Pith. sign in

REVIEW 3 major objections 5 minor 33 references

Self-Supervised Representations for Binary Program Clustering: From Empirical Study to Retrieval-Augmented Learning

T0 review · 3 major / 5 minor · reviewed 2026-08-04 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that restricting VIME's corruption step to samples' k-nearest neighbors—retrieval-augmented corruption—produces more informative training pairs and sets new state-of-the-art clustering results on two public malware dataset

desk verdict Solid empirical study with a simple, likely-real improvement, but the headline 'surpasses the supervised ceiling' is an artifact of comparing mean-of-means to mean-of-maxes, and the retrieval mechanism itself is less supported than the numbers. read the letter →

arxiv 2608.02348 v1 pith:M2K5H5C5 submitted 2026-08-03 cs.CR cs.LG

Martin Mocko , Daniela Chudá This is my paper · ORCID
classification cs.CRcs.LG
keywords malwareclusteringbinaryprogramself-supervisedlearningtabularrepresentationretrieval-augmentedVIMEfamilies
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This is the first systematic study of self-supervised and tabular representation learning for binary program clustering, and its main claim is that a simple modification to VIME makes it the best unsupervised method for this task. VIME-R replaces VIME's global random corruption with corruption sampled only from the k=100 nearest neighbors of each sample. On Ember and Bodmas, VIME-R beats all unsupervised baselines and improves Homogeneity—how purely each cluster contains one true label—by 2.7 to 5.8 percentage points over VIME. On Ember it even exceeds the family-level Homogeneity of a supervised SSL ceiling. The underlying claim is that locality-aware corruption preserves fine-grained malware-family structure better than global marginal corruption.

What carries the argument

The central object is the corruption function x̃ᵢ = m ⊙ x̄ᵢ + (1−m) ⊙ xᵢ, where m is a Bernoulli mask. Vanilla VIME draws x̄ᵢ from global per-feature empirical marginals; VIME-R draws each feature value from the empirical marginal restricted to the k=100 nearest neighbors of xᵢ. This retrieval-restricted sampling is paired with VIME's mask-estimator and reconstruction losses, and its role is to inject locality into the self-supervised pretext task so the learned representation preserves family-level cluster structure.

What would settle it

Compute the family-label purity of the top-100 nearest neighbors on Ember and Bodmas. If most neighbors of a sample belong to different malware families, the retrieval step is not retrieving semantically similar malware, and VIME-R's improvement would have to be explained by something other than locality-aware family structure.

Watch

Extended reading notes

Core claim

The paper establishes that, for binary program clustering, VIME's corruption strategy is the key ingredient: instead of sampling each corrupted feature from the global empirical marginal distribution, sampling it from the marginal distribution of the sample's local neighborhood produces representations that cluster more homogeneously by malware family. VIME-R does this without any label use, relying only on geometric proximity in the preprocessed feature space. It reports mean Homogeneity gains of 2.7% (class) and 3.0% (family) on Bodmas and 5.8% (class) and 3.9% (family) on Ember over VIME, and on Ember it surpasses the supervised Phase-1 ceiling—SimSiam's 76.53% family Homogeneity—with 77.

Load-bearing premise

Nearest neighbors in the 2,235-dimensional standardized feature space must predominantly belong to the same malware family, not merely to the same malware/benign class, for the retrieval-based corruption to teach family structure; the paper measures only class-level neighbor purity.

