Pith. sign in

REVIEW 3 major objections 7 minor 36 references

Learning the Language of NVMe Streams for Ransomware Detection

T0 review · 3 major / 7 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Transformers that read raw NVMe command streams catch ransomware earlier and prevent more data loss than feature-based detectors.

desk verdict Solid and novel transformer approach to ransomware detection on NVMe streams, but headline gains likely inflated by a random split that leaks variants; worth peer review with revisions. read the letter →

arxiv 2502.05011 v1 pith:G3PT247M submitted 2025-02-07 cs.LG cs.CR

Barak Bringoltz , Elisha Halperin , Ran Feraru , Evgeny Blaichman , Amit Berman This is my paper · ORCID
classification cs.LGcs.CR
keywords ransomwaredetectionNVMecommandstreamstransformermodelsstorageI/Osecuritytokenizationcommand-levelclassificationSSDcontrollerdatalossprevention
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that ransomware can be detected directly from the raw sequence of NVMe storage commands, without first compressing the I/O stream into aggregated statistics. It treats the command sequence as text-like data, tokenizes each command, and trains two transformer models: one that labels every command as ransomware or benign, and one that predicts what fraction of a command patch is ransomware I/O. The authors argue this works better than state-of-the-art tabular detectors: on their in-house dataset the command-level transformer cuts the missed-detection rate by up to 24.4%, improves F1 by up to 5.8 points, and reduces the third-quartile data loss before detection by up to 73.5%, while the patch-level transformer misses 84.3% less ransomware I/O volume. A reader should care because faster, more precise storage-level detection means less encrypted data to recover and a defense that cannot be disabled by the malware itself.

What carries the argument

The load-bearing machinery is the transformer paired with a purpose-built tokenizer that turns each NVMe command into a compact token pair. Each command's timestamp gap, size, read/write opcode, disk-offset bits, and binary write-after-read and read-after-read overlap indicators are quantized into 18 bits, split into two 9-bit tokens with an index bit so the vocabulary stays at 1024 entries; the CLT then processes 250 commands as 500 tokens through three self-attention layers and predicts one label per command. The PLT slides patches across the slice and embeds each patch as 181 histogram features covering sizes, offsets, time gaps, overlaps, and normalized totals, then uses six self-attention layers to predict per-patch ransomware read and write fractions. Attention is what lets the model use distant context to judge whether a command is malicious, and the context-ablation experiment, in which longer contexts improve CLT performance, shows that this context use is what carries the result.

What would settle it

Re-run the headline comparison with a split that keeps every stream of a given ransomware variant on one side of the train/test boundary, or with independently audited command-level labels, and re-measure MDR, F1, and MBD3; if the CLT's and PLT's margins over DeftPunk collapse, the reported gains were driven by variant leakage or label noise.

Watch

Extended reading notes

Core claim

The central claim is that the sequential, non-aggregated NVMe command stream carries enough signal for a transformer to recognize ransomware behavior, and that modeling the stream as tokens outperforms the tabular baselines the authors implement, namely a Random Forest and DeftPunk. The Command-Level Transformer (CLT) classifies each command within a 250-command window, and the Patch-Level Transformer (PLT) regresses the ransomware read and write volumes in each of 100 patches per slice; pooling these per-token outputs gives a slice-level decision. Compared with DeftPunk, the CLT improves missed-detection rate, F1, and the third upper quantile of megabytes-to-detection in both ByCommand and ByVolume slicing versions, and the PLT achieves the best performance on the fraction of ransomware I/O volume missed, 84.3% better than DeftPunk. The authors also report that on ransomware variants clustered as out-of-distribution, both transformers still outperform the in-distribution performance of the tabular baselines.

Load-bearing premise

The results stand on the assumption that each storage command in the test data is correctly marked as coming from ransomware or from benign software, and that the random split does not put traces of the same ransomware variant in both the training and test sets.

