PRON iajs-320 148 18 scans scan VERB iajs-320 148 19 any any DET iajs-320 148 20 suspected suspect VERB iajs-320 148 21 application application NOUN iajs-320 148 22 in in ADP iajs-320 148 23 two two NUM iajs-320 148 24 methods method NOUN iajs-320 148 25 . . PUNCT iajs-320 149 1 the the DET iajs-320 149 2 model model NOUN iajs-320 149 3 established establish VERB iajs-320 149 4 a a DET iajs-320 149 5 conferment conferment NOUN iajs-320 149 6 process process NOUN iajs-320 149 7 between between ADP iajs-320 149 8 both both DET iajs-320 149 9 scan scan ADJ iajs-320 149 10 lines line NOUN iajs-320 149 11 . . PUNCT iajs-320 150 1 the the DET iajs-320 150 2 results result NOUN iajs-320 150 3 show show VERB iajs-320 150 4 that that SCONJ iajs-320 150 5 the the DET iajs-320 150 6 proposed propose VERB iajs-320 150 7 model model NOUN iajs-320 150 8 can can AUX iajs-320 150 9 detect detect VERB iajs-320 150 10 unseen unseen ADJ iajs-320 150 11 malware malware NOUN iajs-320 150 12 and and CCONJ iajs-320 150 13 can can AUX iajs-320 150 14 increase increase VERB iajs-320 150 15 accuracy accuracy NOUN iajs-320 150 16 of of ADP iajs-320 150 17 ( ( PUNCT iajs-320 150 18 api api NOUN iajs-320 150 19 ) ) PUNCT iajs-320 150 20 behavior behavior NOUN iajs-320 150 21 detection detection NOUN iajs-320 150 22 systems system NOUN iajs-320 150 23 between between ADP iajs-320 150 24 77%83.2 77%83.2 NUM iajs-320 150 25 % % NOUN iajs-320 150 26 . . PUNCT iajs-320 151 1 references reference NOUN iajs-320 151 2 1 1 NUM iajs-320 151 3 . . PUNCT iajs-320 152 1 jacob jacob PROPN iajs-320 152 2 , , PUNCT iajs-320 152 3 g. g. PROPN iajs-320 152 4 , , PUNCT iajs-320 152 5 debar debar PROPN iajs-320 152 6 , , PUNCT iajs-320 152 7 h. h. NOUN iajs-320 152 8 , , PUNCT iajs-320 152 9 and and CCONJ iajs-320 152 10 filiol filiol PROPN iajs-320 152 11 , , PUNCT iajs-320 152 12 e. e. PROPN iajs-320 152 13 ( ( PUNCT iajs-320 152 14 2008 2008 NUM iajs-320 152 15 ) ) PUNCT iajs-320 152 16 “ " PUNCT iajs-320 152 17 behavior behavior NOUN iajs-320 152 18 detection detection NOUN iajs-320 152 19 of of ADP iajs-320 152 20 malware malware NOUN iajs-320 152 21 : : PUNCT iajs-320 152 22 from from ADP iajs-320 152 23 a a DET iajs-320 152 24 survey survey NOUN iajs-320 152 25 toward toward ADP iajs-320 152 26 an an DET iajs-320 152 27 established establish VERB iajs-320 152 28 taxonomy taxonomy NOUN iajs-320 152 29 ” " PUNCT iajs-320 152 30 , , PUNCT iajs-320 152 31 journal journal NOUN iajs-320 152 32 in in ADP iajs-320 152 33 computer computer NOUN iajs-320 152 34 virology virology NOUN iajs-320 152 35 , , PUNCT iajs-320 152 36 august august PROPN iajs-320 152 37 2008 2008 NUM iajs-320 152 38 , , PUNCT iajs-320 152 39 4 4 NUM iajs-320 152 40 , , PUNCT iajs-320 152 41 . . PUNCT iajs-320 152 42 , , PUNCT iajs-320 152 43 springer springer NOUN iajs-320 152 44 . . PUNCT iajs-320 153 1 : : PUNCT iajs-320 153 2 251 251 NUM iajs-320 153 3 - - SYM iajs-320 153 4 266 266 NUM iajs-320 153 5 2 2 NUM iajs-320 153 6 . . PUNCT iajs-320 154 1 forrest forrest PROPN iajs-320 154 2 , , PUNCT iajs-320 154 3 s. s. PROPN iajs-320 154 4 , , PUNCT iajs-320 154 5 et et PROPN iajs-320 154 6 al al PROPN iajs-320 154 7 . . PROPN iajs-320 154 8 longstaff longstaff PROPN iajs-320 154 9 ( ( PUNCT iajs-320 154 10 1996)”a 1996)”a NUM iajs-320 154 11 sense sense NOUN iajs-320 154 12 of of ADP iajs-320 154 13 self self NOUN iajs-320 154 14 for for ADP iajs-320 154 15 unix unix NOUN iajs-320 154 16 processes process NOUN iajs-320 154 17 ” " PUNCT iajs-320 154 18 . . PUNCT iajs-320 155 1 proceedings proceeding NOUN iajs-320 155 2 of of ADP iajs-320 155 3 ieee ieee NOUN iajs-320 155 4 symposium symposium NOUN iajs-320 155 5 on on ADP iajs-320 155 6 security security