Pith. sign in

REVIEW 3 major objections 6 minor 48 references

Malware Classification using a Hybrid Hidden Markov Model-Convolutional Neural Network

T0 review · 3 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that turning HMM hidden-state sequences into 224×224 images and classifying them with a CNN outperforms eight compared malware classifiers on a seven-family Malicia subset.

desk verdict The HMM-CNN idea is plausible but the reported 0.23 percentage point edge over HMM-RF is within split noise, so the paper's central claim is not yet supported. read the letter →

arxiv 2412.18932 v1 pith:YV6X5FWX submitted 2024-12-25 cs.LG

Ritik Mehta , Olha Jureckova , Mark Stamp This is my paper · ORCID
classification cs.LG
keywords malwareclassificationHiddenMarkovModelconvolutionalneuralnetworkopcodesequencesMaliciadatasetfeatureengineeringimage-baseddetectiontransferlearning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper is trying to establish that a hybrid feature-engineering pipeline beats both pure sequence models and earlier HMM hybrids for malware family classification. The pipeline trains one Hidden Markov Model per malware family on disassembled opcode sequences, decodes each sample's hidden state sequence with every trained HMM, concatenates the seven sequences, reshapes the scaled vector into a square, zero-pads it to 224×224, and feeds that image to a CNN. On a seven-family subset of the Malicia dataset the method reports validation accuracy 0.9781 and weighted F1 0.9778, edging out the HMM-Random Forest baseline (0.9758, 0.9732) it was designed to surpass. If the result holds, it would mean that HMM hidden states are a genuinely useful feature representation for static malware classification, not just for the random-forest classifier used in prior work.

What carries the argument

The load-bearing object is the HMM hidden state sequence as an engineered image. For each of the seven families, an HMM with $N=20$ hidden states and $M=426$ observation symbols is trained on concatenated mnemonics; then for a sample, the first $L$ opcodes are scored against each of the seven trained HMMs to produce seven length-$L$ hidden state sequences, which are concatenated into a length-$7L$ vector. This vector is standardized, rearranged into a $\lceil\sqrt{7L}\rceil \times \lceil\sqrt{7L}\rceil$ matrix, and zero-padded to 224×224 to form the CNN input. The CNN is a pretrained base architecture (ResNet50V2, ResNet101V2, ResNet152V2, DenseNet201, or Xception) with a global average pooling layer, a 1024-unit ReLU dense layer, and a softmax output. The mechanism's work is to turn sequential opcode statistics into a spatial representation that a vision model can separate, and the paper's evidence for this is the accuracy comparison with models that skip the HMM step.

What would settle it

Repeat the comparison with 5-fold or 10-fold cross-validation, or with multiple random 80/20 splits, and report per-family accuracy; if HMM-CNN's mean accuracy does not consistently exceed HMM-RF's, or a held-out split reverses the ranking, the central claim is refuted.

Watch

Extended reading notes

Core claim

The central claim is that the hidden state sequences of per-family HMMs, when reorganized as images, carry enough discriminative signal for a CNN to classify malware families better than the alternatives tested on the same data. The authors call this HMM-CNN and report it as the best row in their comparison: validation accuracy 0.9781 and weighted F1 0.9778, versus 0.9758/0.9732 for HMM-RF and 0.9725/0.9727 for a plain CNN trained on opcode-derived images. They also observe that HMM-based features help on a rare family: SecurityShield is classified at 87.5% average accuracy by HMM-based models versus 41.67% by non-HMM models, while the smallest family Cridex remains hard, at 0.200 accuracy in the HMM-CNN confusion matrix.

Load-bearing premise

The load-bearing assumption is that a single 80:20 train/test split, with the grid search selecting hyperparameters on the same test split, yields a stable and unbiased accuracy estimate for a heavily imbalanced dataset.