Editorial extensions

If this is right

  • Detectors that label individual commands can trigger an alert after the first malicious write in a stream, so detection latency and pre-detection data loss shrink by tens of percent relative to slice-level tabular models.
  • Because the PLT predicts the volume of ransomware I/O per patch, it can report how much data a ransomware strain has already touched, which is directly useful for estimating recovery scope.
  • The models' advantage persists for ransomware variants clustered as out-of-distribution, suggesting the learned patterns are behavioral rather than tied to individual malware hashes.
  • The CLT, at roughly 450K parameters, and the PLT, at about 20M parameters, fit in an SSD controller's internal DRAM and can process traffic at roughly 16 to 21 GB/s, making storage-device-level deployment plausible.
  • The context-length experiment shows CLT performance keeps improving as context grows, so the production-sized model is a deliberate size-and-speed trade rather than the ceiling of the approach.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial extension: the same tokenization and per-token objectives could be applied to other storage attack patterns with distinctive I/O signatures, such as wiper malware or mass file deletion, without redesigning the architecture.
  • Editorial extension: the paper's random stream split may overstate the headline margins if streams from the same ransomware variant land on both sides, so the clustered out-of-distribution experiment is the more conservative estimate of real-world generalization.
  • Editorial extension: a testable follow-up is to train the CLT and PLT on only two or three ransomware families and measure whether they still detect unseen families, isolating which storage behaviors actually generalize.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 7 minor

Summary. This paper proposes two transformer-based detectors for ransomware operating on raw NVMe command streams: a Command-Level Transformer (CLT) that labels individual commands by in-context token classification, and a Patch-Level Transformer (PLT) that regresses ransomware read/write volume per patch. The authors introduce an 18-bit quantization and tokenization scheme for commands, histogram-based patch embeddings, and compare CLT/PLT against Random Forest and DeftPunk baselines on an in-house dataset of 1,464 ransomware streams from 137 variants and 1,261 benign streams. Reported results include MDR, F1, MBD3, Pmiss, feature ablations, context-length dependence, an out-of-distribution cluster experiment, and hardware throughput estimates for SSD deployment.

Significance. The paper has genuine strengths: substantially larger ransomware variant coverage than most prior work, command-level labels generated in-house, careful threshold setting on validation with 50 repeated validation/test splits, identical slices across models within a version, ablations of the token/embedding components, and a concrete product-oriented hardware analysis. If the headline margins survive a cluster-separated evaluation, the contribution would be meaningful and practical. However, the main quantitative claims currently rest on a random stream split that is highly likely to leak variants between training and test, and the out-of-distribution experiment that could address this is reported without numeric tables and with an underspecified fold construction. The architecture and evaluation framework are promising, but the evidence as presented does not yet support the stated margins.

