Pith. sign in

REVIEW 4 major objections 4 minor 45 references

Zero Day Malware Detection with Alpha: Fast DBI with Transformer Models for Real World Application

T0 review · 4 major / 4 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Alpha classifies previously unseen ransomware, worms, and APTs with perfect accuracy using one minute of dynamic assembly-language execution traces.

desk verdict Alpha has a useful multi-type ASM dataset and a plausible fast-detection idea, but the perfect zero-day scores are produced by components fitted on the test set and by a Layer 1 overlap classifier, so the central claim is not supported as written. read the letter →

arxiv 2504.14886 v1 pith:VPTICRER submitted 2025-04-21 cs.CR

Matthew Gaber , Mohiuddin Ahmed , Helge Janicke This is my paper · ORCID
classification cs.CR
keywords dynamicbinaryinstrumentationmalwareanalysisfeatureextractionransomwaretransformersLLMAIAssembly
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that a framework called Alpha can classify malware it has never seen before—zero-day samples—by reading one minute of a program's assembly-language instructions captured while it runs. The authors argue that dynamic binary instrumentation defeats evasion and that the captured instruction stream, treated like natural language, carries enough signal for a Transformer model. Alpha removes every function from a test sample that appeared in training, so the remaining functions are supposedly novel, and then classifies the sample through a three-layer pipeline of two SVMs around a fine-tuned DistilBERT model. If the claim holds, endpoint defenses could flag new ransomware, worms, and advanced persistent threats in about a minute without waiting for signatures. The authors report perfect accuracy for Ransomware, Worms, and APTs, and above 96% for Trojans, Spyware, Botnets, and Tools.

What carries the argument

The central object is the 'function-loss' classification pipeline built on normalized assembly functions. Assembly instructions are concatenated with their operands, hexadecimal addresses are replaced by the placeholder memoryaddress, each function becomes a sentence, and custom WordPiece tokenizers map them for DistilBERT, a compact version of the BERT Transformer language model. A first SVM classifies a sample from the counts of removed functions that matched malicious versus benign training entries; only uncertain samples reach the Transformer, whose per-function predictions feed a final SVM that thresholds the malicious percentage. Zipf's law, a power-law frequency distribution common in natural language, is the stated reason Transformers should work on this material.

What would settle it

Re-run Alpha on the same one-minute traces with Layer 1 bypassed and report accuracy only for samples whose functions have zero overlap with the training corpus; if accuracy drops far below 100% on ransomware, worms, and APTs, the perfect scores are explained by the overlap signal rather than by the Transformer's ability to classify novel functions.

Watch

Extended reading notes

Core claim

On its own terms, the paper's central discovery is that a Transformer trained on normalized assembly instructions from a dynamic binary instrumentation tool can separate malicious from benign samples even after all functions shared with the training set are stripped away. Alpha's Layer 1 counts how many stripped functions were labeled malicious versus benign in training and lets an SVM decide with high confidence; the paper reports that this layer resolves most samples—68 of 88 ransomware and 10 of 14 APT samples—while uncertain samples pass to a DistilBERT model fine-tuned per malware type, and a final SVM thresholds the proportion of functions judged malicious. With one-minute slices of execution data, the paper reports 100% accuracy, precision, recall, and F1 for ransomware, worms, and APTs, with high but imperfect scores elsewhere. The paper reads this as evidence that the model generalizes to genuinely new instruction combinations rather than memorizing training functions.

Load-bearing premise

The zero-day claim rests on treating functions that reappear from the training set as a legitimate detection signal: most perfect ransomware and APT results come from Layer 1 counting those overlaps, and if overlapping known functions does not count as detecting novel malware, the headline results collapse to a much smaller flagged subset.