Editorial extensions

If this is right

  • Unsupervised representation learning can approach supervised clustering quality on static-feature malware benchmarks, narrowing the practical gap for label-scarce security settings.
  • VIME-R sets new state-of-the-art Homogeneity on both Ember and Bodmas, beating UMAP, PCA, Autoencoder, and vanilla VIME without using any labels.
  • On Ember, VIME-R's family Homogeneity exceeds the Phase-1 supervised ceiling, suggesting that fine-grained malware-family structure can be learned without explicit family labels.
  • The supervised-pair SSL results show that BYOL and SimSiam are viable ceiling-setting methods for binary program clustering, while Barlow Twins and VICReg are not.
  • Because VIME scales more efficiently than UMAP, VIME-R inherits a scalability advantage for large malware collections.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editor's inference: family-level neighbor purity is the natural test of VIME-R's mechanism; the paper reports only class-level neighbor purity, so the causal story would be strengthened by showing that top-100 neighbors disproportionately share family labels.
  • Editor's inference: the locality-restricted corruption idea is not limited to VIME; it could be plugged into contrastive tabular learners or SSL pair-generation strategies, potentially improving them as well.
  • Editor's inference: adaptive neighborhood sizes or distance-weighted sampling could further close the gap to the supervised ceiling, and the paper's own future-work list points in that direction.
  • Editor's inference: evaluating VIME-R under temporal splits—training on older samples and clustering newer ones—would test whether neighborhood retrieval remains useful as malware families evolve.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper presents a two-phase empirical study of self-supervised and tabular representation learning for binary program clustering on the Ember and Bodmas datasets. Phase 1 adapts four vision SSL methods (BYOL, SimSiam, Barlow Twins, VICReg) to tabular data with supervised pair generation and establishes a supervised 'ceiling'; Phase 2 evaluates unsupervised TRL methods (VIME, SCARF, SwitchTab) against strong baselines (PCA, Autoencoder, UMAP). The authors then propose VIME-R, a modification of VIME that replaces global marginal-distribution corruption with corruption sampled from the empirical marginal distributions of a sample's k nearest neighbors. They report that VIME-R outperforms VIME by 2.7–5.8% Homogeneity on the two datasets and claim new state-of-the-art results, including a claim that VIME-R surpasses the supervised ceiling on Ember.

Significance. If the claims hold, the paper makes a useful empirical contribution: it provides one of the first systematic comparisons of SSL/TRL methods for malware-family clustering, and it demonstrates a simple, effective mechanism — restricting corruption to local neighborhoods — that improves unsupervised representation quality. The experimental setup is comparatively thorough: multiple runs, multiple checkpoints, standard deviations, and public datasets are used. However, the central evidence for the VIME-R mechanism and for the headline 'supervised ceiling' claim is weakened by three specific issues: missing family-level neighbor-purity analysis, hyperparameter selection on the evaluation data, and an inconsistent comparison between mean-of-means and mean-of-maxes. These issues are fixable and do not by themselves invalidate the core empirical finding, but they must be addressed before the paper can be accepted.

