9 papers
Hamm-Grams: An Algorithm for Mining Regular Expressions of Bytes
Derek Everett, Edward Raff, James Holt
Malware poses a critical and ever-evolving threat, and robust and effective systems for detecting and classifying malware are of essential importance. -grams features are among…
ASSEMBLAGE-DEEPHISTORY: A Cross-Build Binary Dataset with Temporal Coverage
Chang Liu, Noah Fleischmann, Nicolò Altamura +3
Existing binary corpora typically capture only one or two axes of binary variation: they either provide cross-compiler builds without a temporal axis, or CVE labels for single-buil…
A Vector Symbolic Approach to Multiple Instance Learning
Ehsan Ahmed Dhrubo, Mohammad Mahmudul Alam, Edward Raff +2
Multiple Instance Learning (MIL) tasks impose a strict logical constraint: a bag is labeled positive if and only if at least one instance within it is positive. While this iff cons…
Zipf-Gramming: Scaling Byte N-Grams Up to Production Sized Malware Corpora
Edward Raff, Ryan R. Curtin, Derek Everett +2
A classifier using byte n-grams as features is the only approach we have found fast enough to meet requirements in size (sub 2 MB), speed (multiple GB/s), and latency (sub 10 ms) f…
EMBER2024 -- A Benchmark Dataset for Holistic Evaluation of Malware Classifiers
Robert J. Joyce, Gideon Miller, Phil Roth +5
A lack of accessible data has historically restricted malware analysis research, and practitioners have relied heavily on datasets provided by industry sources to advance. Existing…
Quick-Draw Bandits: Quickly Optimizing in Nonstationary Environments with Extremely Many Arms
Derek Everett, Fred Lu, Edward Raff +2
Canonical algorithms for multi-armed bandits typically assume a stationary reward environment where the size of the action space (number of arms) is small. More recently developed…