major comments (3)
  1. [§5.1, Tables 3–4, abstract] The main results are computed on a random 2/3–1/3 split of streams, not of ransomware variants or TLSH clusters. With 1,464 ransomware streams generated by 137 variants, the average is about 10.7 streams per variant, so a random stream split almost certainly places streams of many variants on both sides of the train/test boundary; Appendix C.2 further shows that the 137 variants collapse into 47 TLSH clusters. Because commands from the same variant share size, offset, and timing distributions, the model can memorize variant-specific patterns rather than learn generalizable ransomware behavior. Section 5.4 is the right check, but it is a different split and its results are not used for the numbers quoted in the abstract and Section 5.3. Please report for the main tables: (i) how many variants and TLSH clusters straddle the random split; (ii) the same metrics under a cluster-separated evaluation such as leave-cluster-out or the Section 5.4 protocol; and (iii) the cluster-separated margins with their 1σ intervals. If the margins shrink materially, the abstract and Section 5.3 claims must be reworded.
  2. [§5.4, Table 18, Figure 3] The out-of-distribution robustness analysis is under-reported. The text says the 137 variants are divided into “3 roughly equal groups,” but Table 18 appears to list clusters rather than variants, and the per-fold entries do not obviously sum to 137 (the three folds shown contain 46, 46, and 34 entries). The protocol also mixes two groups and splits them into train and in-distribution test, which is reasonable, but only a figure is given; no numeric id/ood MDR, F1, MBD3, or Pmiss values or their 1σ intervals appear. The claimed conclusion that “the ood performance of our models is still better than the id performance of the SotA” therefore cannot be checked. Please supplement Figure 3 with a table of id and ood metrics for all four models, and define precisely whether the folds are formed from variants or from TLSH clusters.
  3. [§5.3, Table 3] The F1 improvements quoted in Section 5.3 are not reproducible from Table 3. The text states that CLT is better than DeftPunk by “up to 5.8 ± 1.3% in F1” and PLT by “up to 7.0 ± 1.2% in F1”; from Table 3, the largest CLT-vs-DeftPunk F1 gap is 2.4 percentage points (93.2 vs 90.8 in ByCommand; 90.8 vs 88.4 in ByVolume), and the largest PLT-vs-DeftPunk F1 gap is 1.9 percentage points (90.3 vs 88.4 in ByVolume). Relative differences are also below 5%. Please state explicitly whether the quoted quantities are percentage-point differences, relative differences, or values from a different comparison, and correct the abstract/body numbers if needed.
minor comments (7)
  1. [Abstract vs §5.3] The abstract says improvements of “up to 66% in data loss prevention,” while Section 5.3 reports “up to 73.5 ± 5.3%” in MBD3; these numbers should be aligned.
  2. [Table 1] The row “opcode None 1” is confusing; it should be something like “opcode (R/W) 1 bit.”
  3. [§6] “the PTL operates on data slices” should read “the PLT operates on data slices.”
  4. [Appendix D] The heading “subsectionCalculations for the PLT” is a formatting artifact and should be fixed.
  5. [§5.1, Appendix C] A brief description of how command-level labels were generated and validated would help; the current text only states that the dataset was annotated in-house, without describing the labeling or audit procedure.
  6. [§5.2] Because the 50 repeated validation/test splits reuse the same trained model and only re-select thresholds, the quoted 1σ is a threshold-selection variance rather than full training variance; this should be stated explicitly.
  7. [Table 18] The fold table appears malformed, with entries such as “1Babuk eb18” and nested parenthetical clusters; please format it so that clusters, their sizes, and fold assignments are unambiguous.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper's claims are empirical, evaluated on held-out test streams, with training targets distinct from evaluation metrics in a supervised setting.

full rationale

This is an empirical machine-learning paper without a closed-form derivation chain, so the circularity patterns of self-definition, imported uniqueness theorems, or ansatz smuggled via citation do not apply. The central claims are that transformer models trained on tokenized NVMe command sequences outperform tabular baselines on held-out test data. The evaluation protocol in Section 5.2 explicitly separates validation and test streams, sets thresholds on the validation set, and reports metrics on the test set over 50 cross-validation runs, which is the standard supervised setup and not a fitted-input-called-prediction scheme. The PLT is trained to regress per-patch ransomware read/write volume fractions, and Pmiss measures missed ransomware IO volume on held-out data; although the training objective and the evaluation metric are related, the predictions are tested on unseen streams after training, so this is direct supervised evaluation rather than circularity. The robustness experiment in Section 5.4 further tests on out-of-distribution ransomware clusters, providing independent support for generalization. The concern that the random 2/3-1/3 stream split in Section 5.1 may place streams of the same ransomware variant in both training and test is a potential leakage or correctness risk in the evaluation, not a circularity of the derivation; the paper does not define its quantities in terms of the conclusions. No load-bearing self-citations, renamed known results, or by-construction equivalences were found. Accordingly, the appropriate finding is no significant circularity with a score of 0.

Assumptions & free parameters 7 free parameters · 7 assumptions · 0 invented entities

The central claims rest on the integrity of the proprietary dataset and labels, the fairness of the in-house baseline re-implementations, and the realism of the benign workloads. The models also require a number of hand-chosen design constants (slicing sizes, quantization bits, patch strides, normalization factors) whose values are not derived from theory. There are no invented physical or conceptual entities.

