BitShred: feature hashing malware for scalable triage and semantic analysis

By Jiyong Jang, David Brumley, Shobha Venkataraman. 2011

304 citations recorded by the source corpus.

Subfields: Computer Networks and Communications, Information Systems, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Information Systems

In Signal Processing

Citations in the corpus

Poisoning behavioral malware clustering (2014, methodology): “For example, Jang et al. [20] apply feature hashing for clustering large sets of malware binaries, Perdisci & U [26] propose an automatic procedure for calibrating clustering algorithms, and Hu & Shi [16] combine behavioral clustering with static code analysis.”
Deep neural network based malware detection using two dimensional binary program features (2015, methodology): “Potentially the feature space can become large, in those cases methods like locality-sensitive hashing [21, 6], feature hashing (aka hashing “trick”) [34, 22], or random projections [23, 21, 15, 11] have been used in malware detection.”
Scalable fine-grained behavioral clustering of HTTP-based malware (2013, background): “) [7, 32, 8, 20], and only limited information from the network traces is used.”
DUET: integration of dynamic and static analyses for malware clustering with cluster ensembles (2013, methodology): “Using opcodes—instead of widely-used features such as binary sequences [15] or mnemonics i.e. ‘mov’ and ‘add’—oﬀers several beneﬁts.”
Juxtapp: A Scalable System for Detecting Code Reuse among Android Applications (2012, methodology): “As shown in [24], as long as the size of the bitvector is large enough, J(Â, B̂) is very close to J(A,B), the similarity between two applications represented by the k-gram feature sets.”
A Probabilistic Discriminative Model for Android Malware Detection with Decompiled Source Code (2015, unknown): “BitShred [11] extends the previous idea while focusing on modern malware and scalability, extracting features in several ways to handle encrypted code and using feature hashing to compress the feature space effectively while still maintaining the performance of standard machine learning techniques.”
AVclass: A Tool for Massive Malware Labeling (2016, methodology): “There is no agreement in the threshold value, which can be a single AV engine [25,32], two [1], four [15,19], or twenty [13].”
Detection of Intrusions and Malware, and Vulnerability Assessment (2013, background): “In contrast to malware classification that requires labeled samples for training, malware clustering automatically identifies multiple classes of malware that share similar features in an unsupervised learning fashion [3,4,10].”
Malware Detection by Eating a Whole EXE (2017, background): “AUC is an especially pertinent metric due to the need to perform malware triage, where a queue of binaries to look at is created based on a priority structure (Jang, Brumley, and Venkataraman 2011) .”
When a Tree Falls: Using Diversity in Ensemble Classifiers to Identify Evasion in Malware Detectors (2016, background): “However, most classifier evasion attempts, including nine targeted mimicry scenarios from two recent studies, are given an outcome of uncertain indicating that these observations cannot be given a reliable prediction by the classifier.”