NOUN iajs-320 155 7 and and CCONJ iajs-320 155 8 privacy[c],usa privacy[c],usa PROPN iajs-320 155 9 : : PUNCT iajs-320 155 10 ieee ieee NOUN iajs-320 155 11 computer computer NOUN iajs-320 155 12 society society PROPN iajs-320 155 13 press press NOUN iajs-320 155 14 , , PUNCT iajs-320 155 15 the the DET iajs-320 155 16 acm acm PROPN iajs-320 155 17 digital digital PROPN iajs-320 155 18 library library NOUN iajs-320 155 19 , , PUNCT iajs-320 155 20 : : PUNCT iajs-320 155 21 120~128 120~128 NUM iajs-320 155 22 . . PUNCT iajs-320 156 1 3 3 X iajs-320 156 2 . . X iajs-320 156 3 mojtaba mojtaba PROPN iajs-320 156 4 eskandari eskandari ADJ iajs-320 156 5 , , PUNCT iajs-320 156 6 zeinab zeinab ADJ iajs-320 156 7 khorshidpour khorshidpour PROPN iajs-320 156 8 and and CCONJ iajs-320 156 9 sattar sattar PROPN iajs-320 156 10 hashemi(2013)”hdm hashemi(2013)”hdm NOUN iajs-320 156 11 - - PUNCT iajs-320 156 12 analyser analyser NOUN iajs-320 156 13 : : PUNCT iajs-320 156 14 a a DET iajs-320 156 15 hybrid hybrid ADJ iajs-320 156 16 analysis analysis NOUN iajs-320 156 17 approach approach NOUN iajs-320 156 18 based base VERB iajs-320 156 19 on on ADP iajs-320 156 20 data datum NOUN iajs-320 156 21 mining mining NOUN iajs-320 156 22 techniques technique NOUN iajs-320 156 23 for for ADP iajs-320 156 24 malware malware NOUN iajs-320 156 25 detection detection NOUN iajs-320 156 26 ” " PUNCT iajs-320 156 27 , , PUNCT iajs-320 156 28 j j PROPN iajs-320 156 29 comput comput PROPN iajs-320 156 30 virol virol PROPN iajs-320 156 31 hack hack NOUN iajs-320 156 32 tech tech NOUN iajs-320 156 33 , , PUNCT iajs-320 156 34 : : PUNCT iajs-320 156 35 9:77–93 9:77–93 X iajs-320 156 36 . . NOUN iajs-320 156 37 4 4 X iajs-320 156 38 . . X iajs-320 157 1 giovanni giovanni PROPN iajs-320 157 2 vigna(2007 vigna(2007 NOUN iajs-320 157 3 ) ) PUNCT iajs-320 157 4 ” " PUNCT iajs-320 157 5 static static ADJ iajs-320 157 6 disassembly disassembly NOUN iajs-320 157 7 and and CCONJ iajs-320 157 8 code code PROPN iajs-320 157 9 analysis”,springer analysis”,springer NOUN iajs-320 157 10 . . PUNCT iajs-320 158 1 5.saman 5.saman NUM iajs-320 158 2 mirza mirza PROPN iajs-320 158 3 abdulla1 abdulla1 PROPN iajs-320 158 4 , , PUNCT iajs-320 158 5 assoc assoc PROPN iajs-320 158 6 . . PUNCT iajs-320 158 7 prof prof PROPN iajs-320 158 8 . . PUNCT iajs-320 159 1 dr dr PROPN iajs-320 159 2 . . PROPN iajs-320 159 3 miss miss PROPN iajs-320 159 4 laiha laiha PROPN iajs-320 159 5 mat mat PROPN iajs-320 159 6 kiah kiah PROPN iajs-320 159 7 , , PUNCT iajs-320 159 8 and and CCONJ iajs-320 159 9 assoc assoc PROPN iajs-320 159 10 . . PUNCT iajs-320 160 1 prof prof PROPN iajs-320 160 2 . . PUNCT iajs-320 161 1 dr dr PROPN iajs-320 161 2 . . PROPN iajs-320 161 3 omar omar PROPN iajs-320 161 4 zakaria zakaria PROPN iajs-320 161 5 ( ( PUNCT iajs-320 161 6 2012)“minimizing 2012)“minimize VERB iajs-320 161 7 errors error NOUN iajs-320 161 8 in in ADP iajs-320 161 9 identifying identify VERB iajs-320 161 10 malicious malicious ADJ iajs-320 161 11 api api NOUN iajs-320 161 12 to to PART iajs-320 161 13 detect detect VERB iajs-320 161 14 pe pe ADP iajs-320 161 15 malwares malware NOUN iajs-320 161 16 using use VERB iajs-320 161 17 artificial artificial ADJ iajs-320 161 18 costimulation costimulation NOUN iajs-320 161 19 ” " PUNCT iajs-320 161 20 , , PUNCT iajs-320 161 21 international international ADJ iajs-320 161 22 conference conference NOUN iajs-320 161 23 on on ADP iajs-320 161 24 emerging emerge VERB iajs-320 161 25 trends trend NOUN iajs-320 161 26 in in ADP iajs-320 161 27 computer computer NOUN iajs-320 161 28 and and CCONJ iajs-320 161 29 electronics electronic NOUN iajs-320 161 30 engineering engineering NOUN iajs-320 161 31 , , PUNCT iajs-320 