Editorial extensions

If this is right

  • A one-minute dynamic trace can replace the 10–15 minute runs used to build the dataset, making quick endpoint-style detection plausible.
  • Samples whose functions overlap with known malware can be flagged almost immediately by Layer 1, requiring no Transformer inference.
  • The reported perfect scores are specific to malware types that reuse functions across samples, while Trojans and Spyware still produce false positives and false negatives.
  • Because none of the ransomware samples in the test set encrypted within the first three minutes of execution, early detection would in principle precede the main damage.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The perfect ransomware, worm, and APT scores are driven largely by Layer 1 (68 of 88 ransomware and 10 of 14 APT samples), meaning the decisive signal for most samples is reuse of functions already seen in training rather than DistilBERT's judgment of novel code.
  • A trivial baseline that classifies by the ratio of matched malicious-to-benign functions would likely capture much of this signal; adding such a baseline would isolate the Transformer's contribution to genuinely novel functions.
  • The current evaluation already uses disjoint families in training and testing, but function overlap across families means sample novelty is not the same as function novelty; reporting results only on samples with zero overlapping functions would test the strongest zero-day claim.
  • A unified binary classifier without a known malware type, flagged as future work, would remove the per-type models' strong prior and is likely to reduce the reported scores.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The manuscript proposes Alpha, a three-layer malware detector that operates on Assembly-language function traces collected by the Peekaboo DBI tool. Layer 1 counts how many functions of a test sample match malicious/benign functions in the training set and uses an SVM to classify high-confidence samples; Layer 2 fine-tunes per-malware-type DistilBERT models to classify filtered 'novel' functions; Layer 3 applies an SVM to the fraction of functions labeled malicious. Experiments A, B, and C evaluate the full traces, one-minute slices, and the complete Alpha pipeline, respectively. The paper reports perfect accuracy for Ransomware, Worms, and APTs and high accuracy for other families, claiming zero-day detection by removing any test functions seen in training.

Significance. If the results held, the contribution would be significant: combining dynamically instrumented ASM traces with a Transformer model to classify novel malware within one minute, and releasing code and models, would advance zero-day endpoint detection. The paper also usefully extends the authors' prior Pulse work to multiple malware families and analyzes per-minute instruction density. However, the reported metrics are compromised by test-set usage in several places, and the zero-day claim conflates re-identification of known functions with generalization to novel ones. The strength of the contribution therefore depends entirely on a corrected evaluation.

major comments (4)
  1. [Section 5.2, Layer 3 SVM] The Layer 3 final classification SVM is stated to 'train on a the test samples with two features: Functions and Malicious %'. This SVM is used in Experiment A and again as Layer 3 in Experiment C and Algorithm 1, so the reported accuracy, precision, recall, and F1 for every family are in-sample numbers. A decision boundary fitted to the test samples cannot support claims of generalization to zero-day samples. The SVM must be fitted only on training data, or on a validation split, and then applied to a genuinely held-out test set.
  2. [Section 5.4, Algorithm 1] The Layer 1 thresholds are 'quartile-based metrics derived from the benign and malicious classifications'; because no validation split is described, these thresholds appear to be derived from the test samples themselves. Table 13 shows that Layer 1 decides most of the samples that produce the perfect scores (68/88 ransomware, 21/26 worms, 10/14 APT). Thresholds chosen from test-set distances make the reported 100% accuracy circular and must be set on training/validation data before evaluating the test set.
  3. [Section 5.3, Table 11] Maze ransomware is used to select the one-minute slice, and after observing that minute 3 is the only minute with 100% accuracy, the paper uses minute 3 for all families in Experiment C. Selecting the time slice based on its test-set performance invalidates the subsequent Table 13 results as unbiased estimates. The choice of 'minute 2 to 3' in Experiment C versus 'minute 3' in Experiment B also needs clarification. A pre-registered slice choice based on training/validation data is required.
  4. [Section 4 / Algorithm 1 / Table 13] The central zero-day claim is not supported by the architecture as presented. The paper removes functions seen in training so that DistilBERT sees only novel functions, but Layer 1 classifies samples by counting functions that match the training set. Table 13 and Algorithm 1 show that for the families with perfect accuracy most malicious samples are resolved by Layer 1 (Ransomware 68/88, Worms 21/26, APT 10/14). This is overlap-based classification, not detection of 'truly new' functions. The authors should either restrict the zero-day claim to samples classified by Layers 2/3 after removing all overlapping functions, or report Layer 1 and Layer 2/3 results separately.
minor comments (4)
  1. [Section 5.3 vs. Section 5.4] Experiment B states that minute 3 is used, while Experiment C refers to 'a 1 minute data slice from minute 2 to 3'; the exact time interval needs to be specified consistently.
  2. [Section 6] The text claims that Alpha achieves 'perfect scores for Ransomware, Worms, APT, and Tools', but Table 13 reports Tools accuracy as 98.67% with one false positive; the discrepancy should be corrected.
  3. [Throughout] There are several typos that should be fixed in revision: 'Trasnformer' in Section 4, 'availabel' in Section 2, 'insturuction' in Section 6, 'a the test samples' in Section 5.2, 'Spetember' in reference [4], and 'independant' in reference [5].
  4. [Table 13] The column headers L3 TP/FN/FP/TN cover only flagged samples; the table should clarify how the Layer 1 counts are aggregated into the reported accuracy, precision, recall, and F1 columns.