free parameters (7)
  • ROC decision thresholds per model = CLT 0.1725, PLT 0.1363, RF 0.9034, DeftPunk 0.9648
    Set on validation sets to fix FAR at one false alarm per 50GB of benign IO; final binary predictions depend on these thresholds.
  • Slice size for ByCommand and ByVolume = 16,500 commands; 0.5 GiB
    Chosen by hand in Section 2.2 to balance detection latency and throughput robustness; all models compared on identical slices.
  • CLT context window = 250 commands (500 tokens)
    Selected as a compromise between accuracy and hardware feasibility (Section 6).
  • PLT patch width and stride = 250 commands/165 stride; 50MB/~5MB stride
    Chosen for patch-level tokens; affects the granularity of volume estimates.
  • Exponential averaging factor alpha = 0.8
    Controls normalization of delta-t and Delta-t features across slices (Appendix B.2.1).
  • Normalization volume/command counts = v0 = 50MB, n0 = 250
    Defined as token width in ByVolume/ByCommand versions.
  • Quantization bin widths = log-delta-t 4 bits, log-size 4 bits, offset MSB 4/LSB 2, OV binarized
    Hand-designed in Table 1/B.1 to compress 40-digit commands into 18 bits.
assumptions (7)
  • domain assumption Command-level labels from the in-house collection system are correct and complete
    The entire supervised training and evaluation relies on per-command ransomware/benign labels (Section 5.1, Appendix C); no external label audit is provided.
  • domain assumption Random stream splitting does not leak the same ransomware variant's behavior into both train and test
    Section 5.1 randomly chooses 2/3 of streams for training; if same variants appear on both sides, MDR is optimistic. An OOD split exists in Section 5.4 but is not used for headline numbers.
  • domain assumption TLSH similarity with threshold 100 identifies genuinely independent ransomware variants
    Used for OOD generalization analysis in Section 5.4; if clusters are wrong, the OOD test is not truly out-of-distribution.
  • domain assumption Transformer attention can capture ransomware-relevant patterns at long distances in tokenized NVMe streams
    The architectural choice in Section 3 is motivated by this; not independently proven for this domain.
  • domain assumption Benign SNIA traces and in-house benign workloads represent the benign distribution at deployment
    FAR and Perr are measured on these traces; real-world benign SSD traffic may differ.
  • domain assumption The in-house RF and DeftPunk re-implementations faithfully represent the cited SotA performance
    No official code is used; hyperparameters are restricted (RF 20 trees depth 20, XGBoost 100 trees depth 6), which may understate SotA.
  • ad hoc to paper Hand-designed 18-bit quantization of NVMe commands preserves enough information for detection
    The tokenization in Table 1 and Appendix B.1 is specific to this paper; no formal guarantee that the quantized bits are sufficient.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Learning the Language of NVMe Streams for Ransomware Detection." pith.science (2026). https://pith.science/paper/G3PT247M

@misc{pith2026250205011,
  author       = {Pith},
  title        = {Pith review of: Learning the Language of NVMe Streams for Ransomware Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/G3PT247M}},
  note         = {Machine review of arXiv:2502.05011}
}
read the original abstract

We apply language modeling techniques to detect ransomware activity in NVMe command sequences. We design and train two types of transformer-based models: the Command-Level Transformer (CLT) performs in-context token classification to determine whether individual commands are initiated by ransomware, and the Patch-Level Transformer (PLT) predicts the volume of data accessed by ransomware within a patch of commands. We present both model designs and the corresponding tokenization and embedding schemes and show that they improve over state-of-the-art tabular methods by up to 24% in missed-detection rate, 66% in data loss prevention, and 84% in identifying data accessed by ransomware.

Figures

Figures reproduced from arXiv: 2502.05011 by the authors.

Figure 1
Figure 1. A high-level diagram of our ransomware detection pipelines for both the (a) CLT (left panel) and (b) PLT [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 5
Figure 5. We group the slices by the actual fraction of ransomware commands they contain and measure the model’s [PITH_FULL_IMAGE:figures/full_fig_p007_5.png] view at source ↗
Figure 2
Figure 2. The cumulative distribution function of the [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figures from the paper (3 more)
Figure 5
Figure 5. Figure 5: The accuracy of data slices for the CLT versus the slice ransomware command fraction. 8 [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: The dependence of MBD3 and MDR in of the CLT model on the context length. Note that due to splitting each command into two tokens, the actual model input length is twice the numbers shown above [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 8
Figure 8. Figure 8: A pictorial representation of the UNET architecture that we use. [PITH_FULL_IMAGE:figures/full_fig_p016_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

36 extracted references · 31 canonical work pages

  1. [1]

