133 citations · 200 across the 6 of their papers we have counts for
6 papers · 1 filter
Automatic Yara Rule Generation Using Biclustering
Edward Raff, Richard Zak, Gary Lopez Munoz +5
Yara rules are a ubiquitous tool among cybersecurity practitioners and analysts. Developing high-quality Yara rules to detect a malware family of interest can be labor- and time-in…
A Survey of Machine Learning Methods and Challenges for Windows Malware Classification
Edward Raff, Charles Nicholas
Malware classification is a difficult problem, to which machine learning methods have been applied for decades. Yet progress has often been slow, in part due to a number of unique…
A New Burrows Wheeler Transform Markov Distance
Edward Raff, Charles Nicholas, Mark McLean
Prior work inspired by compression algorithms has described how the Burrows Wheeler Transform can be used to create a distance measure for bioinformatics problems. We describe issu…
KiloGrams: Very Large N-Grams for Malware Classification
Edward Raff, William Fleming, Richard Zak +4
N-grams have been a common tool for information retrieval and machine learning applications for decades. In nearly all previous works, only a few values of are tested, with $n…
Static Malware Detection & Subterfuge: Quantifying the Robustness of Machine Learning and Current Anti-Virus
William Fleshman, Edward Raff, Richard Zak +2
As machine-learning (ML) based systems for malware detection become more prevalent, it becomes necessary to quantify the benefits compared to the more traditional anti-virus (AV) s…
Lempel-Ziv Jaccard Distance, an Effective Alternative to Ssdeep and Sdhash
Edward Raff, Charles K. Nicholas
Recent work has proposed the Lempel-Ziv Jaccard Distance (LZJD) as a method to measure the similarity between binary byte sequences for malware classification. We propose and test…