major comments (3)
  1. [§4.3.2, Table 5 vs Table 2] The headline claim that VIME-R 'surpasses the supervised ceiling on Ember' compares VIME-R's mean-of-means family Homogeneity (77.48% in Table 5) to SimSiam's mean-of-maxes (76.53% in Table 2). These are different estimators: Phase 2 uses mean across checkpoints and runs because no label-based model selection is available, while Phase 1 uses the maximum per run because labels allow checkpoint selection. Comparing mean-of-means to mean-of-maxes is not apples-to-apples. Table 6 shows VIME-R mean-of-maxes (77.79%) is also above 76.53%, so the conclusion may survive, but the claim as written in §4.3.2 is unsupported and must be re-computed with like-for-like metrics.
  2. [§4.3.1, Table 4] The motivation for VIME-R is that nearest neighbors in feature space are likely to share the same malware family, so retrieving from a local neighborhood generates more informative corruptions. However, Table 4 reports only class-level purity (malware vs benign), not family-level purity. With roughly 3000 families in Ember and 581 in Bodmas, class purity can be high even if the vast majority of neighbors belong to different families. Since family labels are the target of the reported family Homogeneity, the paper needs to report family-level neighbor purity (e.g., fraction of same-family neighbors, family entropy, or adjusted purity) for the k values used. Without this, the claimed mechanism — retrieval of semantically similar malware — is not supported; the gains could instead come from reduced corruption variance or other local-manifold effects. The distance metric and k-NN procedure u
  3. [§4.3.1] The neighborhood size k=100 is selected by 'preliminary experiments with k∈{50,100,200,500}' on the same datasets that are later used for evaluation, and the reported Homogeneity values are computed on the training set. This is a form of selection on the evaluation data. The paper should either use a separate validation split for hyperparameter selection, report results for all k values with a clear selection protocol, or otherwise justify why the selected k does not inflate VIME-R's improvement. Since k is the only VIME-R-specific hyperparameter, this is load-bearing for the central claim that VIME-R consistently outperforms VIME.
minor comments (5)
  1. [§4.3.2, Table 5] Table 5 omits SCARF, SwitchTab, and the BYOL/SimSiam variants that appear in Table 3. The text claims VIME-R 'outperforms all baselines' and beats VIME, but for a 'state-of-the-art' claim the table should include the other Phase 2 methods, or at least reference Table 3 in a way that makes the comparison explicit.
  2. [§3.2] The text says 'we set the n_neighbors parameter to 20, min_dist to 0.1 and init to spectral'; the parameter name should be consistent (e.g., 'n_neighbors' rather than 'neighbors').
  3. [Table 4] The column header 'Same' / 'Opp.' is ambiguous: it is used for class labels, not family labels. Please clarify that this is class-level purity in the table caption, and consider adding family-level columns as discussed in the major comments.
  4. [§3.6] The paper states that metrics are computed on the train set of the datasets. For a clustering-quality benchmark, it would be useful to state explicitly why the test split is not used, and whether any of the reported numbers use the test split. This also relates to the k-selection issue.
  5. [Abstract/Conclusion] The phrase 'new state-of-the-art results' appears in the abstract and conclusion, but the comparison to prior work is limited to the baselines from [3] and the methods tested in this paper. A brief comparison with other recent malware clustering or representation-learning numbers on the same datasets would strengthen the claim.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the VIME-R improvement claim is an empirical comparison, not a derivation that reduces to its inputs.

full rationale

The paper's central claim (VIME-R improves on VIME and baselines) is supported by direct experiments on Ember and Bodmas; no equation or fitted parameter is defined in terms of the reported Homogeneity values. VIME-R's corruption (Eqs. 3-4) is a concrete algorithmic modification of VIME's corruption (Eqs. 1-2), and the reported 2.7-5.8% gains are measured outcomes, not identities derived from the method's definition. The only self-referential elements are the adoption of the feature-removal list and baselines from the authors' prior work [3], and the choice k=100 from preliminary experiments on the same datasets. Neither makes the VIME-R result true by construction: the feature set and baselines are shared across all compared methods, and k is a hyperparameter, not a re-encoding of the evaluation metric. The nearest-neighbor purity analysis (Table 4) measures class-level rather than family-level purity, which weakens the mechanistic attribution of VIME-R's gains, but that is a support/validity concern, not circularity. No self-citation is used to forbid alternatives or to supply a uniqueness theorem, and no known empirical result is merely renamed. Thus the manuscript is self-contained as an empirical study and the derivation chain (to the extent there is one) is not circular.

Assumptions & free parameters 6 free parameters · 6 assumptions · 0 invented entities

Central results are empirical. The unproved inputs are mainly the family-structure assumptions behind VIME-R, label-derived K, and inherited hyperparameters; no new entities or formal axioms are introduced.