Editorial extensions

If this is right

  • If the reported numbers hold, HMM hidden states are a reusable static feature representation: they improve accuracy over feeding CNNs raw opcode-derived images (0.9781 vs 0.9725) and over HMM features with a random forest or SVM (0.9781 vs 0.9758 and 0.9757).
  • The approach inherits CNN test-time efficiency: per-sample testing is 0.0076 seconds, comparable to a plain CNN, despite 48.83 hours of training.
  • The HMM feature step appears to help rare-class discrimination: SecurityShield samples are classified at 87.5% average accuracy by HMM-based models versus 41.67% by non-HMM models.
  • The authors suggest the same NLP-inspired feature-engineering recipe could transfer to other sequence-classification domains and to obfuscated malware; those are extensions of the method, not yet demonstrated results.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's headline comparison rests on a gap of 0.0023 in accuracy and 0.0046 in F1; a reasonable editorial inference is that this margin is within the noise of a single 80/20 split, and repeated splitting or cross-validation could erase it.
  • Because the hidden states are categorical labels rather than spatial gradients, the 224×224 image is not a natural image; one testable inference is that a simple classifier on the same 7L hidden-state vector might match the CNN, which would mean the gain comes from the HMM representation rather than the CNN.
  • The weighted F1 is dominated by the largest families; with Cridex at 0.200 accuracy and only 74 samples, a macro-averaged or per-family comparison would likely show smaller or reversed differences between methods.
  • A direct ablation the paper does not run—HMM features with a linear model versus HMM features with the CNN—would isolate how much of the gain is due to the CNN and how much to the hidden-state embedding.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes HMM-CNN, a hybrid malware family classifier that combines Hidden Markov Models with Convolutional Neural Networks. The method trains one HMM per malware family on opcode sequences, extracts hidden-state sequences of length L for each sample under each family-specific HMM, concatenates them into a vector of length 7L, reshapes and zero-pads this vector into a 224x224 image, and classifies the image with a CNN built on a pretrained base model. Experiments are conducted on a seven-family subset of the Malicia dataset with a single 80:20 train-test split. The paper reports HMM-CNN validation accuracy 0.9781 and F1 0.9778, slightly above the authors' prior HMM-Random Forest model (0.9758 and 0.9732), and concludes that HMM-CNN achieves superior performance. Training and testing times for all compared techniques are also reported.

Significance. If the reported result were statistically robust, the contribution would be a modest but potentially useful engineering insight: HMM hidden-state sequences can be embedded as images and classified by a CNN, extending the authors' earlier HMM-RF work. The paper is clearly written and provides useful detail on the dataset, preprocessing, hardware, and hyperparameter candidates, which aids reproducibility. However, the central claim of superiority rests on a single data split and a hyperparameter configuration selected by accuracy on that same held-out partition, with no error bars, repeated splits, or significance tests. The reported margin over HMM-RF is 0.0023 in accuracy, which corresponds to roughly four test samples and is well within plausible split-to-split noise given the class imbalance. As presented, the evidence does not establish the paper's main claim.

major comments (3)
  1. [Section 4.2 and Section 5.2, Table 5] The entire comparison rests on one fixed 80:20 split (Section 4.2), and the grid search in Section 5.2 selects hyperparameters by accuracy on that same held-out partition. The reported 0.9781 is therefore a selected maximum over the grid, not an unbiased estimate of generalization. With about 1,611 test samples, the 0.0023 accuracy gap over HMM-RF corresponds to approximately four samples, which is within plausible split-to-split noise unless a paired test is reported. The manuscript provides no variance estimate, no repeated splits, and no McNemar or similar significance test. Please report repeated stratified cross-validation or multiple splits with error bars and a paired significance test, and state explicitly whether hyperparameters were chosen on a separate validation set rather than the final test set.
  2. [Section 5.1 and Table 4] The hyperparameter search is internally inconsistent: Section 5.1 states that L was tested over {25, 50, 100, 200}, while Table 4 lists L over {56, 112, 224}. This makes the exact selected configuration and the search protocol unreproducible. Please reconcile these values and state exactly which L values were tested, which value was selected, and on which data partition the selection was made.
  3. [Section 5.3, Table 5] For the baseline models (Word2Vec-LSTM, BERT-LSTM, Random Forest, SVM, HMM-RF, HMM-SVM, CNN), the manuscript does not report hyperparameter values or whether any tuning was performed. If HMM-CNN received a grid search while the baselines used default settings, the comparison in Table 5 is confounded by tuning effort. This is critical because the reported margins are small. Please specify the baseline configurations and, ideally, give the baselines the same tuning budget or otherwise justify that the comparison is fair.
minor comments (6)
  1. [Abstract] The phrase 'poses a significant challenges' is ungrammatical; use 'significant challenges' or 'a significant challenge'.
  2. [Section 5.3, Table 5] The column heading 'Validation Accuracy' conflicts with the '80:20 train-test split' terminology in Section 4.2; use consistent 'test' terminology throughout.
  3. [Section 5.2] The sentence 'The accuracy obtained for the best choice of hyperparameters in Table 4 was 0.9781' does not state whether this is the test accuracy from the single split; please clarify this point explicitly.
  4. [Figure 5] The three subfigures are said to show 'Accuracy trends for different hyperparameters,' but the text does not specify how each hyperparameter is varied while holding others fixed, nor whether these accuracies are computed on the test split; add a sentence describing the protocol.
  5. [Section 2.1] The statement 'this implies an HMM is an Expectation Maximization (EM) technique' is imprecise; Baum-Welch is an EM algorithm used for HMM training, not the HMM itself.
  6. [References] Reference [40] contains the URL 'https://www.microsoft.com/enus/wdsi/...'; the path should be 'en-us'.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: the comparison is a measured benchmark; self-citations to prior HMM-RF work motivate but do not supply the Table 5 numbers.

