Pith. sign in

REVIEW 4 major objections 4 minor 46 references

Multimodal Techniques for Malware Classification

T0 review · 4 major / 4 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read By training separate models on PE headers and PE sections and feeding their probability outputs to a final SVM, the paper reports malware classification accuracy of 0.9930, up from 0.9835 for the best single-model baseline.

desk verdict A clean but statistically fragile stacking experiment; the claimed multimodal gain is about four test samples from one split, and the abstract overstates it. read the letter →

arxiv 2501.10956 v1 pith:STKR22AO submitted 2025-01-19 cs.CR cs.LG

Jonathan Jiang , Mark Stamp This is my paper · ORCID
classification cs.CRcs.LG
keywords malwareclassificationmultimodalmachinelearningWindowsPortableExecutablePEheaderandsectionfeaturesprobabilityvectorstackingsupportLSTMCNN
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that the two structural parts of a Windows PE file—the header and the remaining sections—carry complementary information for malware classification, and that exploiting that structure through a multimodal model yields a genuine accuracy gain. The authors train support vector machine (SVM), long short-term memory (LSTM), and convolutional neural network (CNN) baselines on header features, on section features, and on whole-file features, then concatenate the output probabilities of each header/section pair and train a final SVM on those ten probabilities. Of the nine combinations, the two best multimodal models reach accuracies of 0.9929 and 0.9930, against 0.9835 for the best single-model baseline, which roughly halves the number of misclassified samples. The result matters because it suggests a low-cost improvement path: split a structured binary file by its natural parts, keep the existing classifiers, and let a meta-classifier combine their probability outputs.

What carries the argument

The central mechanism is a two-stage stacking scheme. In the first stage, each component model outputs a five-class probability vector for a PE file; a header-based model and a section-based model are trained independently. In the second stage, the two probability vectors are concatenated into a ten-dimensional feature vector, and an SVM is trained on those vectors to produce the final classification. The PE file's natural division into headers and sections is what makes the two modalities distinct, and the probability vector is the carrier of information between the stages.

What would settle it

Compute the final SVM's accuracy using out-of-fold probabilities: generate header- and section-model probabilities on held-out folds, train the stacking SVM only on those held-out predictions, and compare against the reported 0.9930. If the gap over the 0.9835 baseline disappears or reverses, the multimodal gain is an artifact of training the stack on probabilities from the component models' own training data.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is that a multimodal stacking setup—one model trained on PE-header bytes, one model trained on PE-section bytes, and a final SVM trained on the concatenated output-layer probability vectors of the two—outperforms any single model trained on one part or on the entire file. The best results are (LSTM, CNN) → SVM at 0.9929 and (CNN, CNN) → SVM at 0.9930, versus 0.9835 for the best baseline, which is an SVM trained on section histograms. The paper reads this as evidence that training separate models on distinct parts of PE files can be advantageous: the probability vectors of the component models act as engineered features that preserve information lost when one model sees only part of the file, and the final SVM learns to combine them.

Load-bearing premise

The central result assumes the probability features fed to the final SVM come from samples that were not used to train the header and section models; if those probabilities were computed on the same training data, the reported accuracy gain could be inflated.

Editorial extensions

If this is right

  • Training existing classifiers separately on PE headers and PE sections and combining their probabilities with an SVM can improve accuracy by roughly one percentage point over the best single-model baseline.
  • The benefit is not tied to a single architecture: the two top combinations, (LSTM, CNN) → SVM and (CNN, CNN) → SVM, both beat every baseline.
  • At these accuracy levels, moving from 0.9835 to 0.9930 means the best multimodal model misclassifies about half as many samples as the best baseline.
  • The method treats the component models as trainable feature extractors, so any classifier that emits probabilities can be plugged into the second-stage SVM.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural extension the paper leaves implicit is testing whether the stacking gain persists on a larger, more balanced PE dataset; with 2,114 samples across five heavily imbalanced families, the reported one-point gain is a point estimate from a single split.
  • The design implies that the gain should grow when the two component models' errors are complementary and shrink when the two modalities are redundant; this could be tested by measuring error correlation between header and section predictions.
  • The same probability-vector stacking recipe should transfer to other structured binary formats, such as ELF files, though the paper only demonstrates it on Windows PE files.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper applies SVM, LSTM, and CNN models to features extracted from PE headers, PE sections, and entire PE files, and then trains an SVM on the concatenated output probabilities of one header-based and one section-based model for each of nine combinations. On a 2,114-sample Malicia subset with five malware families, it reports that the best multimodal models, (LSTM, CNN)→SVM and (CNN, CNN)→SVM, reach accuracies of 0.9929 and 0.9930, respectively, versus 0.9835 for the best baseline (SVM on sections). From this the abstract concludes that it can be advantageous to train separate models on distinct parts of Windows PE files.