Circularity Check

3 steps flagged · score 7.0 of 10

Alpha's perfect zero-day scores for Ransomware, Worms and APT are substantially produced by classifiers fitted to the test set (Layer 3 SVM trained on test samples; Layer 1 thresholds from test quartiles) or by Layer 1 counts of training-overlap functions, so the central 'truly new' claim is not established.

  1. fitted input called prediction [Section 5.2 (Experiment A, Layer 3 Final Classification SVM); Algorithm 1 Layer 3]
    "This SVM classifier distinguishes between two classes: Malware and Benign samples. The classifier uses a linear kernel and equal class weights to train on a the test samples with two features: Functions and Malicious % . After training, it calculates the decision boundary, which is represented as a hyperplane that separates the two classes. Algorithm 1 also says: Use BERT predictions P for S to create feature set F S, representing the malicious percentage. Fit SVM hyperplane H to F S and predict the class label for S."

    The final classification SVM is fitted to the exact test samples whose labels it then reports. The features it uses (Functions and Malicious %) are computed from DistilBERT predictions on those same samples, and Algorithm 1 explicitly says to fit the SVM hyperplane to the test sample's feature set before predicting that sample. Thus the accuracy, precision and recall for every Layer 3 decision, including the L3 rows of Table 13, are in-sample evaluations of a classifier trained on the evaluation data, not out-of-sample predictions of novel samples.

  2. fitted input called prediction [Section 5.4 (Experiment C, Layer 1 confidence thresholds)]
    "The upper and lower thresholds are determined using quartile-based metrics derived from the benign and malicious classifications. Specifically, if a sample's distance from the decision boundary exceeds the first quartile (Q1) for its predicted class, it is considered classified with high confidence. Conversely, if the sample's distance falls within the first quartile, it is flagged for further testing using the DistilBERT model."

    The Layer 1 confidence thresholds (Q1) are computed from the classification distances of the very test samples being evaluated. These thresholds determine whether a sample is resolved as a correct Layer 1 prediction or is passed to DistilBERT, and the final metrics in Table 13 count the resolved samples. Fitting the confidence cutoffs to the test distribution makes the high-confidence subset and its perfect scores in-sample by construction.

1 more flagged steps
  1. self definitional [Section 4 (Layer 1 Function Loss SVM); Table 13; Algorithm 1]
    "Each function in every benign and malware test sample is checked against the training dataset. Functions labeled as malicious or benign in the training set are removed from the test sample. ... The functions that were removed from a sample because they were in the training dataset, and their labels, that is benign or malicious are evaluated by a SVM, which classifies the sample based on the ratio of malicious functions to benign functions removed during filtering."