full rationale

The paper is an empirical benchmark, not a derivation chain. The HMM-CNN pipeline is self-contained: per-family HMMs are trained on opcode sequences, hidden-state sequences are converted to images, and a CNN is trained and evaluated on an 80/20 split. All numbers in Table 5, including the HMM-RF baseline, are described as experiments run in this work (Section 5.3), not imported from the authors' prior paper [23]. The strongest prior result, HMM-RF, is cited as inspiration, but the comparison accuracy of 0.9758 is measured here. There is no equation that defines a predicted quantity in terms of a fitted value, no uniqueness theorem imported from the authors, and no ansatz smuggled in via citation. The only notable issue is methodological rather than circular: grid-search hyperparameter selection on the same test split (Section 5.2) means the reported 0.9781 may be optimistically biased, and the 0.0023 accuracy margin over HMM-RF is not shown to be statistically significant. This affects the strength of the empirical claim, not the independence of the measurements. Self-citations to [23] and other Stamp-group papers are present but not load-bearing. The score of 2 reflects the minor non-load-bearing self-citation, not any reduction by construction.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The empirical result depends on six tuned hyperparameters, all selected on the same test split, plus five domain assumptions about the dataset, features, HMM training, split representativeness, and the image representation. No derivation is attempted, so there are no hidden mathematical axioms.

free parameters (6)
  • Number of HMM hidden states (N) = 20
    Selected from {5,10,20,30} based on highest accuracy (Section 5.1).
  • Hidden-state sequence length (L) = 224
    Selected from {56,112,224} by grid search on the test split (Section 5.2, Table 4).
  • Base CNN architecture = Not clearly identified in prose; one of ResNet50V2, ResNet101V2, ResNet152V2, DenseNet201, Xception
    Treated as a hyperparameter and selected by grid search (Table 4); the winning model is not stated in the text.
  • Optimizer = Nadam
    Chosen as generally best from {Adam, RMSProp, Adagrad, Adadelta, Nadam, Ftrl} (Section 5.2, Figure 5a).
  • Learning rate = 0.001
    Selected from {0.0001, 0.001, 0.01}; 0.001 was clearly superior (Figure 5b).
  • Loss function = categorical crossentropy
    Selected from {categorical crossentropy, KL divergence, poisson}; clearly superior (Figure 5c).
assumptions (5)
  • domain assumption Malicia family labels are ground truth
    Labels come from automatic clustering plus analyst refinement (Section 4.1); no independent verification or error audit is provided.
  • domain assumption Opcode mnemonics are sufficient features for family discrimination
    The entire pipeline uses only disassembled opcode sequences (Section 4.2); other static features are not considered.
  • domain assumption Baum-Welch HMM training yields informative hidden states for each family
    The method assumes the seven family-specific HMMs, trained with N=20 and M=426, produce hidden-state sequences that discriminate families (Sections 4.3 and 5.1).
  • domain assumption The single 80:20 split is representative
    One unstratified split is used for all experiments; small families such as Harebot (53 samples) may be underrepresented in the test set (Section 4.2).
  • ad hoc to paper Reshaping hidden-state sequences into 224x224 images preserves class-relevant structure
    This is the paper's core design choice: concatenated 7L-length state sequences are arranged into square matrices and padded (Section 4.3, step 4), with no analysis of why this spatial layout is meaningful for a CNN.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Malware Classification using a Hybrid Hidden Markov Model-Convolutional Neural Network." pith.science (2026). https://pith.science/paper/YV6X5FWX

