133 citations · 292 across the 10 of their papers we have counts for
13 papers
A Framework for Cluster and Classifier Evaluation in the Absence of Reference Labels
Robert J. Joyce, Edward Raff, Charles Nicholas
In some problem spaces, the high cost of obtaining ground truth labels necessitates use of lower quality reference datasets. It is difficult to benchmark model performance using th…
Leveraging Uncertainty for Improved Static Malware Detection Under Extreme False Positive Constraints
Andre T. Nguyen, Edward Raff, Charles Nicholas +1
The detection of malware is a critical task for the protection of computing environments. This task often requires extremely low false positive rates (FPR) of 0.01% or even lower,…
Automatic Yara Rule Generation Using Biclustering
Edward Raff, Richard Zak, Gary Lopez Munoz +5
Yara rules are a ubiquitous tool among cybersecurity practitioners and analysts. Developing high-quality Yara rules to detect a malware family of interest can be labor- and time-in…
COVID-19 Kaggle Literature Organization
Maksim Ekin Eren, Nick Solovyev, Edward Raff +2
The world has faced the devastating outbreak of Severe Acute Respiratory Syndrome Coronavirus-2 (SARS-CoV-2), or COVID-19, in 2020. Research in the subject matter was fast-tracked…
A Survey of Machine Learning Methods and Challenges for Windows Malware Classification
Edward Raff, Charles Nicholas
Malware classification is a difficult problem, to which machine learning methods have been applied for decades. Yet progress has often been slow, in part due to a number of unique…
A New Burrows Wheeler Transform Markov Distance
Edward Raff, Charles Nicholas, Mark McLean
Prior work inspired by compression algorithms has described how the Burrows Wheeler Transform can be used to create a distance measure for bioinformatics problems. We describe issu…
KiloGrams: Very Large N-Grams for Malware Classification
Edward Raff, William Fleming, Richard Zak +4
N-grams have been a common tool for information retrieval and machine learning applications for decades. In nearly all previous works, only a few values of are tested, with $n…
Static Malware Detection & Subterfuge: Quantifying the Robustness of Machine Learning and Current Anti-Virus
William Fleshman, Edward Raff, Richard Zak +2
As machine-learning (ML) based systems for malware detection become more prevalent, it becomes necessary to quantify the benefits compared to the more traditional anti-virus (AV) s…
Engineering a Simplified 0-Bit Consistent Weighted Sampling
Edward Raff, Jared Sylvester, Charles Nicholas
The Min-Hashing approach to sketching has become an important tool in data analysis, information retrial, and classification. To apply it to real-valued datasets, the ICWS algorith…
Toward Metric Indexes for Incremental Insertion and Querying
Edward Raff, Charles Nicholas
In this work we explore the use of metric index structures, which accelerate nearest neighbor queries, in the scenario where we need to interleave insertions and queries during dep…
Malware Detection by Eating a Whole EXE
Edward Raff, Jon Barker, Jared Sylvester +3
In this work we introduce malware detection from raw byte sequences as a fruitful research area to the larger machine learning community. Building a neural network for such a probl…
Learning the PE Header, Malware Detection with Minimal Domain Knowledge
Edward Raff, Jared Sylvester, Charles Nicholas
Many efforts have been made to use various forms of domain knowledge in malware detection. Currently there exist two common approaches to malware detection without domain knowledge…
Lempel-Ziv Jaccard Distance, an Effective Alternative to Ssdeep and Sdhash
Edward Raff, Charles K. Nicholas
Recent work has proposed the Lempel-Ziv Jaccard Distance (LZJD) as a method to measure the similarity between binary byte sequences for malware classification. We propose and test…