    Selcuk Uluagac

    Harun Oz, Ahmet Aris, Albert Levi, and A. Selcuk Uluagac. A survey on ransomware: Evolution, taxonomy, and defense solutions. ACM Comput. Surv. , 54(11s), September 2022. ISSN 0360-0300. URL https: //doi.org/10.1145/3514229

    doi:10.1145/3514229 2022

  2. [2]

    Rafiqul Islam, Md

    Jamil Ispahany, Md. Rafiqul Islam, Md. Zahidul Islam, and M. Arif Khan. Ransomware detection using machine learning: A review, research limitations and future directions. IEEE Access, 12:68785–68813, 2024

    work page 2024

  3. [3]

    Ssd-insider: Internal defense of solid-state drive against ransomware with perfect data recovery

    SungHa Baek, Youngdon Jung, Aziz Mohaisen, Sungjin Lee, and DaeHun Nyang. Ssd-insider: Internal defense of solid-state drive against ransomware with perfect data recovery. In 2018 IEEE 38th International Conference on Distributed Computing Systems (ICDCS) , pages 875–884, 2018

    work page 2018

  4. [4]

    Mimosaftl: Adding secure and practical ransomware defense strategy to flash translation layer

    Peiying Wang, Shijie Jia, Bo Chen, Luning Xia, and Peng Liu. Mimosaftl: Adding secure and practical ransomware defense strategy to flash translation layer. In Proceedings of the Ninth ACM Conference on Data and Application Security and Privacy, CODASPY ’19, page 327–338, New York, NY , USA, 2019. Association for Computing Machinery. ISBN 9781450360999. UR...

    work page arXiv 2019

  5. [5]

    Ransom access memories: Achieving practical ransomware protection in cloud with DeftPunk

    Zhongyu Wang, Yaheng Song, Erci Xu, Haonan Wu, Guangxun Tong, Shizhuo Sun, Haoran Li, Jincheng Liu, Lijun Ding, Rong Liu, Jiaji Zhu, and Jiesheng Wu. Ransom access memories: Achieving practical ransomware protection in cloud with DeftPunk. In 18th USENIX Symposium on Operating Systems Design and Implementation (OSDI 24), pages 687–702, Santa Clara, CA, Ju...

    work page 2024

  6. [6]

    Redemption: Real-time protection against ransomware at end-hosts

    Amin Kharraz and Engin Kirda. Redemption: Real-time protection against ransomware at end-hosts. pages 98–119, 10 2017. ISBN 978-3-319-66331-9

    work page 2017

  7. [7]

    Ransap: An open dataset of ransomware storage ac- cess patterns for training machine learning models

    Manabu Hirano, Ryo Hodota, and Ryotaro Kobayashi. Ransap: An open dataset of ransomware storage ac- cess patterns for training machine learning models. F orensic Science International: Digital Investigation, 40: 301314, 2022. ISSN 2666-2817. URL https://www.sciencedirect.com/science/article/ pii/S2666281721002390

    work page 2022

  8. [8]

    On the Generalizability of Machine Learning-based Ransomware Detection in Block Storage

    Nicolas Reategui, Roman Pletka, and Dionysios Diamantopoulos. On the generalizability of machine learning- based ransomware detection in block storage, 2024, 2412.21084. URL https://arxiv.org/abs/2412. 21084

    work page Pith review arXiv 2024

Show all 36 references
  1. [9]

    Gomez, Łukasz Kaiser, and Illia Polosukhin

    Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N. Gomez, Łukasz Kaiser, and Illia Polosukhin. Attention is all you need. In Proceedings of the 31st International Conference on Neural Information Processing Systems, NIPS’17, page 6000–6010, Red H...

    2017

  2. [10]

    Singh and DJ Strouse

    Aaditya K. Singh and DJ Strouse. Tokenization counts: the impact of tokenization on arithmetic in frontier llms, 2024, 2402.14903. URL https://arxiv.org/abs/2402.14903

    2024 arXiv

  3. [11]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition at...

    2010 arXiv

  4. [12]

    Ramalho, Joaquim J.S

    Esmeralda A. Ramalho, Joaquim J.S. Ramalho, and Jos ´e M.R. Murteira. Alternative estimating and test- ing empirical strategies for fractional regression models. Journal of Economic Surveys , 25(1):19–68, 2011, https://onlinelibrary.wiley.com/doi/pdf/10.1111/j.1467-6419.2009.0...