@misc{pith2026241218932,
  author       = {Pith},
  title        = {Pith review of: Malware Classification using a Hybrid Hidden Markov Model-Convolutional Neural Network},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YV6X5FWX}},
  note         = {Machine review of arXiv:2412.18932}
}
read the original abstract

The proliferation of malware variants poses a significant challenges to traditional malware detection approaches, such as signature-based methods, necessitating the development of advanced machine learning techniques. In this research, we present a novel approach based on a hybrid architecture combining features extracted using a Hidden Markov Model (HMM), with a Convolutional Neural Network (CNN) then used for malware classification. Inspired by the strong results in previous work using an HMM-Random Forest model, we propose integrating HMMs, which serve to capture sequential patterns in opcode sequences, with CNNs, which are adept at extracting hierarchical features. We demonstrate the effectiveness of our approach on the popular Malicia dataset, and we obtain superior performance, as compared to other machine learning methods -- our results surpass the aforementioned HMM-Random Forest model. Our findings underscore the potential of hybrid HMM-CNN architectures in bolstering malware classification capabilities, offering several promising avenues for further research in the field of cybersecurity.

Figures

Figures reproduced from arXiv: 2412.18932 by the authors.

Figure 1
Figure 1. Hidden Markov Model [39] The number of hidden states in an HMM is denoted as 𝑁 and the number of unique observation symbols is denoted as 𝑀, while the length of the observation sequence is 𝑇. Within the HMM framework, there are efficient algorithms to solve three problems [38]. For the research in this paper, we are only focused on the following two problems. 1. Given a model 𝜆 = (𝐴, 𝐵, 𝜋) and an observation sequenc… view at source ↗
Figure 2
Figure 2. illustrates a convolution applied to input data using a filter. 𝑛 × 𝑛 input layer 𝑚 × 𝑚 filter (𝑛 − 𝑚 + 1) × (𝑛 − 𝑚 + 1) convolutional layer [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Overview of CNN architecture discusses a representative sample of such malware classifications techniques, with the emphasis on research that is most closely related to our novel NLP-inspired HMM-CNN technique. 3.1 Malware Classification using HMM In one of the earliest papers in this genre, Wong and Stamp [43] consider HMMs for the detection of metamorphic malware. By modern standards, they consid￾ered a very small… view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: Malware samples per family 4.2 Experimental Design The first step in our experimental design is to disassemble every executable file in the dataset and extract mnemonic opcode sequences. Next, the dataset is split into train and test sets. For all of our experiments, w…
Figure 5
Figure 5. Figure 5: Accuracy trends for different hyperparameters for HMM-CNN [PITH_FULL_IMAGE:figures/full_fig_p013_5.png]
Figure 6
Figure 6. Figure 6: Confusion matrices for HMM-CNN model of the related techniques that we consider. • Word2Vec-LSTM — For this model, we generate Word2Vec embeddings of the opcodes, then train an LSTM model on the resulting sequence of embedding vectors. • BERT-LSTM — This is the same as…
Figure 7
Figure 7. Figure 7: Training and testing timings We observe that Word2Vec-LSTM and BERT-LSTM, which combine word embeddings with LSTM networks, require moderate training times and rela￾tively high testing times. On the other hand, techniques incorporating HMMs required significantly longe…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

48 extracted references · 42 canonical work pages

  1. [23]

    A natural language pro- cessing approach to malware classification

    Ritik Mehta, Olha Jure vckov´ a, and Mark Stamp. A natural language pro- cessing approach to malware classification. Journal of Computer Virology and Hacking Techniques , 20:173–184, 2024

    work page 2024

  2. [1]

    Deep learning using rectified linear units (ReLU)

    Abien Fred Agarap. Deep learning using rectified linear units (ReLU). https://arxiv.org/abs/1803.08375, 2019

    arXiv 2019

  3. [2]

    Hidden Markov modelling (HMM) — An introduction

    Johnson Agbinya. Hidden Markov modelling (HMM) — An introduction. In Applied Data Analytics — Principles and Applications , pages 17–34. River Publishers, 2020

    work page 2020

  4. [3]