Significance. If the reported comparison were statistically robust, this would be a modest but useful empirical data point: probability stacking of simple models yields about a one-percent accuracy gain, halving the error rate, on a public dataset. The paper is clearly written, the experimental pipeline is transparent, and the use of an external dataset (Malicia) is a strength. However, the headline gain corresponds to roughly four test samples from a single 80-20 split, with no confidence intervals, repeated seeds, or significance tests, and the stacking protocol in Section 4.5 does not state whether out-of-fold probabilities were used. As presented, the evidence is too fragile to support the abstract's conclusion.

major comments (4)
  1. [Section 4.5 and Figure 11] The central comparative claim rests on a single 80-20 split with no repeated runs, confidence intervals, or significance tests. The reported gap between the best multimodal accuracy (0.9930) and the best baseline (0.9835) is about four test samples out of roughly 423, and with Zbot and ZeroAccess accounting for 93% of the dataset (Figure 7), the difference could be driven by one family. The authors should provide repeated stratified cross-validation or bootstrap confidence intervals, and a paired significance test such as McNemar's test for the comparison of interest, with multiple-comparison control over the nine multimodal combinations.
  2. [Section 4.5, stacking protocol] The manuscript does not state whether the probability vectors used as features for the final SVM were produced out-of-fold or on the same training data used to fit the component models. If the latter, the meta-SVM is trained on optimistically biased features, and part of the reported 1% gain could be an artifact. The authors must specify the protocol and, if it is not out-of-fold, rerun the experiments with out-of-fold or nested cross-validation.
  3. [Section 5 (Conclusion and Future Work)] The conclusion acknowledges that testing on a larger, more diverse, and more challenging dataset is needed 'to more accurately quantify the effectiveness' of the approach. This self-identified limitation directly undercuts the abstract's categorical claim that the results 'indicating that it can be advantageous' to train separate models on distinct PE parts. The conclusion should be rephrased to match the strength of the current evidence, and the paper should state the uncertainty associated with the reported accuracies.
  4. [Section 4.2, hyperparameter selection] The SVM hyperparameter grid search is described as being performed 'using the header features' (Table 2), but the text does not state whether the selected hyperparameters were then used for all SVM variants (sections, entire file, and the meta-SVM) and whether the grid search was conducted entirely within the training partition. This should be clarified, as tuning on the full dataset or on the test portion would bias the reported accuracies.
minor comments (4)
  1. [Section 1, Introduction] There is a duplicated word and an unclosed parenthesis in the sentence beginning 'While copious previous research has trained trained a wide variety learning models...'; the sentence should be rewritten for clarity.
  2. [Section 2.1] In the description of the .reloc section, 'session' should be 'section'; the sentence reads 'The .reloc session contains the relocation table...'.
  3. [Section 2.2 and Section 4.4] Minor typographical and grammatical issues include 'introduces the machine learning that are used' and 'these results demonstrates the efficacy'; these should be corrected.
  4. [Figure 11 and Appendix Figure A.1] The bar charts would be more informative if they included error bars or the number of test samples per family; given the class imbalance, this would help readers judge the reliability of the accuracy differences.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the multimodal result is an empirical comparison on an external dataset, not a derivation forced by its own inputs.