161 32 march march PROPN iajs-320 161 33 24 24 NUM iajs-320 161 34 - - PUNCT iajs-320 161 35 25dubai 25dubai NUM iajs-320 161 36 . . NOUN iajs-320 162 1 6 6 NUM iajs-320 162 2 . . X iajs-320 162 3 schultz schultz PROPN iajs-320 162 4 , , PUNCT iajs-320 162 5 m. m. NOUN iajs-320 162 6 g. g. PROPN iajs-320 162 7 , , PUNCT iajs-320 162 8 eskin eskin NOUN iajs-320 162 9 , , PUNCT iajs-320 162 10 e. e. PROPN iajs-320 162 11 , , PUNCT iajs-320 162 12 and and CCONJ iajs-320 162 13 stolfo stolfo PROPN iajs-320 162 14 , , PUNCT iajs-320 162 15 s. s. PROPN iajs-320 162 16 j.(2001 j.(2001 PROPN iajs-320 162 17 ) ) PUNCT iajs-320 162 18 ” " PUNCT iajs-320 162 19 data datum NOUN iajs-320 162 20 mining mining NOUN iajs-320 162 21 methods method NOUN iajs-320 162 22 for for ADP iajs-320 162 23 detection detection NOUN iajs-320 162 24 of of ADP iajs-320 162 25 new new ADJ iajs-320 162 26 malicious malicious ADJ iajs-320 162 27 executables executable NOUN iajs-320 162 28 , , PUNCT iajs-320 162 29 ” " PUNCT iajs-320 162 30 in in ADP iajs-320 162 31 proceedings proceeding NOUN iajs-320 162 32 of of ADP iajs-320 162 33 the the DET iajs-320 162 34 ieee ieee NOUN iajs-320 162 35 symp symp NOUN iajs-320 162 36 . . PUNCT iajs-320 163 1 on on ADP iajs-320 163 2 security security NOUN iajs-320 163 3 and and CCONJ iajs-320 163 4 privacy privacy NOUN iajs-320 163 5 , , PUNCT iajs-320 163 6 . . PUNCT iajs-320 164 1 38 38 NUM iajs-320 164 2 - - SYM iajs-320 164 3 49 49 NUM iajs-320 164 4 . . PUNCT iajs-320 165 1 7 7 X iajs-320 165 2 . . X iajs-320 165 3 cohen cohen PROPN iajs-320 165 4 , , PUNCT iajs-320 165 5 w.(1995 w.(1995 NOUN iajs-320 165 6 ) ) PUNCT iajs-320 165 7 “ " PUNCT iajs-320 165 8 fast fast ADJ iajs-320 165 9 effective effective ADJ iajs-320 165 10 rule rule NOUN iajs-320 165 11 induction induction NOUN iajs-320 165 12 , , PUNCT iajs-320 165 13 . . PUNCT iajs-320 165 14 ” " PUNCT iajs-320 166 1 proc proc NOUN iajs-320 166 2 . . PUNCT iajs-320 167 1 12th 12th ADJ iajs-320 167 2 international international ADJ iajs-320 167 3 conference conference NOUN iajs-320 167 4 on on ADP iajs-320 167 5 machine machine NOUN iajs-320 167 6 learning learning NOUN iajs-320 167 7 , , PUNCT iajs-320 167 8 115 115 NUM iajs-320 167 9 - - SYM iajs-320 167 10 23 23 NUM iajs-320 167 11 , , PUNCT iajs-320 167 12 san san PROPN iajs-320 167 13 francisco francisco PROPN iajs-320 167 14 , , PUNCT iajs-320 167 15 ca ca PROPN iajs-320 167 16 : : PUNCT iajs-320 167 17 morgan morgan PROPN iajs-320 167 18 kaufmann kaufmann PROPN iajs-320 167 19 publishers publisher NOUN iajs-320 167 20 . . PUNCT iajs-320 168 1 8.http://csminig.org/index.php/malicious-software-datasets-.html 8.http://csminig.org/index.php/malicious-software-datasets-.html X iajs-320 168 2 . . PUNCT iajs-320 169 1 9 9 NUM iajs-320 169 2 . . X iajs-320 169 3 mori mori PROPN iajs-320 169 4 akira akira PROPN iajs-320 169 5 ; ; PUNCT iajs-320 169 6 sawada sawada PROPN iajs-320 169 7 toshimi toshimi PROPN iajs-320 169 8 ; ; PUNCT iajs-320 169 9 izumida izumida PROPN iajs-320 169 10 tomonori tomonori PROPN iajs-320 169 11 and and CCONJ iajs-320 169 12 inoue inoue PROPN iajs-320 169 13 tadashi(2005)”detecting tadashi(2005)”detecte VERB iajs-320 169 14 unknown unknown ADJ iajs-320 169 15 computer computer NOUN iajs-320 169 16 viruses viruse VERB iajs-320 169 17 a a DET iajs-320 169 18 new new ADJ iajs-320 169 19 approach”,journal approach”,journal NOUN iajs-320 169 20 of of ADP iajs-320 169 21 the the DET iajs-320 169 22 national national PROPN iajs-320 169 23 institute institute PROPN iajs-320 169 24 of of ADP iajs-320 169 25 information information NOUN iajs-320 169 26 and and CCONJ iajs-320 169 27 communications communication NOUN iajs-320 169 28 technology technology