    Hidden Markov models for malware classification

    Chinmayee Annachhatre, Thomas Austin, and Mark Stamp. Hidden Markov models for malware classification. Journal of Computer Virology and Hack- ing Techniques, 11:59–73, 2015

    work page 2015

  5. [4]

    A survey on heuristic malware detection techniques

    Zahra Bazrafshan, Hashem Hashemi, Seyed Mehdi Hazrati Fard, and Ali Hamzeh. A survey on heuristic malware detection techniques. In The 16 5th Conference on Information and Knowledge Technology , pages 113–120, 2013

    work page 2013

  6. [5]

    Transfer learning for image-based malware classification

    Niket Bhodia, Pratikkumar Prajapati, Fabio Di Troia, and Mark Stamp. Transfer learning for image-based malware classification. In Paolo Mori, Steven Furnell, and Olivier Camp, editors, Proceedings of the 5th Interna- tional Conference on Information Systems Security and Privacy , ICISSP, pages 719–726, 2019

    work page 2019

  7. [6]

    Andrew P. Bradley. The use of the area under the roc curve in the evaluation of machine learning algorithms. Pattern Recognition, 30(7):1145–1159, 1997

    work page 1997

  8. [7]

    Xception: Deep learning with depthwise separable convo- lutions

    Francois Chollet. Xception: Deep learning with depthwise separable convo- lutions. In 2017 IEEE Conference on Computer Vision and Pattern Recog- nition, CVPR, pages 1800–1807, 2017

    work page 2017

Show all 48 references
  1. [8]

    https://www.computerhope.com/jargon/c/cridex- malware.htm, 2017

    Cridex malware. https://www.computerhope.com/jargon/c/cridex- malware.htm, 2017

    2017

  2. [9]

    Austin, and Mark Stamp

    Anusha Damodaran, Fabio Di Troia, Corrado Aaron Visaggio, Thomas H. Austin, and Mark Stamp. A comparison of static, dynamic, and hybrid analysis for malware detection. Journal of Computer Virology and Hacking Techniques, 13(1):1–12, 2017

    2017

  3. [10]

    Recurrent neural networks

    Ke-Lin Du and M.N.S Swamy. Recurrent neural networks. In Neural Net- works and Statistical Learning , pages 337–353. Springer, second edition, 2019

    2019

  4. [11]

    Hidden Markov models

    Monica Franzese and Antonella Iuliano. Hidden Markov models. In Shoba Ranganathan, Michael Gribskov, Kenta Nakai, and Christian Sch¨ onbach, editors, Encyclopedia of Bioinformatics and Computational Biology , pages 753–762. Academic Press, 2019

    2019

  5. [12]

    Garcia and Felix P

    Felan Carlo C. Garcia and Felix P. Muga II. Random forest for malware classification. https://arxiv.org/abs/1609.07770, 2016

    2016 arXiv

  6. [13]

    Identity map- pings in deep residual networks

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity map- pings in deep residual networks. In Bastian Leibe, Jiri Matas, Nicu Sebe, and Max Welling, editors, Computer Vision , ECCV, pages 630–645, 2016

    2016

  7. [14]

    Densely connected convolutional networks

    Gao Huang, Zhuang Liu, Laurens van der Maaten, and Kilian Weinberger. Densely connected convolutional networks. In 2017 IEEE Conference on Computer Vision and Pattern Recognition , CVPR, 2017

    2017

  8. [15]

    Convolutional neu- ral networks and extreme learning machines for malware classification.Jour- nal of Computer Virology and Hacking Techniques , 16(3):229–244, 2020

    Mugdha Jain, William Andreopoulos, and Mark Stamp. Convolutional neu- ral networks and extreme learning machines for malware classification.Jour- nal of Computer Virology and Hacking Techniques , 16(3):229–244, 2020

    2020

  9. [16]

    Global Cyber Policy Radar: Report on Cyber Security Regula- tion Trends

    Verona Johnstone-Hulse, Kat Sommer, and Willemijn Rodenburg. Global Cyber Policy Radar: Report on Cyber Security Regula- tion Trends. https://insights.nccgroup.com/l/898251/2024-02- 09/31hwl3c/898251/1707490152q2gY3vOD/NCC_Group_Global_Cyber_ Policy_Radar_Report_Feb_2024.pdf, 2024. 17

    2024

  10. [17]