full rationale

The paper's central claim is empirical: the best stacked multimodal model (CNN, CNN) -> SVM reaches 0.9930 accuracy versus 0.9835 for the best single-model baseline, and Section 4.5 describes training the meta-SVM on concatenated output-layer probability vectors of the component models. This is the experimental protocol, not a definitional equivalence: the accuracy numbers are not computed from the inputs by construction, and the baseline models are independent classifiers on the same external Malicia subset. The nine multimodal combinations are tested and the best selected, which is a multiple-comparison and winner's-curse concern rather than a circularity concern. Self-citations appear in related work and background (e.g., [6, 9, 17, 27, 31, 35, 43]), but none carries the load of the central claim; no uniqueness theorem or fitted parameter is imported from the authors' prior work. The Section 4.5 omission of whether the probability features for the meta-SVM are out-of-fold is a potential information-leakage or soundness issue, and the single 80/20 split with no confidence interval is a statistical fragility, but neither makes the result equivalent to its inputs. Section 5's call for a larger, more diverse dataset is an ordinary limitation statement, not an admission of circularity. The paper is therefore not circular; the relevant criticisms fall under experimental soundness, not circular derivation.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central claim rests on modeling choices (hyperparameters, byte lengths, image sizes), trust in the Malicia labels, and an underspecified stacking protocol. No new physical or conceptual entities are introduced.

free parameters (4)
  • SVM hyperparameters (C, gamma, kernel) = not stated in text (boldface in Table 2)
    Selected by grid search on header features only and reused for sections and entire-file models; these choices affect all SVM and stacking results.
  • LSTM input sequence length = 324 (header), 1000 and 2000 (sections/entire)
    Chosen by hand for efficiency; directly limits the bytes seen, and the 1000/2000 choices affect the low LSTM section and entire accuracies.
  • CNN image dimensions = 16x16 header, 32x32 sections/entire
    Chosen by hand; determines that only 256 or 1024 bytes are used, which defines the 'entire file' input.
  • LSTM architecture hyperparameters = 64 units, 10 epochs, batch 30, sigmoid activation
    Fixed by the authors; the central accuracy numbers depend on these choices.
assumptions (5)
  • domain assumption PE header is represented by the first 324 bytes
    Assumed in Sections 4.3 and 4.4; the header model uses exactly 324 bytes (LSTM) or 256 bytes (CNN image).
  • domain assumption The Malicia ground truth labels for the five selected families are correct
    The entire evaluation rests on these labels; no label verification is described in Section 4.1.
  • domain assumption svm.SVC(probability=True) yields reliable probability estimates for stacking
    Introduced in Section 4.5; Platt-scaled SVM probabilities are not true probabilities and may be poorly calibrated.
  • domain assumption Static byte-level features are sufficient to separate these malware families
    The paper only uses static features (Section 3) and does not compare with dynamic features on this dataset.
  • domain assumption A single 80-20 split is representative of model performance
    Results in Section 4 have no repeated splits or confidence intervals; the comparison treats one split as the outcome.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Multimodal Techniques for Malware Classification." pith.science (2026). https://pith.science/paper/STKR22AO

@misc{pith2026250110956,
  author       = {Pith},
  title        = {Pith review of: Multimodal Techniques for Malware Classification},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/STKR22AO}},
  note         = {Machine review of arXiv:2501.10956}
}
read the original abstract

The threat of malware is a serious concern for computer networks and systems, highlighting the need for accurate classification techniques. In this research, we experiment with multimodal machine learning approaches for malware classification, based on the structured nature of the Windows Portable Executable (PE) file format. Specifically, we train Support Vector Machine (SVM), Long Short-Term Memory (LSTM), and Convolutional Neural Network (CNN) models on features extracted from PE headers, we train these same models on features extracted from the other sections of PE files, and train each model on features extracted from the entire PE file. We then train SVM models on each of the nine header-sections combinations of these baseline models, using the output layer probabilities of the component models as feature vectors. We compare the baseline cases to these multimodal combinations. In our experiments, we find that the best of the multimodal models outperforms the best of the baseline cases, indicating that it can be advantageous to train separate models on distinct parts of Windows PE files.

Figures

Figures reproduced from arXiv: 2501.10956 by the authors.