    2011

  5. [13]

    Poster: Locally virtualized environment for mitigating ransomware threat

    Manish Shukla, Sutapa Mondal, and Sachin Lodha. Poster: Locally virtualized environment for mitigating ransomware threat. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, CCS ’16, page 1784–1786, New York, NY , USA, 2016. Association fo...

    2016

  6. [14]

    A storage-level detection mechanism against crypto-ransomware

    Joon-Young Paik, Joong-Hyun Choi, Rize Jin, Jianming Wang, and Eun-Sun Cho. A storage-level detection mechanism against crypto-ransomware. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, CCS ’18, page 2258–2260, New York, NY , USA, 201...

    2018

  7. [15]

    Amoeba: An autonomous backup and recovery ssd for ransomware attack defense

    Donghyun Min, Donggyu Park, Jinwoo Ahn, Ryan Walker, Junghee Lee, Sungyong Park, and Youngjae Kim. Amoeba: An autonomous backup and recovery ssd for ransomware attack defense. IEEE Computer Architecture Letters, 17(2):245–248, 2018

    2018

  8. [16]

    Ssd-assisted ransomware detection and data recovery techniques

    Sungha Baek, Youngdon Jung, David Mohaisen, Sungjin Lee, and DaeHun Nyang. Ssd-assisted ransomware detection and data recovery techniques. IEEE Transactions on Computers, 70(10):1762–1776, 2021

    2021

  9. [17]

    Machine learning-based ransomware detection using low-level memory access patterns obtained from live-forensic hypervisor

    Manabu Hirano and Ryotaro Kobayashi. Machine learning-based ransomware detection using low-level memory access patterns obtained from live-forensic hypervisor. In 2022 IEEE International Conference on Cyber Security and Resilience (CSR), pages 323–330, 2022

    2022

  10. [18]

    Real-time defense system using ebpf for machine learning-based ransomware detection method

    Kosuke Higuchi and Ryotaro Kobayashi. Real-time defense system using ebpf for machine learning-based ransomware detection method. In 2023 Eleventh International Symposium on Computing and Networking Workshops (CANDARW), pages 213–219, 2023

    2023

  11. [19]

    Minding the semantic gap for effective storage-based ransomware defense

    Weidong Zhu, Grant Hernandez, Tian Dave (Jing) Garcia, Washington, Sara Rampazzi, and Kevin Butler. Minding the semantic gap for effective storage-based ransomware defense. In International Conference on Massive Storage Systems and Technology, 2024

    2024

  12. [20]

    Xgboost: A scalable tree boosting system

    Tianqi Chen and Carlos Guestrin. Xgboost: A scalable tree boosting system. In Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining , KDD ’16, page 785–794, New York, NY , USA, 2016. Association for Computing Machinery. ISBN 9781450...

    2016

  13. [21]

    Travelling the hypervisor and ssd: A tag-based approach against crypto ransomware with fine-grained data recovery

    Boyang Ma, Yilin Yang, Jinku Li, Fengwei Zhang, Wenbo Shen, Yajin Zhou, and Jianfeng Ma. Travelling the hypervisor and ssd: A tag-based approach against crypto ransomware with fine-grained data recovery. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communic...

    2023

  14. [22]

    BERT: Pre-training of deep bidirectional transformers for language understanding

    Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. BERT: Pre-training of deep bidirectional transformers for language understanding. In Jill Burstein, Christy Doran, and Thamar Solorio, editors,Proceedings of the 2019 Conference of the North American Chapter of ...