    The paper defines its zero-day protocol as forcing classification of only 'truly new' functions by removing every function seen in training. Layer 1 then classifies the sample from the count and labels of exactly those removed, training-overlap functions. Table 13 shows Layer 1 resolves 68/88 Ransomware, 21/26 Worm and 10/14 APT malicious samples before DistilBERT sees any novel function. For these families the headline perfect scores are largely a re-identification of known functions, so the quantity called zero-day accuracy is, by construction, partly a measure of training overlap rather than of generalization to unseen functions.

full rationale

Alpha's core DistilBERT function classifier is trained on the Peekaboo training split, and the custom tokenizer and feature engineering are genuine contributions, so the paper is not a pure renaming or self-citation chain. However, the sample-level components that produce the reported perfect scores are not held out. The Layer 3 SVM is explicitly trained on the test samples it later evaluates; the Layer 1 confidence thresholds are quartiles of the test classifications; and for Ransomware, Worms and APT most malicious test samples are resolved by Layer 1 from counts of functions that exist in the training set. Consequently, the abstract's claim of perfect accuracy on 'truly new malware samples' is not supported by an out-of-sample test of novel functions. Because these in-sample and overlap-based mechanisms cover the central headline results, the circularity score is 7 rather than lower; it is not 10 because the DistilBERT function-level classification itself is trained normally and the framework has independent content.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The framework rests on a stack of fitted machine-learning components. Most damagingly, the Layer 3 SVM and the Layer 1 quartile thresholds are fitted to the test set itself, so the evaluation is not a clean generalization test. The domain assumptions about Peekaboo authenticity and Zipf-based transfer from NLP to ASM come from the authors' own prior work.

free parameters (5)
  • DistilBERT fine-tuned weights = 66M parameters per model, one model per malware type
    Trained on Peekaboo training functions and central to Layer 2 classification.
  • Layer 3 Final Classification SVM hyperplane = Linear kernel with equal class weights, coefficients not reported
    Trained on the test samples with features Functions and Malicious Percentage, so reported accuracy for this layer is in-sample.
  • Layer 1 confidence thresholds = Quartile-based distances, no numeric values given
    Derived from test-sample SVM distances and used to decide whether a sample is classified without DistilBERT.
  • One-minute time slice selection = Minute 3, or a segment from just before execution ended
    Minute 3 was chosen after Maze results showed minute 3 gave 100% accuracy; samples without minute 3 were assigned another slice using end-of-run information.
  • Custom WordPiece tokenizer vocabulary = 30,522 tokens
    Trained on Peekaboo data and used to convert normalized assembly functions into tokens.
assumptions (4)
  • domain assumption ASM instruction frequencies follow Zipf's law, making Transformer models suitable for assembly language.
    Section 2.2 and Figure 1 use Zipf's law as motivation. It is an empirical regularity, not a guarantee that Transformer classification transfers from natural language to assembly.
  • domain assumption Peekaboo DBI forces evasive malware to reveal genuine behavior.
    Section 2.1 relies on the authors' own Peekaboo preprint [2] for the claim that dynamic binary instrumentation defeats evasive techniques; no independent validation is provided in this paper.
  • domain assumption The functions remaining after filtering out training overlap are sufficient and label-discriminative for sample classification.
    Section 4 assumes novel functions carry enough signal. Appendix Tables 15 and 16 show many samples retain only a handful of functions after filtering, which weakens this premise.
  • domain assumption A linear SVM on the percentage of malicious functions is a valid way to aggregate function-level predictions into a sample-level decision.
    Layer 3 depends on this aggregation, but the SVM is fitted on the test samples, so the assumption is not tested on held-out data.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Zero Day Malware Detection with Alpha: Fast DBI with Transformer Models for Real World Application." pith.science (2026). https://pith.science/paper/VPTICRER

@misc{pith2026250414886,
  author       = {Pith},
  title        = {Pith review of: Zero Day Malware Detection with Alpha: Fast DBI with Transformer Models for Real World Application},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VPTICRER}},
  note         = {Machine review of arXiv:2504.14886}
}
read the original abstract