    Mahmoud Kalash, Mrigank Rochan, Noman Mohammed, Neil D. B. Bruce, Yang Wang, and Farkhund Iqbal. Malware classification with deep convolu- tional neural networks. In 2018 9th IFIP International Conference on New Technologies, Mobility and Security , NTMS, pages 1–5, 2018

    2018

  11. [18]

    Support vector machine for malware analysis and classification

    Michal Kruczkowski and Ewa Niewiadomska Szynkiewicz. Support vector machine for malware analysis and classification. In 2014 IEEE/WIC/ACM International Joint Conferences on Web Intelligence (WI) and Intelligent Agent Technologies (IAT), volume 2, pages 415–420, 2014

    2014

  12. [19]

    Grid search, random search, genetic algorithm: A big comparison for NAS

    Petro Liashchynskyi and Pavlo Liashchynskyi. Grid search, random search, genetic algorithm: A big comparison for NAS. https://arxiv.org/abs/ 1912.06059

    1912 arXiv

  13. [20]

    Network in network

    Min Lin, Qiang Chen, and Shuicheng Yan. Network in network. https: //arxiv.org/abs/1312.4400, 2014

    2014 arXiv

  14. [21]

    Malware detection with LSTM using opcode language

    Renjie Lu. Malware detection with LSTM using opcode language. http: //arxiv.org/abs/1906.04593, 2019

    1906 arXiv

  15. [22]

    A.S. Maida. Cognitive computing and neural networks: Reverse engineering the brain. In Venkat N. Gudivada, Vijay V. Raghavan, Venu Govindaraju, and C.R. Rao, editors, Cognitive Computing: Theory and Applications , vol- ume 35 of Handbook of Statistics , chapter 2, pages 39–78....

    2016

  16. [24]

    https://www

    Microsoft malware classification challenge (BIG 2015). https://www. kaggle.com/c/malware-classification

    2015

  17. [25]

    Method- ology for malware classification using a random forest classifier

    Carlos Domenick Morales-Molina, Diego Santamaria-Guerrero, Gabriel Sanchez-Perez, Hector Perez-Meana, and Aldo Hernandez-Suarez. Method- ology for malware classification using a random forest classifier. In 2018 IEEE International Autumn Meeting on Power, Electronics and Compu...

    2018

  18. [26]

    Zubair Rafique, and Juan Caballero

    Antonio Nappa, M. Zubair Rafique, and Juan Caballero. The MALICIA dataset: identification and analysis of drive-by download operations. Inter- national Journal of Information Security , 14:15–33, 2014

    2014

  19. [27]

    Karthikeyan, Gregoire Jacob, and B

    Lakshmanan Nataraj, S. Karthikeyan, Gregoire Jacob, and B. S. Manju- nath. Malware images: Visualization and automatic classification. In Pro- ceedings of the 8th International Symposium on Visualization for Cyber Se- curity, VizSec ’11, 2011

    2011

  20. [28]

    Zeroaccess indepth

    Alan Neville and Ross Gibb. Zeroaccess indepth. https://docs.broadcom. com/doc/zeroaccess-indepth-13-en, 2013

    2013

  21. [29]

    Generative adversarial networks and image-based malware classification

    Huy Nguyen, Fabio Di Troia, Genya Ishigaki, and Mark Stamp. Generative adversarial networks and image-based malware classification. Journal of Computer Virology and Hacking Techniques , 19(4):579–595, 2023. 18

    2023

  22. [30]

    An introduction to convolutional neural networks

    Keiron O’Shea and Ryan Nash. An introduction to convolutional neural networks. https://arxiv.org/abs/1511.08458, 2015

    2015 arXiv

  23. [31]

    Stokes, Hermineh Sanossian, Mady Marinescu, and Anil Thomas

    Razvan Pascanu, Jack W. Stokes, Hermineh Sanossian, Mady Marinescu, and Anil Thomas. Malware classification with recurrent networks. In 2015 IEEE International Conference on Acoustics, Speech and Signal Processing , ICASSP, pages 1916–1920, 2015

    2015

  24. [32]

    Prokhorov

    D. Prokhorov. Echo state networks: Appeal and challenges. In Proceedings. 2005 IEEE International Joint Conference on Neural Networks , volume 3, pages 1463–1466, 2005

    2005

  25. [33]

    Claude Sammut and Geoffrey I. Webb. TF–IDF. In Encyclopedia of Machine Learning, pages 986–987. Springer, 2010

