24 citations · 24 across the 15 of their papers we have counts for
17 papers
KNN Implementation Details Can Dramatically Change Performance: An Example from Cover Trees
Amol Khanna, Edward Raff
Nearest neighbor search algorithms are widely used and have a long history, but we find that key implementation details are seldom reviewed in articles about them. These details ca…
Fast And Accurate Text Content File Type Identification
Manu Nandan, Michael Brautbar, Edward Raff
A common requirement across organizations is to have a tool that can identify file types based on their contents, particularly in the cybersecurity domain where magic numbers and f…
Identifying Security Platform Product Abuse with Machine Learning
Shaefer Drew, Michael Brautbar, Paul Knight +6
Product abuse is an individually rare, but growing, problem across the SaaS industry. Highly sophisticated threat actors can misuse security platforms within customer environments…
When LLM Decompilers Recompile More and Preserve Less
Chang Liu, Edward Raff, Kristopher Micinski
Decompilation recovers high-level source from compiled machine code and serves as a foundation for security tasks such as vulnerability detection and malware analysis. Traditional…
Why Is SHAP Not a Reliable Standalone Explanation Framework for Malware Detection?
Seyedreza Mohseni, Edward Raff, Manas Gaur
Machine learning is widely used for malware detection, but its decisions must be explained. An analyst needs to know whether a model has learned genuine malicious behavior or only…
Cybersecurity Detection Classification with Reasoning-enabled Language Models
Amol Khanna, Manu Nandan, Cristian Viorel Popa +10
A major issue in Security Operations Centers (SOCs) is alert fatigue, as the number of detections reported is more than staff can triage in a given day. Prior work prompts or fine-…
Hamm-Grams: An Algorithm for Mining Regular Expressions of Bytes
Derek Everett, Edward Raff, James Holt
Malware poses a critical and ever-evolving threat, and robust and effective systems for detecting and classifying malware are of essential importance. -grams features are among…
Large Byte Model: Teaching Language Models About Compiled Code
Florian Störtz, Catalin-Andrei Stan, Alexandru Dinu +4
Malware analysis starts with the raw bytes of an executable program, and tools to "lift" these to higher-level representations, such as assembly, are expensive and subject to error…
ASSEMBLAGE-DEEPHISTORY: A Cross-Build Binary Dataset with Temporal Coverage
Chang Liu, Noah Fleischmann, Nicolò Altamura +3
Existing binary corpora typically capture only one or two axes of binary variation: they either provide cross-compiler builds without a temporal axis, or CVE labels for single-buil…
McNdroid: A Longitudinal Multimodal Benchmark for Robust Drift Detection in Android Malware
Md Mahmuduzzaman Kamol, Jesus Lopez, Saeefa Rubaiyet Nowmi +5
Machine learning (ML) in real-world systems must contend with concept drift, adversarial actors, and a spectrum of potential features with varying costs and benefits. Malware natur…
A Vector Symbolic Approach to Multiple Instance Learning
Ehsan Ahmed Dhrubo, Mohammad Mahmudul Alam, Edward Raff +2
Multiple Instance Learning (MIL) tasks impose a strict logical constraint: a bag is labeled positive if and only if at least one instance within it is positive. While this iff cons…
Intermediate N-Gramming: Deterministic and Fast N-Grams For Large N and Large Datasets
Ryan R. Curtin, Fred Lu, Edward Raff +1
The number of n-gram features grows exponentially in n, making it computationally demanding to compute the most frequent n-grams even for n as small as 3. Motivated by our producti…
Zipf-Gramming: Scaling Byte N-Grams Up to Production Sized Malware Corpora
Edward Raff, Ryan R. Curtin, Derek Everett +2
A classifier using byte n-grams as features is the only approach we have found fast enough to meet requirements in size (sub 2 MB), speed (multiple GB/s), and latency (sub 10 ms) f…
EMBER2024 -- A Benchmark Dataset for Holistic Evaluation of Malware Classifiers
Robert J. Joyce, Gideon Miller, Phil Roth +5
A lack of accessible data has historically restricted malware analysis research, and practitioners have relied heavily on datasets provided by industry sources to advance. Existing…
Quick-Draw Bandits: Quickly Optimizing in Nonstationary Environments with Extremely Many Arms
Derek Everett, Fred Lu, Edward Raff +2
Canonical algorithms for multi-armed bandits typically assume a stationary reward environment where the size of the action space (number of arms) is small. More recently developed…
Disassembly as Weighted Interval Scheduling with Learned Weights
Antonio Flores-Montoya, Junghee Lim, Adam Seitz +3
Disassembly is the first step of a variety of binary analysis and transformation techniques, such as reverse engineering, or binary rewriting. Recent disassembly approaches consist…
SoK: A Review of Differentially Private Linear Models For High-Dimensional Data
Amol Khanna, Edward Raff, Nathan Inkawhich
Linear models are ubiquitous in data science, but are particularly prone to overfitting and data memorization in high dimensions. To guarantee the privacy of training data, differe…