free parameters (6)
  • VIME-R neighborhood size k = 100
    Selected from {50,100,200,500} via preliminary experiments on the same Ember/Bodmas data; no held-out validation, so reported gains are partly in-sample.
  • Corruption rate p_m = 0.3
    Inherited from VIME and reused for VIME-R/SCARF; chosen by hand rather than derived.
  • Embedding dimension = 10
    All backbone/projector embeddings fixed to 10 dimensions; matches prior baseline setup but is an arbitrary capacity choice.
  • K-Means cluster count = 560 (Bodmas), 2750 (Ember)
    Set to the number of malware families in the training labels; injects label-derived information into an otherwise unsupervised evaluation and may not transfer when the number of families is unknown.
  • Barlow Twins loss weight lambda = 0.16
    Chosen by preliminary experimentation for both datasets; affects Phase 1 ceiling results.
  • VICReg loss weights (inv, var, cov) = (19,30,1) Bodmas; (5,100,5) Ember
    Chosen by preliminary experimentation per dataset; high variance (VICReg std up to ±53) indicates instability.
assumptions (6)
  • domain assumption Ground-truth family labels define the correct clustering (Homogeneity against AVClass/Bodmas families is the right success measure).
    The whole evaluation treats family labels as objective truth, but clustering is meant to discover unknown families; label noise/coverage is not modeled.
  • domain assumption Static Ember features, after the preprocessing pipeline of [3], retain enough family-discriminative structure for representation learning.
    Section 3.1-3.2; acknowledged limitation (static features may miss runtime behavior).
  • ad hoc to paper Nearest neighbors in the standardized feature space tend to belong to the same malware family, not just the same malware/benign class.
    Section 4.3.1; only class-level purity is measured (Table 4), so the family-level premise is unverified.
  • domain assumption VIME's corruption-and-reconstruction objective is a sensible pretext task for binary program features.
    Section 3.4; empirically supported by results, but no theoretical guarantee.
  • domain assumption K-Means with k set to the known number of families is a fair downstream evaluation.
    Section 3.5; label-derived k leaks supervision and is unrealistic for zero-day/family discovery.
  • standard math Shannon entropy and conditional entropy definitions are standard; Homogeneity formula is correct.
    Equation (2); standard metrics.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Self-Supervised Representations for Binary Program Clustering: From Empirical Study to Retrieval-Augmented Learning." pith.science (2026). https://pith.science/paper/M2K5H5C5

@misc{pith2026260802348,
  author       = {Pith},
  title        = {Pith review of: Self-Supervised Representations for Binary Program Clustering: From Empirical Study to Retrieval-Augmented Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/M2K5H5C5}},
  note         = {Machine review of arXiv:2608.02348}
}
read the original abstract

Malware clustering is a critical task in cybersecurity that helps discover threats and analyze evolving malware families. While self-supervised learning (SSL) and tabular representation learning (TRL) have achieved breakthroughs in other domains, their application to binary program clustering (the task of clustering all incoming samples regardless of label) remains largely unexplored. This study presents the first systematic investigation of SSL and TRL methods for binary program clustering, conducted in two phases on the public Ember and Bodmas datasets. In Phase 1, we establish a performance ceiling by adapting prominent vision-based SSL models (BYOL, SimSiam, Barlow Twins, VICReg) for tabular data with supervised pair generation, finding that BYOL and SimSiam achieve performance comparable to fully supervised models, while Barlow Twins and VICReg significantly underperform. In Phase 2, we evaluate purely unsupervised TRL methods against strong baselines (PCA, Autoencoder, UMAP), demonstrating that VIME establishes a new state of the art for binary program clustering. Informed by these findings, we propose VIME-R, a retrieval-augmented extension of VIME that replaces random marginal-distribution corruption with retrieval-based augmentation to generate more informative training pairs. VIME-R further improves upon VIME, achieving 2.7\%-5.8\% higher Homogeneity on both datasets. Our results highlight retrieval-augmented tabular representation learning as a promising direction for enhancing automated malware analysis. Code will be made available.

Figures

Figures reproduced from arXiv: 2608.02348 by the authors.