NOUN iajs-320 169 29 .52 .52 NUM iajs-320 169 30 nos.1/2 nos.1/2 PROPN iajs-320 169 31 , , PUNCT iajs-320 169 32 75 75 NUM iajs-320 169 33 - - SYM iajs-320 169 34 88 88 NUM iajs-320 169 35 . . PUNCT iajs-320 170 1 10 10 NUM iajs-320 170 2 . . PUNCT iajs-320 171 1 shelly shelly PROPN iajs-320 171 2 xiaonan xiaonan PROPN iajs-320 172 1 wu wu PROPN iajs-320 173 1 * * PROPN iajs-320 173 2 and and CCONJ iajs-320 173 3 wolfgang wolfgang PROPN iajs-320 173 4 banzhaf(2010)”the banzhaf(2010)”the PROPN iajs-320 173 5 use use NOUN iajs-320 173 6 of of ADP iajs-320 173 7 computational computational ADJ iajs-320 173 8 intelligence intelligence NOUN iajs-320 173 9 in in ADP iajs-320 173 10 intrusion intrusion NOUN iajs-320 173 11 detection detection NOUN iajs-320 173 12 systems system NOUN iajs-320 173 13 : : PUNCT iajs-320 173 14 a a DET iajs-320 173 15 review review NOUN iajs-320 173 16 ” " PUNCT iajs-320 173 17 , , PUNCT iajs-320 173 18 applied apply VERB iajs-320 173 19 soft soft ADJ iajs-320 173 20 computing computing NOUN iajs-320 173 21 10 10 NUM iajs-320 173 22 : : PUNCT iajs-320 173 23 1–35 1–35 NUM iajs-320 173 24 . . PUNCT iajs-320 174 1 562 562 NUM iajs-320 174 2 | | ADV iajs-320 174 3 computer computer NOUN iajs-320 174 4 science science NOUN iajs-320 174 5 2014 2014 NUM iajs-320 174 6 ) ) PUNCT iajs-320 174 7 عام عام ADP iajs-320 174 8 3(العدد 3(العدد NUM iajs-320 174 9 27المجلد 27المجلد NUM iajs-320 174 10 مجلة مجلة VERB iajs-320 174 11 إبن إبن NOUN iajs-320 174 12 الھيثم الھيثم NOUN iajs-320 174 13 للعلوم للعلوم NOUN iajs-320 174 14 الصرفة الصرفة NOUN iajs-320 175 1 و و PRON iajs-320 175 2 التطبيقية التطبيقية ADJ iajs-320 175 3 ibn ibn PROPN iajs-320 175 4 al al PROPN iajs-320 175 5 - - PUNCT iajs-320 175 6 haitham haitham PROPN iajs-320 175 7 jour jour X iajs-320 175 8 . . PROPN iajs-320 175 9 for for ADP iajs-320 175 10 pure pure ADJ iajs-320 175 11 & & CCONJ iajs-320 175 12 appl appl PROPN iajs-320 175 13 . . PUNCT iajs-320 176 1 sci sci PROPN iajs-320 176 2 . . PUNCT iajs-320 176 3 vol vol NOUN iajs-320 176 4 . . PROPN iajs-320 177 1 27 27 NUM iajs-320 177 2 ( ( PUNCT iajs-320 177 3 3 3 NUM iajs-320 177 4 ) ) PUNCT iajs-320 177 5 2014 2014 NUM iajs-320 177 6 table table NOUN iajs-320 177 7 no no INTJ iajs-320 177 8 . . PUNCT iajs-320 178 1 ( ( PUNCT iajs-320 178 2 1 1 NUM iajs-320 178 3 ): ): PUNCT iajs-320 178 4 da da NOUN iajs-320 178 5 using use VERB iajs-320 178 6 4 4 NUM iajs-320 178 7 api api NOUN iajs-320 178 8 in in ADP iajs-320 178 9 each each DET iajs-320 178 10 vector vector NOUN iajs-320 178 11                                                                                                                                                                                                                                                                                                           SPACE iajs-320 178 12 classification classification NOUN iajs-320 178 13 results result NOUN iajs-320 178 14 4 4 NUM iajs-320 178 15 api api NOUN iajs-320 178 16 predicted predict VERB iajs-320 178 17 group group NOUN iajs-320 178 18 membership membership NOUN iajs-320 178 19 total total NOUN iajs-320 178 20 0 0 NUM iajs-320 178 21 1 1 NUM iajs-320 178 22 original original ADJ iajs-320 178 23 count count NOUN iajs-320 178 24 0 0 NUM iajs-320 178 25 519 519 NUM iajs-320 178 26 42 42 NUM iajs-320 178 27 561 561 NUM iajs-320 178 28 1 1 NUM iajs-320 178 29 168 168 NUM iajs-320 178 30 209 209 NUM iajs-320 178 31 377 377 NUM iajs-320 178 32 % % NOUN iajs-320 178 33 0 0 NUM iajs-320 178 34 92.5 92.5 NUM iajs-320 178 35 7.5 7.5 NUM iajs-320 178 36 100.0 100.0 NUM iajs-320 178 37 1 1 NUM iajs-320 178 38 44.6 44.6 NUM iajs-320 178 39 55.4 55.4 NUM iajs-320 178 40 100.0 100.0 NUM