VirusSign data have supported published malware research at USENIX ATC and NDSS, and in journals including Computer Networks and Expert Systems with Applications.
Author affiliations: University of Essex.
The authors acquired 2,000 malware samples from VirusSign for a dataset used to study feature rescaling and malware clustering.
Source location: Section 5.1, Data set 1; PDF page 7. Author manuscript.
Author affiliations: University of Illinois Urbana-Champaign; NEC Laboratories America; University of Texas at Dallas.
VirusSign was one of the malware sample sources used to generate provenance data for stealthy-malware research.
Source location: Evaluation dataset description; PDF page 8. Author-hosted paper.
Author affiliations: University of South Carolina; National Chiao Tung University.
The evaluation used 38,789 malware samples collected from VirusSign in 2014 to study combinations of malware scanners.
Source location: Section 9.1 and Table 3; PDF pages 10–11. University-hosted paper.
Author affiliations: Columbia University; Princeton University; NEC Laboratories America.
Table II identifies VirusSign as the source of the 12,657-sample Train-1 dataset used in the study of process-associated DNS activity.
Source location: Table II and Section V-B; PDF page 8. Conference proceedings.
Author affiliations: Princeton University; Case Western Reserve University; NEC Laboratories America; Nanjing University.
The researchers selected five malware samples from a free VirusSign dataset and used their accompanying behavior reports to construct attack-investigation queries.
Source location: Section 6.3.1 and Table 4; PDF page 10. Conference proceedings.
These references document the use of VirusSign data in specific studies. They do not imply institutional endorsement or validation of the current VirusSign TI API. Affiliations are those listed in the papers.
The Malware Knowledge Base, hosted by NCHC and TWCSIRT, identifies VirusSign as a source of malware data used in its analysis.
Source location: About page, About Malware Knowledge Base and About Partner sections.
Read public statement ↗Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.