    2019

  15. [23]

    Portuguese named entity recognition using bert-crf, 2020, 1909.10649

    F´abio Souza, Rodrigo Nogueira, and Roberto Lotufo. Portuguese named entity recognition using bert-crf, 2020, 1909.10649. URL https://arxiv.org/abs/1909.10649

    2020 arXiv

  16. [24]

    A survey on deep learning for named entity recognition : Extended abstract

    Jing Li, Aixin Sun, Jianglei Han, and Chenliang Li. A survey on deep learning for named entity recognition : Extended abstract. In 2023 IEEE 39th International Conference on Data Engineering (ICDE) , pages 3817–3818, 2023

    2023

  17. [25]

    Gpt-ner: Named entity recognition via large language models, 2023, 2304.10428

    Shuhe Wang, Xiaofei Sun, Xiaoya Li, Rongbin Ouyang, Fei Wu, Tianwei Zhang, Jiwei Li, and Guoyin Wang. Gpt-ner: Named entity recognition via large language models, 2023, 2304.10428. URL https://arxiv. org/abs/2304.10428

    2023 arXiv

  18. [26]

    All tokens matter: token labeling for training better vision transformers

    Zihang Jiang, Qibin Hou, Li Yuan, Daquan Zhou, Yujun Shi, Xiaojie Jin, Anran Wang, and Jiashi Feng. All tokens matter: token labeling for training better vision transformers. In Proceedings of the 35th International Conference on Neural Information Processing Systems , NIPS ’2...

    2021

  19. [27]

    Hsi-bert: Hyperspectral image classification using the bidirectional encoder representation from transformers

    Ji He, Lina Zhao, Hongwei Yang, Mengmeng Zhang, and Wei Li. Hsi-bert: Hyperspectral image classification using the bidirectional encoder representation from transformers. IEEE Transactions on Geoscience and Remote Sensing, 58(1):165–178, 2020

    2020

  20. [28]

    Davies, Richard Macfarlane, and William J

    Simon R. Davies, Richard Macfarlane, and William J. Buchanan. Napierone: A modern mixed file data set alternative to govdocs1. F orensic Science International: Digital Investigation, 40:301330, 2022. ISSN 2666-2817. URL https://www.sciencedirect.com/science/article/pii/S266628...

    2022

  21. [29]

    Systor ’17 traces (SNIA IOTTA trace set 4928)

    Chunghan Lee, Tatsuo Kumano, Tatsuma Matsuki, Hiroshi Endo, Naoto Fukumoto, and Mariko Sugawara. Systor ’17 traces (SNIA IOTTA trace set 4928). In Geoff Kuenning, editor, SNIA IOTTA Trace Repository. Storage Networking Industry Association, March 2016. URL http://iotta.snia.or...

    2016

  22. [30]

    MSR Cambridge traces (SNIA IOTTA trace set 388)

    Dushyanth Narayanan, Austin Donnelly, and Antony Rowstron. MSR Cambridge traces (SNIA IOTTA trace set 388). In Geoff Kuenning, editor, SNIA IOTTA Trace Repository. Storage Networking Industry Association, March

  23. [31]

    Microsoft production server traces (SNIA IOTTA trace set 158)

    Vishal Sharda, Swaroop Kavalanekar, and Bruce Worthington. Microsoft production server traces (SNIA IOTTA trace set 158). In Geoff Kuenning, editor,SNIA IOTTA Trace Repository. Storage Networking Industry Association, March 2008. URL http://iotta.snia.org/traces/block-io?only=158

    2008

  24. [32]

    Tlsh – a locality sensitive hash

    Jonathan Oliver, Chun Cheng, and Yanggui Chen. Tlsh – a locality sensitive hash. In 2013 F ourth Cybercrime and Trustworthy Computing Workshop, pages 7–13, 2013

    2013

  25. [33]

    An evaluation of malware triage similarity hashes

    Haoping Liu, Josiah Hagen, Muqeet Ali, and Jonathan Oliver. An evaluation of malware triage similarity hashes. In ICEIS (1), pages 431–435, 2023

    2023

  26. [34]

    Ssd benchmarks hierarchy 2025

    Jarred Walton. Ssd benchmarks hierarchy 2025. https://www.tomshardware.com/features/ ssd-benchmarks-hierarchy, 2025. Accessed: 2025-01-23. 13 A Model Specifications A.1 Random Forest Model The first model we use as a baseline comparison for our approach is a Random Forest (RF)...

    2025

  27. [2007]

    URL http://iotta.snia.org/traces/block-io?only=388

  28. [2019]

    URL https://aclanthology.org/N19-1423/

    Association for Computational Linguistics. URL https://aclanthology.org/N19-1423/. 12

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.