Figure 1
Figure 1. Clustering quality of TRL methods for binary program clustering [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. The general process of our methodology. Different representation [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

33 extracted references · 3 linked inside Pith

  1. [1]

    Classification and online clustering of zero-day malware,

    O. Jure ˇckov´a, M. Jure ˇcek, M. Stamp, F. Di Troia, and R. L ´orencz, “Classification and online clustering of zero-day malware,”Journal of Computer Virology and Hacking Techniques, vol. 20, no. 4, pp. 579–592, 2024

    2024

  2. [2]

    Scalable, behavior-based malware clustering

    U. Bayer, P. M. Comparetti, C. Hlauschek, C. Kruegel, and E. Kirda, “Scalable, behavior-based malware clustering.” inNDSS, vol. 9, 2009, pp. 8–11

    2009

  3. [3]

    Clustering malware at scale: A first full-benchmark study,

    M. Mocko, J. ˇSevcech, and D. Chud ´a, “Clustering malware at scale: A first full-benchmark study,” inInternational Conference on Avail- ability, Reliability and Security. Springer, 2025, pp. 231–251

    2025

  4. [4]

    Bootstrap your own latent-a new approach to self-supervised learning,

    J.-B. Grill, F. Strub, F. Altch ´e, C. Tallec, P. Richemond, E. Buchatskaya, C. Doersch, B. Avila Pires, Z. Guo, M. Ghesh- laghi Azaret al., “Bootstrap your own latent-a new approach to self-supervised learning,”Advances in neural information processing systems, vol. 33, pp. 21 271–21 284, 2020

    2020

  5. [5]

    Exploring simple siamese representation learn- ing,

    X. Chen and K. He, “Exploring simple siamese representation learn- ing,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2021, pp. 15 750–15 758

    2021

  6. [6]

    Bert: Pre- training of deep bidirectional transformers for language understand- ing,

    J. Devlin, M.-W. Chang, K. Lee, and K. Toutanova, “Bert: Pre- training of deep bidirectional transformers for language understand- ing,” inProceedings of the 2019 conference of the North Ameri- can chapter of the association for computational linguistics: human language technologies, volume 1 (long and short papers), 2019, pp. 4171–4186

    2019

  7. [7]

    Vime: Extending the success of self-and semi-supervised learning to tabular domain,

    J. Yoon, Y . Zhang, J. Jordon, and M. Van der Schaar, “Vime: Extending the success of self-and semi-supervised learning to tabular domain,”Advances in neural information processing systems, vol. 33, pp. 11 033–11 043, 2020

    2020

  8. [8]

    Scarf: Self-supervised contrastive learning using random feature corruption,

    D. Bahri, H. Jiang, Y . Tay, and D. Metzler, “Scarf: Self-supervised contrastive learning using random feature corruption,”arXiv preprint arXiv:2106.15147, 2021

    arXiv 2021

Show all 33 references
  1. [9]

    Switchtab: Switched autoencoders are effective tabular learners,

    J. Wu, S. Chen, Q. Zhao, R. Sergazinov, C. Li, S. Liu, C. Zhao, T. Xie, H. Guo, C. Jiet al., “Switchtab: Switched autoencoders are effective tabular learners,” inProceedings of the AAAI conference on artificial intelligence, vol. 38, no. 14, 2024, pp. 15 924–15 933

    2024

  2. [10]

    Subtab: Subsetting features of tabular data for self-supervised representation learning,

    T. Ucar, E. Hajiramezanali, and L. Edwards, “Subtab: Subsetting features of tabular data for self-supervised representation learning,” Advances in Neural Information Processing Systems, vol. 34, pp. 18 853–18 865, 2021

    2021

  3. [11]

    Semi-supervised malware clustering based on the weight of bytecode and api,

    Y . Fang, W. Zhang, B. Li, F. Jing, and L. Zhang, “Semi-supervised malware clustering based on the weight of bytecode and api,”IEEE Access, vol. 8, pp. 2313–2326, 2019

    2019

  4. [12]