iajs-320 178 41 77.6 77.6 NUM iajs-320 178 42 % % NOUN iajs-320 178 43 of of ADP iajs-320 178 44 original original ADJ iajs-320 178 45 grouped group VERB iajs-320 178 46 cases case NOUN iajs-320 178 47 correctly correctly ADV iajs-320 178 48 classified classified ADJ iajs-320 178 49 . . PUNCT iajs-320 178 50     SPACE iajs-320 178 51 table table NOUN iajs-320 178 52 no no INTJ iajs-320 178 53 . . PUNCT iajs-320 179 1 ( ( PUNCT iajs-320 179 2 2 2 NUM iajs-320 179 3 ): ): PUNCT iajs-320 179 4 da da NOUN iajs-320 179 5 using use VERB iajs-320 179 6 5 5 NUM iajs-320 179 7 api api NOUN iajs-320 179 8 in in ADP iajs-320 179 9 ea ea PROPN iajs-320 179 10 vector vector NOUN iajs-320 179 11 . . PUNCT iajs-320 180 1 classification classification NOUN iajs-320 180 2 results result NOUN iajs-320 180 3 5 5 NUM iajs-320 180 4 api api NOUN iajs-320 180 5 predicted predict VERB iajs-320 180 6 group group NOUN iajs-320 180 7 membership membership NOUN iajs-320 180 8 total total NOUN iajs-320 180 9 0 0 NUM iajs-320 180 10 1 1 NUM iajs-320 180 11 original original ADJ iajs-320 180 12 count count NOUN iajs-320 180 13 0 0 NUM iajs-320 180 14 721 721 NUM iajs-320 180 15 46 46 NUM iajs-320 180 16 767 767 NUM iajs-320 180 17 1 1 NUM iajs-320 180 18 207 207 NUM iajs-320 180 19 244 244 NUM iajs-320 180 20 451 451 NUM iajs-320 180 21 % % NOUN iajs-320 180 22 0 0 NUM iajs-320 180 23 94.0 94.0 NUM iajs-320 180 24 6.0 6.0 NUM iajs-320 180 25 100.0 100.0 NUM iajs-320 180 26 1 1 NUM iajs-320 180 27 45.9 45.9 NUM iajs-320 180 28 54.1 54.1 NUM iajs-320 180 29 100.0 100.0 NUM iajs-320 180 30 79.2 79.2 NUM iajs-320 180 31 % % NOUN iajs-320 180 32 of of ADP iajs-320 180 33 original original ADJ iajs-320 180 34 grouped group VERB iajs-320 180 35 cases case NOUN iajs-320 180 36 correctly correctly ADV iajs-320 180 37 classified classified ADJ iajs-320 180 38 . . PUNCT iajs-320 180 39 table table NOUN iajs-320 180 40 no.(3):da no.(3):da PROPN iajs-320 180 41 using use VERB iajs-320 180 42 6 6 NUM iajs-320 180 43 api api NOUN iajs-320 180 44 in in ADP iajs-320 180 45 each each DET iajs-320 180 46 vector vector NOUN iajs-320 180 47 . . PUNCT iajs-320 181 1 classification classification NOUN iajs-320 181 2 results result VERB iajs-320 181 3 6 6 NUM iajs-320 181 4 api api NOUN iajs-320 181 5 predicted predict VERB iajs-320 181 6 group group NOUN iajs-320 181 7 membership membership NOUN iajs-320 181 8 total total NOUN iajs-320 181 9 0 0 NUM iajs-320 181 10 1 1 NUM iajs-320 181 11 original original ADJ iajs-320 181 12 count count NOUN iajs-320 181 13 0 0 NUM iajs-320 181 14 839 839 NUM iajs-320 181 15 56 56 NUM iajs-320 181 16 895 895 NUM iajs-320 181 17 1 1 NUM iajs-320 181 18 215 215 NUM iajs-320 181 19 300 300 NUM iajs-320 181 20 515 515 NUM iajs-320 181 21 % % NOUN iajs-320 181 22 0 0 NUM iajs-320 181 23 93.7 93.7 NUM iajs-320 181 24 6.3 6.3 NUM iajs-320 181 25 100.0 100.0 NUM iajs-320 181 26 1 1 NUM iajs-320 181 27 41.7 41.7 NUM iajs-320 181 28 58.3 58.3 NUM iajs-320 181 29 100.0 100.0 NUM iajs-320 181 30 80.8 80.8 NUM iajs-320 181 31 % % NOUN iajs-320 181 32 of of ADP iajs-320 181 33 original original ADJ iajs-320 181 34 grouped group VERB iajs-320 181 35 cases case NOUN iajs-320 181 36 correctly correctly ADV iajs-320 181 37 classified classified ADJ iajs-320 181 38 . . PUNCT iajs-320 182 1 563 563 NUM iajs-320 183 1 | | ADV iajs-320 183 2 computer computer NOUN iajs-320 183 3 science science NOUN iajs-320 183 4 2014 2014 NUM iajs-320 183 5 ) ) PUNCT iajs-320 183 6 عام عام ADP iajs-320 183 7 3(العدد 3(العدد NUM iajs-320 183 8 27المجلد 27المجلد NUM iajs-320 184 1 مجلة مجلة VERB iajs-320 184 2 إبن إبن NOUN iajs-320 184 3 الھيثم الھيثم NOUN iajs-320 184 4 للعلوم للعلوم NOUN iajs-320 184 5 الصرفة الصرفة NOUN iajs-320 