    2010

  26. [34]

    https://www.microsoft.com/en-us/wdsi/threats/ malware-encyclopedia-description?Name=SecurityShield, 2019

    Securityshield. https://www.microsoft.com/en-us/wdsi/threats/ malware-encyclopedia-description?Name=SecurityShield, 2019

    2019

  27. [35]

    Very deep convolutional net- works for large-scale image recognition

    Karen Simonyan and Andrew Zisserman. Very deep convolutional net- works for large-scale image recognition. In Yoshua Bengio and Yann LeCun, editors, 3rd International Conference on Learning Representations , ICLR, 2015

    2015

  28. [36]

    Support vector machines and malware detection

    Tanuvir Singh, Fabio Di Troia, Corrado Aaron Visaggio, Thomas Austin, and Mark Stamp. Support vector machines and malware detection. Journal of Computer Virology and Hacking Techniques , 12:203–212, 2016

    2016

  29. [37]

    https://www.bleepingcomputer.com/virus-removal/ remove-smart-hdd, 2010

    Smart HDD. https://www.bleepingcomputer.com/virus-removal/ remove-smart-hdd, 2010

    2010

  30. [38]

    A revealing introduction to hidden Markov models

    Mark Stamp. A revealing introduction to hidden Markov models. https: //www.cs.sjsu.edu/~stamp/RUA/HMM.pdf, 2004

    2004

  31. [39]

    Introduction to Machine Learning with Applications in Infor- mation Security

    Mark Stamp. Introduction to Machine Learning with Applications in Infor- mation Security. Chapman and Hall/CRC, 2nd edition, 2022

    2022

  32. [40]

    https://www.microsoft.com/enus/wdsi/threats/malware- encyclopedia-description?Name=Win32/Winwebsec, 2017

    Winwebsec. https://www.microsoft.com/enus/wdsi/threats/malware- encyclopedia-description?Name=Win32/Winwebsec, 2017

    2017

  33. [41]

    Principal component analy- sis

    Svante Wold, Kim Esbensen, and Paul Geladi. Principal component analy- sis. Chemometrics and Intelligent Laboratory Systems , 2(1):37–52, 1987

    1987

  34. [42]

    How does antivirus software work? https: //www.usnews.com/360-reviews/privacy/antivirus/how-does- antivirus-software-work

    Stewart Wolpin. How does antivirus software work? https: //www.usnews.com/360-reviews/privacy/antivirus/how-does- antivirus-software-work

  35. [43]

    Hunting for metamorphic engines

    Wing Wong and Mark Stamp. Hunting for metamorphic engines. Journal in Computer Virology , 2(3):211–229, 2006

    2006

  36. [44]

    Deep learning versus gist descriptors for image-based malware classi- fication

    Sravani Yajamanam, Vikash Raja Samuel Selvin, Fabio Di Troia, and Mark Stamp. Deep learning versus gist descriptors for image-based malware classi- fication. In Paolo Mori, Steven Furnell, and Olivier Camp, editors, Proceed- ings of the 4th International Conference on Informat...

    2018

  37. [45]

    Malware obfuscation techniques: A brief sur- vey

    Ilsun You and Kangbin Yim. Malware obfuscation techniques: A brief sur- vey. In Proceedings - 2010 International Conference on Broadband, Wire- less Computing Communication and Applications , BWCCA, pages 297–300, 2010

    2010

  38. [46]

    https://www.microsoft.com/en-us/wdsi/threats/malware- encyclopedia-description?Name=PWS%3AWin32%2FZbot, 2017

    Zbot. https://www.microsoft.com/en-us/wdsi/threats/malware- encyclopedia-description?Name=PWS%3AWin32%2FZbot, 2017

    2017

  39. [47]

    Malware classification with GMM-HMM models

    Jing Zhao, Samanvitha Basole, and Mark Stamp. Malware classification with GMM-HMM models. In Paolo Mori, Gabriele Lenzini, and Steven Furnell, editors, Proceedings of the 7th International Conference on In- formation Systems Security and Privacy , ICISSP, pages 753–762, 2021. ...

    2021 arXiv

  40. [48]

    EngmaSoft: Rootkit.HareBot

    ZulaZula. EngmaSoft: Rootkit.HareBot. https://www.enigmasoftware. com/rootkitharebot-removal, 2016. 20

    2016

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.