    Cougar: clustering of unknown malware using genetic algorithm routines,

    Z. Wilkins and N. Zincir-Heywood, “Cougar: clustering of unknown malware using genetic algorithm routines,” inProceedings of the 2020 genetic and evolutionary computation conference, 2020, pp. 1195– 1203

    2020

  5. [13]

    Online clustering of known and emerging malware families,

    O. Jure ˇckov´a, M. Jure ˇcek, and M. Stamp, “Online clustering of known and emerging malware families,” inMachine Learning, Deep Learning and AI for Cybersecurity. Springer, 2025, pp. 37–59

    2025

  6. [14]

    Scalable malware clustering using multi-stage tree parallelization,

    M. Ali, J. Hagen, and J. Oliver, “Scalable malware clustering using multi-stage tree parallelization,” in2020 IEEE International Confer- ence on Intelligence and Security Informatics (ISI). IEEE, 2020, pp. 1–6

    2020

  7. [15]

    Scaling multi- objective optimization for clustering malware,

    N. MacAskill, Z. Wilkins, and N. Zincir-Heywood, “Scaling multi- objective optimization for clustering malware,” in2021 IEEE Sym- posium Series on Computational Intelligence (SSCI). IEEE, 2021, pp. 1–8

    2021

  8. [16]

    Cluster analysis and concept drift detection in malware: A. mishra, m. stamp,

    A. Mishra and M. Stamp, “Cluster analysis and concept drift detection in malware: A. mishra, m. stamp,”Journal of Computer Virology and Hacking Techniques, vol. 21, no. 1, p. 27, 2025

    2025

  9. [17]

    Malware self-supervised graph contrastive learning with data augmentation,

    Y . Gao, H. Hasegawa, Y . Yamaguchi, and H. Shimada, “Malware self-supervised graph contrastive learning with data augmentation,” Int. J. Adv. Secur, vol. 16, pp. 116–125, 2023

    2023

  10. [18]

    An graph neural network approach with self- supervised learning for malware detection,

    Y . Su and X. Wang, “An graph neural network approach with self- supervised learning for malware detection,” in2024 IEEE 7th Infor- mation Technology, Networking, Electronic and Automation Control Conference (ITNEC), vol. 7. IEEE, 2024, pp. 775–778

    2024

  11. [19]

    Malssl—self-supervised learning for accurate and label-efficient malware classification,

    S. J. I. Ismail, B. Rahardjo, T. Juhana, Y . Musashiet al., “Malssl—self-supervised learning for accurate and label-efficient malware classification,”IEEE Access, vol. 12, pp. 58 823–58 835, 2024

    2024

  12. [20]

    Self-supervised contrastive representation learning for classifying internet of things malware,

    F. Wang, Y . Chen, H. Gao, Q. Li, and C. Wang, “Self-supervised contrastive representation learning for classifying internet of things malware,”Engineering Applications of Artificial Intelligence, vol. 150, p. 110299, 2025

    2025

  13. [21]

    Malsort: Lightweight and efficient image-based malware classifica- tion using masked self-supervised framework with swin transformer,

    F. Wang, X. Shi, F. Yang, R. Song, Q. Li, Z. Tan, and C. Wang, “Malsort: Lightweight and efficient image-based malware classifica- tion using masked self-supervised framework with swin transformer,” Journal of Information Security and Applications, vol. 83, p. 103784, 2024

    2024

  14. [22]

    contrast- bert: Behavioral anomaly detection for malware using contrastive learning,

    J. Carter, S. Mancoridis, P. Protopapas, and B. Mitchell, “contrast- bert: Behavioral anomaly detection for malware using contrastive learning,” inInternational Conference on Game Theory and AI for Security. Springer, 2025, pp. 167–186

    2025

  15. [23]

    Bibe: A self- supervised contrastive learning architecture for malware detection,

    Y . Wang, M. Xu, K. Luo, H. Tong, C. Jin, and B. Xie, “Bibe: A self- supervised contrastive learning architecture for malware detection,” in2023 IEEE 11th International Conference on Computer Science and Network Technology (ICCSNT). IEEE, 2023, pp. 251–257