The effectiveness of an AI model in accurately classifying novel malware hinges on the quality of the features it is trained on, which in turn depends on the effectiveness of the analysis tool used. Peekaboo, a Dynamic Binary Instrumentation (DBI) tool, defeats malware evasion techniques to capture authentic behavior at the Assembly (ASM) instruction level. This behavior exhibits patterns consistent with Zipf's law, a distribution commonly seen in natural languages, making Transformer models particularly effective for binary classification tasks. We introduce Alpha, a framework for zero day malware detection that leverages Transformer models and ASM language. Alpha is trained on malware and benign software data collected through Peekaboo, enabling it to identify entirely new samples with exceptional accuracy. Alpha eliminates any common functions from the test samples that are in the training dataset. This forces the model to rely on contextual patterns and novel ASM instruction combinations to detect malicious behavior, rather than memorizing familiar features. By combining the strengths of DBI, ASM analysis, and Transformer architectures, Alpha offers a powerful approach to proactively addressing the evolving threat of malware. Alpha demonstrates perfect accuracy for Ransomware, Worms and APTs with flawless classification for both malicious and benign samples. The results highlight the model's exceptional performance in detecting truly new malware samples.

Figures

Figures reproduced from arXiv: 2504.14886 by the authors.

Figure 1
Figure 1. Log-log plot of ASM instruction frequency versus rank across Peekaboo samples. [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. Alpha architecture 8 [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. Experiment A results 13 [PITH_FULL_IMAGE:figures/full_fig_p013_3.png] view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: ASM instruction density per minute 15 [PITH_FULL_IMAGE:figures/full_fig_p015_4.png]
Figure 5
Figure 5. Figure 5: Maze Final Classification SVM per minute results [PITH_FULL_IMAGE:figures/full_fig_p016_5.png]
Figure 6
Figure 6. Figure 6: Minute 3 data tested with trained models [PITH_FULL_IMAGE:figures/full_fig_p017_6.png]
Figure 7
Figure 7. Figure 7: Malware and Benign test sample function loss [PITH_FULL_IMAGE:figures/full_fig_p020_7.png]
Figure 8
Figure 8. Figure 8: Layer 1 Function Loss Classification SVM results [PITH_FULL_IMAGE:figures/full_fig_p021_8.png]
Figure 9
Figure 9. Figure 9: Final Alpha results for 1 minute of data [PITH_FULL_IMAGE:figures/full_fig_p022_9.png]
Figure 9
Figure 9. Figure 9: This shows how the flagged samples, those that were deemed uncertain by the initial classification [PITH_FULL_IMAGE:figures/full_fig_p023_9.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

45 extracted references · 27 canonical work pages

  1. [1]

    M. G. Gaber, M. Ahmed, H. Janicke, Malware detection with artificial intelligence: A systematic literature review, ACM Comput. Surv. 56 (6) (jan 2024). doi:10.1145/3638552. URL https://doi.org/10.1145/3638552

    doi:10.1145/3638552 2024

  2. [2]

    Gaber, M

    M. Gaber, M. Ahmed, H. Janicke, Defeating evasive malware with peekaboo: Extracting authentic malware behavior with dynamic binary instrumentation, ResearchSquare Preprint (2024). doi:https: //doi.org/10.21203/rs.3.rs-4279929/v1

    work page doi:10.21203/rs.3.rs-4279929/v1 2024

  3. [3]

    Gaber, M

    M. Gaber, M. Ahmed, H. Janicke, Peekaboo (2024). doi:https://doi.org/10.25958/85p1-4w32. URL https://ro.ecu.edu.au/datasets/138/

    work page doi:10.25958/85p1-4w32 2024

  4. [4]

    Blackberry, Global threat intelligence report spetember 2024 (2024). URL https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/bbcomv4/blackberr y-com/en/solutions/threat-intelligence/threat-report/sept2024/Global-Threat-Intellige nce-Report_Sept-2024.pdf

    work page 2024

  5. [5]

    URL https://portal.av-atlas.org/malware

    AV-Test, The independant it security institute (2024). URL https://portal.av-atlas.org/malware

    work page 2024

  6. [6]