185 1 و و PRON iajs-320 185 2 التطبيقية التطبيقية ADJ iajs-320 185 3 ibn ibn PROPN iajs-320 185 4 al al PROPN iajs-320 185 5 - - PUNCT iajs-320 185 6 haitham haitham PROPN iajs-320 185 7 jour jour X iajs-320 185 8 . . PROPN iajs-320 185 9 for for ADP iajs-320 185 10 pure pure ADJ iajs-320 185 11 & & CCONJ iajs-320 185 12 appl appl PROPN iajs-320 185 13 . . PUNCT iajs-320 186 1 sci sci PROPN iajs-320 186 2 . . PUNCT iajs-320 186 3 vol vol NOUN iajs-320 186 4 . . PROPN iajs-320 187 1 27 27 NUM iajs-320 187 2 ( ( PUNCT iajs-320 187 3 3 3 NUM iajs-320 187 4 ) ) PUNCT iajs-320 187 5 2014 2014 NUM iajs-320 187 6 table table NOUN iajs-320 187 7 no no INTJ iajs-320 187 8 . . PUNCT iajs-320 188 1 ( ( PUNCT iajs-320 188 2 5 5 NUM iajs-320 188 3 ): ): PUNCT iajs-320 188 4 da da NOUN iajs-320 188 5 using use VERB iajs-320 188 6 8 8 NUM iajs-320 188 7 api api NOUN iajs-320 188 8 in in ADP iajs-320 188 9 each each DET iajs-320 188 10 vector vector NOUN iajs-320 188 11 . . PUNCT iajs-320 189 1 yes yes INTJ iajs-320 190 1 no no INTJ iajs-320 191 1 yes yes INTJ iajs-320 191 2 no no DET iajs-320 191 3 figure figure NOUN iajs-320 191 4 no no INTJ iajs-320 191 5 . . PUNCT iajs-320 192 1 ( ( PUNCT iajs-320 192 2 1):research 1):research NUM iajs-320 192 3 scanning scan VERB iajs-320 192 4 framework framework NOUN iajs-320 192 5 classification classification NOUN iajs-320 192 6 results result NOUN iajs-320 192 7 8 8 NUM iajs-320 192 8 api api NOUN iajs-320 192 9 predicted predict VERB iajs-320 192 10 group group NOUN iajs-320 192 11 membership membership NOUN iajs-320 192 12 total total NOUN iajs-320 192 13 0 0 NUM iajs-320 192 14 1 1 NUM iajs-320 192 15 original original ADJ iajs-320 192 16 count count NOUN iajs-320 192 17 0 0 NUM iajs-320 192 18 956 956 NUM iajs-320 192 19 48 48 NUM iajs-320 192 20 1004 1004 NUM iajs-320 192 21 1 1 NUM iajs-320 192 22 231 231 NUM iajs-320 192 23 367 367 NUM iajs-320 192 24 598 598 NUM iajs-320 192 25 % % NOUN iajs-320 192 26 0 0 NUM iajs-320 192 27 95.2 95.2 NUM iajs-320 192 28 4.8 4.8 NUM iajs-320 192 29 100.0 100.0 NUM iajs-320 192 30 1 1 NUM iajs-320 192 31 38.6 38.6 NUM iajs-320 192 32 61.4 61.4 NUM iajs-320 192 33 100.0 100.0 NUM iajs-320 192 34 82.6 82.6 NUM iajs-320 192 35 % % NOUN iajs-320 192 36 of of ADP iajs-320 192 37 original original ADJ iajs-320 192 38 grouped group VERB iajs-320 192 39 cases case NOUN iajs-320 192 40 correctly correctly ADV iajs-320 192 41 classified classified ADJ iajs-320 192 42 . . PUNCT iajs-320 193 1 api api NOUN iajs-320 193 2 calls call VERB iajs-320 193 3 for for ADP iajs-320 193 4 suspected suspect VERB iajs-320 193 5 application application NOUN iajs-320 193 6 benign benign NOUN iajs-320 193 7 apply apply VERB iajs-320 193 8 neural neural ADJ iajs-320 193 9 network network NOUN iajs-320 193 10 for for ADP iajs-320 193 11 api api NOUN iajs-320 193 12 calls call NOUN iajs-320 193 13 application application NOUN iajs-320 193 14 apply apply VERB iajs-320 193 15 discriminant discriminant ADJ iajs-320 193 16 analysis analysis NOUN iajs-320 193 17 for for ADP iajs-320 193 18 api api NOUN iajs-320 193 19 calls call NOUN iajs-320 193 20 application application NOUN iajs-320 193 21 benignaccept benignaccept NOUN iajs-320 193 22 application application NOUN iajs-320 193 23 refuse refuse VERB iajs-320 193 24 application application NOUN iajs-320 193 25 564 564 NUM iajs-320 194 1 | | NOUN iajs-320 194 2 computer computer NOUN iajs-320 194 3 science science NOUN iajs-320 194 4 2014 2014 NUM iajs-320 194 5 ) ) PUNCT iajs-320 194 6 عام عام ADP iajs-320 194 7 3(العدد 3(العدد NUM iajs-320 194 8 27المجلد 27المجلد NUM iajs-320 194 9 مجلة مجلة VERB iajs-320 194 10 إبن إبن NOUN iajs-320 194 11 الھيثم الھيثم NOUN iajs-320 194 12 للعلوم للعلوم NOUN