| Next revision | Previous revision |
| security:virustotal [2026/08/27 13:44] – Create security:virustotal: VirusTotal as a maliciousness oracle. Authored by Claude karel.kubicek.claude | security:virustotal [2026/09/17 08:12] (current) – Qualify root Security links; Authored by Claude karel.kubicek.claude |
|---|
| All counts are **papers**, from the 5,859-paper extraction (CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf, IEEE S&P, 2010–2026). 2025–2026 venue-years are provisional — see [[literature:corpus]]. Four records have no ''paper.cols.txt'' and count as negatives in every full-text probe. | All counts are **papers**, from the 5,859-paper extraction (CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf, IEEE S&P, 2010–2026). 2025–2026 venue-years are provisional — see [[literature:corpus]]. Four records have no ''paper.cols.txt'' and count as negatives in every full-text probe. |
| |
| The population is the union of ''tools[].name'', ''classification.resourceName'' and ''population.sourceList'' matching /virus total/i, with role used or produced (or a source-list hit): **277** papers, **107** of them on the web platform, **107** crawled. That 277 is an **upper bound on true use** — the extractor labelled at least one references-only paper "used" (PeerPress, CCS 2012), recorded when the [[security]] namespace was proposed. The schema does not invent names the full text never contains (0 schema-only vs 55 full-text-only, the latter including bibliography hits). | The population is the union of ''tools[].name'', ''classification.resourceName'' and ''population.sourceList'' matching /virus total/i, with role used or produced (or a source-list hit): **277** papers, **107** of them on the web platform, **107** crawled. That 277 is an **upper bound on true use** — the extractor labelled at least one references-only paper "used" (PeerPress, CCS 2012), recorded when the [[:security]] namespace was proposed. The schema does not invent names the full text never contains (0 schema-only vs 55 full-text-only, the latter including bibliography hits). |
| |
| **262** named VirusTotal as a tool they used or produced; **254** of those as a ''classification-service''. **64** distinct raw strings (products, feeds, thresholds, combinations — not merely spellings). **209** used it as a classifier. Do not substitute OVERVIEW.md's folded 239 / 4th-most-used-tool: that is a name-fold over ''tools[]'' only. | **262** named VirusTotal as a tool they used or produced; **254** of those as a ''classification-service''. **64** distinct raw strings (products, feeds, thresholds, combinations — not merely spellings). **209** used it as a classifier. Do not substitute OVERVIEW.md's folded 239 / 4th-most-used-tool: that is a name-fold over ''tools[]'' only. |
| ===== A script that makes the threshold visible ===== | ===== A script that makes the threshold visible ===== |
| |
| The following is real output of ''python3 vt_label.py --demo'', run 2026-08-27. Two runs are byte-identical. The fixture is a truncated URL object whose ''last_analysis_stats'' match the four engines it lists — it is not a live VirusTotal response. | The following is real output of ''python3 vt_label.py %%--demo%%'', run 2026-08-27. Two runs are byte-identical. The fixture is a truncated URL object whose ''last_analysis_stats'' match the four engines it lists — it is not a live VirusTotal response. |
| |
| <code> | <code> |
| </file> | </file> |
| |
| Point it at a real ''GET /api/v3/urls/...'' (or files / domains / ip_addresses) JSON. File and URL objects print ''first_submission_date''; domain and IP objects do not have that attribute, so the script omits the line rather than inventing a date. It fails with ''KeyError'' if ''last_analysis_stats'' is missing, and with ''ValueError'' if that dict carries a key outside the documented URL+file set, or if a file object is missing ''confirmed-timeout'' / ''failure'' / ''type-unsupported''. Extra file keys count toward ''total''. ''--threshold N'' adds one more row and rejects ''N < 1''. | Point it at a real ''GET /api/v3/urls/...'' (or files / domains / ip_addresses) JSON. File and URL objects print ''first_submission_date''; domain and IP objects do not have that attribute, so the script omits the line rather than inventing a date. It fails with ''KeyError'' if ''last_analysis_stats'' is missing, and with ''ValueError'' if that dict carries a key outside the documented URL+file set, or if a file object is missing ''confirmed-timeout'' / ''failure'' / ''type-unsupported''. Extra file keys count toward ''total''. ''%%--threshold%% N'' adds one more row and rejects ''N < 1''. |
| |
| ===== Papers to read first ===== | ===== Papers to read first ===== |
| ===== Related pages ===== | ===== Related pages ===== |
| |
| * [[security]] — namespace outline. | * [[:security]] — namespace outline. |
| * [[design:website_classification]] — topic labels, including VirusTotal ''categories''. | * [[design:website_classification]] — topic labels, including VirusTotal ''categories''. |
| * [[security:phishing]] — feeds (PhishTank, OpenPhish, Google Safe Browsing). Not yet written. | * [[security:phishing]] — feeds (PhishTank, OpenPhish, Google Safe Browsing). Not yet written. |