    Sharmeen, Y

    S. Sharmeen, Y. A. Ahmed, S. Huda, B. S. Kocer, M. M. Hassan, Avoiding future digital extortion through robust protection against ransomware threats using deep learning based adaptive approaches, IEEE Access Special Section on Deep Learning: Security and Forensics Research Advances and Chal- lenges (1 2020). doi:10.1109/ACCESS.2020.2970466. URL https://dr...

    arXiv 2020

  7. [7]

    S. Ahn, S. Ahn, H. Koo, Y. Paek, Practical binary code similarity detection with bert-based transferable similarity learning, Proceedings of the 38th Annual Computer Security Applications Conference (2022) 361doi:10.1145/3564625.3567975. URL http://dx.doi.org/10.1145/3564625.3567975

    arXiv 2022

  8. [8]

    Aurangzeb, R

    S. Aurangzeb, R. N. B. Rais, M. Aleem, M. A. Islam, M. A. Iqbal, On the classification of microsoft- windows ransomware using hardware profile, PeerJ. Computer Science 7 (2021) e361. doi:10.7717/pe erj-cs.361. 26

    work page doi:10.7717/pe 2021

Show all 45 references
  1. [9]

    Hirano, R

    M. Hirano, R. Hodota, R. Kobayashi, Ransap: An open dataset of ransomware storage access patterns for training machine learning models, Forensic Science International: Digital Investigation 40 (2022) 301314. doi:https://doi.org/10.1016/j.fsidi.2021.301314. URL https://www.scie...

    2022

  2. [10]

    F. Khan, C. Ncube, L. K. Ramasamy, S. Kadry, Y. Nam, A digital dna sequencing engine for ransomware detection using machine learning, IEEE Access 8 (2020) 119710–119719. doi:10.1109/ACCESS.2020. 3003785

    2020 doi

  3. [11]

    Carlin, P

    D. Carlin, P. O’Kane, S. Sezer, A cost analysis of machine learning using dynamic runtime opcodes for malware detection, Computers & Security 85 (2019) 138–155. doi:https://doi.org/10.1016/j.co se.2019.04.018. URL https://www.sciencedirect.com/science/article/pii/S0167404819300082

    2019 doi

  4. [12]

    Gibert, C

    D. Gibert, C. Mateu, J. Planes, J. Marques-Silva, Auditing static machine learning anti-malware tools against metamorphic attacks, Computers & Security 102 (2021). doi:10.1016/j.cose.2020.102159

    2021

  5. [13]

    Y. Ye, T. Li, D. Adjeroh, S. S. Iyengar, A survey on malware detection using data mining techniques, ACM Computing Surveys (CSUR) 50 (3) (2017) 1–40. doi:10.1145/3073559

    2017 doi

  6. [14]

    Gaber, M

    M. Gaber, M. Ahmed, H. Janicke, Zero day ransomware detection with pulse: Function classification with transformer models and assembly language, Computers & Security 148 (2025) 104167. doi:https: //doi.org/10.1016/j.cose.2024.104167. URL https://www.sciencedirect.com/science/a...

    2025

  7. [15]

    Kajiwara, J

    Y. Kajiwara, J. Zheng, K. Mouri, Performance comparison of training datasets for system call-based malware detection with thread information, IEICE Transactions on Information and Systems E104D (12) (2021) 2173–2183

    2021

  8. [16]

    Galloro, M

    N. Galloro, M. Polino, M. Carminati, A. Continella, S. Zanero, A systematical and longitudinal study of evasive behaviors in windows malware, Computers & security 113 (2022)

    2022

  9. [17]

    M. Kim, H. Cho, J. H. Yi, Large-scale analysis on anti-analysis techniques in real-world malware, IEEE access 10 (2022) 75802–75815

    2022

  10. [18]