iajs-320 194 13 الصرفة الصرفة NOUN iajs-320 195 1 و و PRON iajs-320 195 2 التطبيقية التطبيقية ADJ iajs-320 195 3 ibn ibn PROPN iajs-320 195 4 al al PROPN iajs-320 195 5 - - PUNCT iajs-320 195 6 haitham haitham PROPN iajs-320 195 7 jour jour X iajs-320 195 8 . . PROPN iajs-320 195 9 for for ADP iajs-320 195 10 pure pure ADJ iajs-320 195 11 & & CCONJ iajs-320 195 12 appl appl PROPN iajs-320 195 13 . . PUNCT iajs-320 196 1 sci sci PROPN iajs-320 196 2 . . PUNCT iajs-320 196 3 vol vol NOUN iajs-320 196 4 . . PROPN iajs-320 197 1 27 27 NUM iajs-320 197 2 ( ( PUNCT iajs-320 197 3 3 3 NUM iajs-320 197 4 ) ) PUNCT iajs-320 197 5 2014 2014 NUM iajs-320 197 6                                                                                                                                                                                                                                                                         SPACE iajs-320 197 7 false false ADJ iajs-320 197 8     SPACE iajs-320 197 9 alarm alarm NOUN iajs-320 197 10 ( ( PUNCT iajs-320 197 11 fa fa NOUN iajs-320 197 12 ) ) PUNCT iajs-320 197 13 malware malware NOUN iajs-320 197 14 benign benign ADJ iajs-320 197 15 ( ( PUNCT iajs-320 197 16 false false ADJ iajs-320 197 17 negative negative NOUN iajs-320 197 18 ) ) PUNCT iajs-320 197 19 fn fn NOUN iajs-320 197 20 fp fp X iajs-320 197 21 ( ( PUNCT iajs-320 197 22 false false ADJ iajs-320 197 23 positive positive ADJ iajs-320 197 24 ) ) PUNCT iajs-320 197 25 figure figure NOUN iajs-320 197 26 no.(2):false no.(2):false PROPN iajs-320 197 27 alarm alarm NOUN iajs-320 197 28 , , PUNCT iajs-320 197 29 false false ADJ iajs-320 197 30 negative negative ADJ iajs-320 197 31 and and CCONJ iajs-320 197 32 false false ADJ iajs-320 197 33 positive positive ADJ iajs-320 197 34 . . PUNCT iajs-320 198 1 benign benign ADJ iajs-320 198 2 < < X iajs-320 198 3 = = X iajs-320 198 4 threshold1malware threshold1malware ADJ iajs-320 198 5 > > PUNCT iajs-320 198 6 = = SYM iajs-320 198 7 threshold2 threshold2 NOUN iajs-320 199 1 565 565 NUM iajs-320 199 2 | | NOUN iajs-320 199 3 computer computer NOUN iajs-320 199 4 science science NOUN iajs-320 199 5 2014 2014 NUM iajs-320 199 6 ) ) PUNCT iajs-320 199 7 عام عام ADP iajs-320 199 8 3(العدد 3(العدد NUM iajs-320 199 9 27المجلد 27المجلد NUM iajs-320 199 10 مجلة مجلة VERB iajs-320 199 11 إبن إبن NOUN iajs-320 199 12 الھيثم الھيثم NOUN iajs-320 199 13 للعلوم للعلوم NOUN iajs-320 199 14 الصرفة الصرفة NOUN iajs-320 200 1 و و PRON iajs-320 200 2 التطبيقية التطبيقية ADJ iajs-320 200 3 ibn ibn PROPN iajs-320 200 4 al al PROPN iajs-320 200 5 - - PUNCT iajs-320 200 6 haitham haitham PROPN iajs-320 200 7 jour jour X iajs-320 200 8 . . PROPN iajs-320 200 9 for for ADP iajs-320 200 10 pure pure ADJ iajs-320 200 11 & & CCONJ iajs-320 200 12 appl appl PROPN iajs-320 200 13 . . PUNCT iajs-320 201 1 sci sci PROPN iajs-320 201 2 . . PUNCT iajs-320 201 3 vol vol NOUN iajs-320 201 4 . . PROPN iajs-320 202 1 27 27 NUM iajs-320 202 2 ( ( PUNCT iajs-320 202 3 3 3 NUM iajs-320 202 4 ) ) PUNCT iajs-320 202 5 2014 2014 NUM iajs-320 202 6 كشفعند كشفعند NOUN iajs-320 202 7 الضارة الضارة NOUN iajs-320 202 8 برامجيات برامجيات PROPN iajs-320 202 9 التطبيقات التطبيقات PROPN iajs-320 202 10 واجھة واجھة PROPN iajs-320 202 11 تحديد تحديد VERB iajs-320 202 12 في في PRON iajs-320 203 1 تقليل تقليل PROPN iajs-320 203 2 التبليغات التبليغات PROPN iajs-320 203 3 الكاذبة الكاذبة PROPN iajs-320 203 4 التحليل التحليل PROPN iajs-320 203 5 المميز المميز PROPN iajs-320 204 1 مع مع PROPN iajs-320 204 2 الشبكات الشبكات PROPN iajs-320 204 3 العصبية العصبية PROPN iajs-320 204 4 عمالباست عمالباست NOUN iajs-320 204 5 البرمجيات البرمجيات PROPN iajs-320 204 6 الخبيثة الخبيثة PROPN iajs-320 204 7 البكريعباس