    2023

  16. [24]

    Nebula: Self-attention for dynamic malware analysis,

    D. Trizna, L. Demetrio, B. Biggio, and F. Roli, “Nebula: Self-attention for dynamic malware analysis,”IEEE Transactions on Information Forensics and Security, vol. 19, pp. 6155–6167, 2024

    2024

  17. [25]

    {CADE}: Detecting and explaining concept drift sam- ples for security applications,

    L. Yang, W. Guo, Q. Hao, A. Ciptadi, A. Ahmadzadeh, X. Xing, and G. Wang, “{CADE}: Detecting and explaining concept drift sam- ples for security applications,” in30th USENIX Security Symposium (USENIX Security 21), 2021, pp. 2327–2344

    2021

  18. [26]

    Evoliot: A self-supervised contrastive learning framework for detecting and characterizing evolving iot malware variants,

    M. Dib, S. Torabi, E. Bou-Harb, N. Bouguila, and C. Assi, “Evoliot: A self-supervised contrastive learning framework for detecting and characterizing evolving iot malware variants,” inProceedings of the 2022 ACM on Asia conference on computer and communications security, 2022,...

    2022

  19. [27]

    Barlow twins: Self-supervised learning via redundancy reduction,

    J. Zbontar, L. Jing, I. Misra, Y . LeCun, and S. Deny, “Barlow twins: Self-supervised learning via redundancy reduction,” inInternational conference on machine learning. PMLR, 2021, pp. 12 310–12 320

    2021

  20. [28]

    Vicreg: Variance-invariance- covariance regularization for self-supervised learning,

    A. Bardes, J. Ponce, and Y . LeCun, “Vicreg: Variance-invariance- covariance regularization for self-supervised learning,”arXiv preprint arXiv:2105.04906, 2021

    2021 arXiv

  21. [29]

    Adversarial exemples: A survey and experimental evaluation of practical attacks on machine learning for windows malware detec- tion,

    L. Demetrio, S. E. Coull, B. Biggio, G. Lagorio, A. Armando, and F. Roli, “Adversarial exemples: A survey and experimental evaluation of practical attacks on machine learning for windows malware detec- tion,”ACM Transactions on Privacy and Security (TOPS), vol. 24, no. 4, pp. ...

    2021

  22. [30]

    Ember: an open dataset for train- ing static pe malware machine learning models,

    H. S. Anderson and P. Roth, “Ember: an open dataset for train- ing static pe malware machine learning models,”arXiv preprint arXiv:1804.04637, 2018

    2018 arXiv

  23. [31]

    Avclass: A tool for massive malware labeling,

    M. Sebasti ´an, R. Rivera, P. Kotzias, and J. Caballero, “Avclass: A tool for massive malware labeling,” inInternational symposium on research in attacks, intrusions, and defenses. Springer, 2016, pp. 230–253

    2016

  24. [32]

    Bodmas: An open dataset for learning based temporal analysis of pe malware,

    L. Yang, A. Ciptadi, I. Laziuk, A. Ahmadzadeh, and G. Wang, “Bodmas: An open dataset for learning based temporal analysis of pe malware,” in2021 IEEE Security and Privacy Workshops (SPW). IEEE, 2021, pp. 78–84

    2021

  25. [33]

    Malmixer: Few-shot mal- ware classification with retrieval-augmented semi-supervised learn- ing,

    J. Li, Y . Zhang, Y . Huang, and K. Leach, “Malmixer: Few-shot mal- ware classification with retrieval-augmented semi-supervised learn- ing,” in2025 IEEE 10th European Symposium on Security and Privacy (EuroS&P). IEEE, 2025, pp. 268–288. TABLE 6. CLUSTERING EVALUATION RESULTS(...

    2025

Pith tools

Reviewed August 4, 2026 · model on record in the stance chip above.