    Nunes, P

    M. Nunes, P. Burnap, P. Reinecke, K. Lloyd, Bane or boon: Measuring the effect of evasive malware on system call classifiers, Journal of Information Security and Applications 67 (2022). doi:10.1016/ j.jisa.2022.103202

    2022

  11. [19]

    Gaber, M

    M. Gaber, M. Ahmed, H. Janicke, Peekaboo transformer models (2024). doi:https://doi.org/10.2 5958/z82g-1e40. URL https://ro.ecu.edu.au/datasets/142/

    2024

  12. [20]

    Madani, N

    H. Madani, N. Ouerdi, A. Boumesaoud, A. Azizi, Classification of ransomware using different types of neural networks, Scientific Reports 12 (1) (2022) 4770

    2022

  13. [21]

    M. N. Alenezi, H. Alabdulrazzaq, A. A. Alshaher, M. M. Alkharang, Evolution of malware threats and techniques: A review, International journal of communication networks and information security 12 (3) (2020) 326–337

    2020

  14. [22]

    Kara, A basic malware analysis method, Computer Fraud & Security 2019 (6) (2019) 11–19

    I. Kara, A basic malware analysis method, Computer Fraud & Security 2019 (6) (2019) 11–19

    2019

  15. [23]

    Ahmed, M

    M. Ahmed, M. Gaber, An investigation on cyber espionage ecosystem, Journal of Cyber Security Tech- nology (2024) 1–25

    2024

  16. [24]

    Benito, A

    R. Benito, A. Shaffer, G. Singh, An automated post-exploitation model for cyber red teaming, in: International Conference on Cyber Warfare and Security, Vol. 18, 2023, pp. 25–34. 27

    2023

  17. [25]

    Thurner, R

    S. Thurner, R. Hanel, B. Liu, B. Corominas-Murtra, Understanding zipf’s law of word frequencies through sample-space collapse in sentence formation, Journal of The Royal Society Interface 12 (108) (2015). doi:10.1098/rsif.2015.0330. URL http://dx.doi.org/10.1098/rsif.2015.0330

    2015

  18. [26]

    H. Koo, S. Park, D. Choi, T. Kim, Semantic-aware Binary Code Representation with BERT, Cornell University Library, arXiv.org, Ithaca, 2021

    2021

  19. [27]

    Vaswani, N

    A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, L. Kaiser, I. Polosukhin, Attention is all you need, Advances in neural information processing systems 30 (2017)

    2017

  20. [28]

    Devlin, M.-W

    J. Devlin, M.-W. Chang, K. Lee, K. Toutanova, BERT: Pre-training of deep bidirectional transformers for language understanding, in: J. Burstein, C. Doran, T. Solorio (Eds.), Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational L...

    2019 doi

  21. [29]

    V. Sanh, L. Debut, J. Chaumond, T. Wolf, DistilBERT, a distilled version of BERT: smaller, faster, cheaper and lighter, Cornell University Library, arXiv.org, Ithaca, 2020

    2020

  22. [30]

    X. Li, Y. Qu, H. Yin, Palmtree learning an assembly language model for instruction embedding (2021). doi:10.1145/3460120.3484587. URL http://dx.doi.org/10.1145/3460120.3484587

    2021

  23. [31]

    Saracino, M

    A. Saracino, M. Simoni, Graph-based android malware detection and categorization through bert transformer, in: Proceedings of the 18th International Conference on Availability, Reliability and Security, ARES ’23, Association for Computing Machinery, New York, NY, USA, 2023. do...

    2023

  24. [32]

    Maniriho, A

    P. Maniriho, A. N. Mahmood, M. J. M. Chowdhury, Earlymaldetect: A novel approach for early windows malware detection based on sequences of api calls (2024). arXiv:2407.13355. URL https://arxiv.org/abs/2407.13355

    2024 arXiv

  25. [33]

    J. Liu, Y. Zhao, Y. Feng, Y. Hu, X. Ma, Semalbert: Semantic-based malware detection with bidirectional encoder representations from transformers, Journal of Information Security and Applications 80 (2024) 103690. doi:https://doi.org/10.1016/j.jisa.2023.103690. URL https://www....