البكريعباس VERB iajs-320 204 8 محسن محسن PROPN iajs-320 204 9 كلية كلية PROPN iajs-320 204 10 الرياضيات الرياضيات PROPN iajs-320 204 11 الحاسوب الحاسوب PROPN iajs-320 204 12 / / SYM iajs-320 204 13 جامعة جامعة PROPN iajs-320 204 14 الكوفة الكوفة PROPN iajs-320 204 15 حسين حسين PROPN iajs-320 204 16 لفتة لفتة VERB iajs-320 204 17 حسين حسين PROPN iajs-320 204 18 قسم قسم PROPN iajs-320 204 19 علوم علوم PROPN iajs-320 204 20 الحاسبات الحاسبات PROPN iajs-320 204 21 /كلية /كلية PROPN iajs-320 204 22 التربية التربية PROPN iajs-320 204 23 للعلوم للعلوم NOUN iajs-320 204 24 الصرفة الصرفة NOUN iajs-320 204 25 ( ( PUNCT iajs-320 204 26 ابن ابن X iajs-320 204 27 الھيثم الھيثم PROPN iajs-320 204 28 ) ) PUNCT iajs-320 204 29 / / SYM iajs-320 204 30 جامعة جامعة NOUN iajs-320 204 31 بغداد بغداد PROPN iajs-320 204 32 2014تشرين 2014تشرين PROPN iajs-320 204 33 الثاني الثاني PROPN iajs-320 204 34 24قبل 24قبل NOUN iajs-320 204 35 البحث البحث VERB iajs-320 204 36 في في ADP iajs-320 204 37 : : PUNCT iajs-320 204 38 2014ايلول 2014ايلول NUM iajs-320 204 39 7استلم 7استلم PROPN iajs-320 204 40 البحث البحث INTJ iajs-320 204 41 في في NOUN iajs-320 204 42 : : PUNCT iajs-320 204 43 الخالصة الخالصة PROPN iajs-320 204 44 برمجة برمجة NOUN iajs-320 204 45 بواسطة بواسطة VERB iajs-320 204 46 واجھات واجھات PROPN iajs-320 204 47 رصدھاووالتي رصدھاووالتي PROPN iajs-320 204 48 يتم يتم PROPN iajs-320 204 49 تحليلھا تحليلھا PROPN iajs-320 204 50 أنماط أنماط PROPN iajs-320 204 51 السلوك السلوك NOUN iajs-320 204 52 المعتمدة المعتمدة NOUN iajs-320 204 53 في في SCONJ iajs-320 204 54 أنظمة أنظمة PROPN iajs-320 204 55 الكشف الكشف PROPN iajs-320 204 56 دقة دقة NOUN iajs-320 204 57 يناقش يناقش NOUN iajs-320 204 58 ھذا ھذا NOUN iajs-320 204 59 البحث البحث ADV iajs-320 204 60 العملفي العملفي VERB iajs-320 204 61 ھذا ھذا VERB iajs-320 204 62 4744 4744 NUM iajs-320 204 63 ( ( PUNCT iajs-320 204 64 api api NOUN iajs-320 204 65 ) ) PUNCT iajs-320 204 66 تم تم VERB iajs-320 205 1 استخراج استخراج NOUN iajs-320 205 2 .الكشف .الكشف PROPN iajs-320 205 3 نماذج نماذج PROPN iajs-320 205 4 دقة دقة VERB iajs-320 205 5 تؤثر تؤثر INTJ iajs-320 206 1 في في INTJ iajs-320 206 2 المشكالت المشكالت ADJ iajs-320 206 3 التي التي PROPN iajs-320 206 4 يحدد يحدد PROPN iajs-320 206 5 العملھذا العملھذا PROPN iajs-320 206 6 ( ( PUNCT iajs-320 206 7 api api NOUN iajs-320 206 8 ) ) PUNCT iajs-320 206 9 .التطبيقات .التطبيقات NOUN iajs-320 206 10 تصل تصل NOUN iajs-320 206 11 إلى إلى NOUN iajs-320 206 12 البرمجيات البرمجيات NOUN iajs-320 206 13 الخبيثة الخبيثة NOUN iajs-320 206 14 في في PRON iajs-320 206 15 الخبيثة الخبيثة NOUN iajs-320 206 16 ) ) PUNCT iajs-320 206 17 apiكشف apiكشف INTJ iajs-320 206 18 ( ( PUNCT iajs-320 206 19 الدقة الدقة NOUN iajs-320 207 1 فيزيادة فيزيادة INTJ iajs-320 208 1 وتتضمن وتتضمن PROPN iajs-320 208 2 ھذه ھذه PROPN iajs-320 208 3 الطريقة الطريقة NOUN iajs-320 208 4 الجديدة الجديدة NOUN iajs-320 208 5 .تحليلال .تحليلال X iajs-320 208 6 عن عن PROPN iajs-320 208 7 طريق طريق NOUN iajs-320 208 8 .التمايز .التمايز INTJ iajs-320 208 9 تحليلطبقة تحليلطبقة PROPN iajs-320 208 10 تقويمھا تقويمھا NOUN iajs-320 208 11 باعتماد باعتماد VERB iajs-320 208 12 تم تم INTJ iajs-320 208 13 احتسابھا احتسابھا PROPN iajs-320 208 14 و و PRON iajs-320 208 15 نتائج نتائج PROPN iajs-320 208 16 ھذا ھذا VERB iajs-320 208 17 العملعلما العملعلما PROPN iajs-320 208 18 ان ان ADP iajs-320 208 19 .83.2 .83.2 PROPN iajs-320 208 20 ٪ ٪ PROPN iajs-320 208 21 pe pe PROPN iajs-320 208 22 malwares malware NOUN iajs-320 208 23 , , PUNCT iajs-320 208 24 mali mali ADJ iajs-320 208 25 cious cious ADJ iajs-320 208 26 api api NOUN iajs-320 208 27 , , PUNCT iajs-320 208 28 ann ann PROPN iajs-320 208 29 : : PUNCT iajs-320 208 30 الكلمات الكلمات VERB iajs-320 208 31 المفتاحية المفتاحية VERB