24 citations · 24 across the 15 of their papers we have counts for
10 papers · 1 filter
KNN Implementation Details Can Dramatically Change Performance: An Example from Cover Trees
Amol Khanna, Edward Raff
Nearest neighbor search algorithms are widely used and have a long history, but we find that key implementation details are seldom reviewed in articles about them. These details ca…
Fast And Accurate Text Content File Type Identification
Manu Nandan, Michael Brautbar, Edward Raff
A common requirement across organizations is to have a tool that can identify file types based on their contents, particularly in the cybersecurity domain where magic numbers and f…
Identifying Security Platform Product Abuse with Machine Learning
Shaefer Drew, Michael Brautbar, Paul Knight +6
Product abuse is an individually rare, but growing, problem across the SaaS industry. Highly sophisticated threat actors can misuse security platforms within customer environments…
When LLM Decompilers Recompile More and Preserve Less
Chang Liu, Edward Raff, Kristopher Micinski
Decompilation recovers high-level source from compiled machine code and serves as a foundation for security tasks such as vulnerability detection and malware analysis. Traditional…
Why Is SHAP Not a Reliable Standalone Explanation Framework for Malware Detection?
Seyedreza Mohseni, Edward Raff, Manas Gaur
Machine learning is widely used for malware detection, but its decisions must be explained. An analyst needs to know whether a model has learned genuine malicious behavior or only…
Cybersecurity Detection Classification with Reasoning-enabled Language Models
Amol Khanna, Manu Nandan, Cristian Viorel Popa +10
A major issue in Security Operations Centers (SOCs) is alert fatigue, as the number of detections reported is more than staff can triage in a given day. Prior work prompts or fine-…
Hamm-Grams: An Algorithm for Mining Regular Expressions of Bytes
Derek Everett, Edward Raff, James Holt
Malware poses a critical and ever-evolving threat, and robust and effective systems for detecting and classifying malware are of essential importance. -grams features are among…
Large Byte Model: Teaching Language Models About Compiled Code
Florian Störtz, Catalin-Andrei Stan, Alexandru Dinu +4
Malware analysis starts with the raw bytes of an executable program, and tools to "lift" these to higher-level representations, such as assembly, are expensive and subject to error…
ASSEMBLAGE-DEEPHISTORY: A Cross-Build Binary Dataset with Temporal Coverage
Chang Liu, Noah Fleischmann, Nicolò Altamura +3
Existing binary corpora typically capture only one or two axes of binary variation: they either provide cross-compiler builds without a temporal axis, or CVE labels for single-buil…
McNdroid: A Longitudinal Multimodal Benchmark for Robust Drift Detection in Android Malware
Md Mahmuduzzaman Kamol, Jesus Lopez, Saeefa Rubaiyet Nowmi +5
Machine learning (ML) in real-world systems must contend with concept drift, adversarial actors, and a spectrum of potential features with varying costs and benefits. Malware natur…