    2024

  26. [34]

    H. Lu, H. Peng, G. Nan, J. Cui, C. Wang, W. Jin, Malsight: Exploring malicious source code and benign pseudocode for iterative binary malware summarization (2024). arXiv:2406.18379. URL https://arxiv.org/abs/2406.18379

    2024 arXiv

  27. [35]

    G. Xiao, J. Li, Y. Chen, K. Li, Malfcs: An effective malware classification framework with automated feature extraction based on deep convolutional neural networks, Journal of Parallel and Distributed Computing 141 (2020) 49–58. doi:10.1016/j.jpdc.2020.03.012

    2020 doi

  28. [36]

    URL https://colab.research.google.com/

    Google, Google colaboratory, accessed: 2024-03-11 (2024). URL https://colab.research.google.com/

    2024

  29. [37]

    Kim, S.-Y

    C. Kim, S.-Y. Chang, J. Kim, D. Lee, J. Kim, Zero-day malware detection using threshold-free au- toencoding architecture, in: 2021 IEEE International Conference on Big Data (Big Data), 2021, pp. 1279–1284. doi:10.1109/BigData52589.2021.9671355

    2021

  30. [38]

    Kim, S.-Y

    C. Kim, S.-Y. Chang, J. Kim, D. Lee, J. Kim, Automated, reliable zero-day malware detection based on autoencoding architecture, IEEE Transactions on Network and Service Management 20 (3) (2023) 3900–3914. doi:10.1109/TNSM.2023.3251282. 28

    2023

  31. [39]

    X. Deng, M. Cen, M. Jiang, M. Lu, Ransomware early detection using deep reinforcement learning on portable executable header, Cluster Computing (27) (may 2024). doi:10.1007/s10586-023-04043-5 . URL https://doi.org/10.1007/s10586-023-04043-5

    2024 doi

  32. [40]

    Zahoora, M

    U. Zahoora, M. Rajarajan, Z. Pan, A. Khan, Ransomware attack detection using deep contractive autoencoder and voting based ensemble classifier, Applied Intelligence (52) (september 2022). doi: /10.1007/s10489-022-03244-6 . URL https://doi.org/10.1007/s10489-022-03244-6

    2022 doi

  33. [41]

    A. Ayub, A. Siraj, B. Filar, M. Gupta, Rwarmor: a static-informed dynamic analysis approach for early detection of cryptographic windows ransomware, International Journal of Information Security (53) (february 2024). doi:10.1007/s10207-023-00758-z . URL https://doi.org/10.1007...

    2024 doi

  34. [42]

    Zahoora, A

    U. Zahoora, A. Khan, M. Rajarajan, S. Hussain Khan, M. Asam, T. Jamal, Ransomware detection using deep learning based unsupervised feature extraction and a cost sensitive pareto ensemble classifier, Scientific Reports (12) (september 2022). doi:10.1038/s41598-022-19443-7 . URL...

    2022 doi

  35. [43]

    Demirkıran, A

    F. Demirkıran, A. C ¸ ayır, U.¨Unal, H. Da˘ g, An ensemble of pre-trained transformer models for imbalanced multiclass malware classification, Computers & Security 121 (2022). doi:10.1016/j.cose.2022.1028 46. URL http://dx.doi.org/10.1016/j.cose.2022.102846

    2022

  36. [44]

    Rahali, M

    A. Rahali, M. A. Akhloufi, Malbert: Malware detection using bidirectional encoder representations from transformers, in: 2021 IEEE International Conference on Systems, Man, and Cybernetics (SMC), 2021, pp. 3226–3231. doi:10.1109/SMC52423.2021.9659287

    2021

  37. [45]

    Appendix 29 Table 15: Experiment C benign function loss, found in benign or malicious training data Filename Initial Length After Deduplication Length Found in Benign Found in Malicious Final Instructions Left b092b0 17784 12613 11906 148 559 eefac8 22875 15871 14759 220 892 c...

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.