Figure 1
Figure 1. Structure of a Portable Executable (PE) file [ [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. DOS header [38] the section name, virtual size, virtual address, raw data size, and assigned permissions. These headers contain the crucial information required by the loader to correctly map each section into memory with appropriate attributes, such as read, write, or execute permissions. Both the Section Table and the Optional Header play important roles in the loading and execution of a PE file but address differ… view at source ↗
Figure 3
Figure 3. The separating hyperplane of an SVM According to [4, p. 9], “SVMs are a rare example of a methodology where geometric intuition, elegant mathematics, theoretical guarantees, and practical algorithms meet.” We note in passing that the SVM technique easily general￾izes to multiclass data, in which case the technique is sometimes referred to as Support Vector Classifier (SVC). 2.2.2 Long Short-Term Memory In this secti… view at source ↗
Figures from the paper (8 more)
Figure 4
Figure 4. Figure 4: LSTM operators “⊗” and “⊕” are pointwise multiplication and addition, respectively, while “ ‖ ” indicates concatenation of vectors. The vector 𝑖𝑡 is the “input gate,” 𝑓𝑡 is the “forget gate,” and 𝑜𝑡 is the “output gate.” The vector 𝑔𝑡 is an interme￾diate gate and is so…
Figure 5
Figure 5. Figure 5: One timestep of an LSTM The gate vectors that appear in [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: A convolutional layer CNNs typically employ multiple convolutional layers. The first convolutional layer learns intuitive features, such as edges and gradients, while higher convolu￾tional layers learn progressively more abstract features, which ultimately allows for d…
Figure 7
Figure 7. Figure 7: Number of samples for each malware family [PITH_FULL_IMAGE:figures/full_fig_p015_7.png]
Figure 8
Figure 8. Figure 8: SVM: Accuracy comparison across experiments [PITH_FULL_IMAGE:figures/full_fig_p016_8.png]
Figure 9
Figure 9. Figure 9: LSTM: Accuracy comparison across experiments [PITH_FULL_IMAGE:figures/full_fig_p017_9.png]
Figure 10
Figure 10. Figure 10: CNN: Accuracy comparison across experiments [PITH_FULL_IMAGE:figures/full_fig_p018_10.png]
Figure 11
Figure 11. Figure 11: Accuracy comparison across all experiments [PITH_FULL_IMAGE:figures/full_fig_p019_11.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

46 extracted references · 42 canonical work pages

  1. [1]

    Evolution of mal- ware threats and techniques: A review

    Mohammad Nasser Alenezi, Haneen Khalid Alabdulrazzaq, Abdullah Ab- dulhai Alshaher, and Mubarak Mohammad Alkharang. Evolution of mal- ware threats and techniques: A review. International Journal of Commu- nication Networks and Information Security , 12(3):326–337, 2020. 20

    work page 2020

  2. [2]

    Anderson and Phil Roth

    Hyrum S. Anderson and Phil Roth. EMBER: An open dataset for training static PE malware machine learning models. https://arxiv.org/abs/ 1804.04637, 2018

    arXiv 2018

  3. [3]

    A systematic literature review on multimodal machine learning: Applications, challenges, gaps and future directions

    Arnab Barua, Mobyen Uddin Ahmed, and Shahina Begum. A systematic literature review on multimodal machine learning: Applications, challenges, gaps and future directions. IEEE Access, 11:14804–14831, 2023

    work page 2023

  4. [4]

    Bennett and Colin Campbell

    Kristin P. Bennett and Colin Campbell. Support vector machines: Hype or hallelujah? SIGKDD Explorations, 2(2):1–13, 2000

    work page 2000

  5. [5]

    PE format

    Karl Bridge et al. PE format. https://learn.microsoft.com/en-us/ windows/win32/debug/pe-format

    work page

  6. [6]

    A comparison of word2vec, hmm2vec, and pca2vec for malware classification

    Aniket Chandak, Wendy Lee, and Mark Stamp. A comparison of word2vec, hmm2vec, and pca2vec for malware classification. In Mark Stamp, Mamoun Alazab, and Andrii Shalaginov, editors, Malware Analysis Using Artificial Intelligence and Deep Learning , pages 287–320. Springer, 2021

    work page 2021

  7. [7]

    An intuitive guide to convolutional neural net- works

    Daphne Cornelisse. An intuitive guide to convolutional neural net- works. https://medium.freecodecamp.org/an-intuitive-guide-to- convolutional-neural-networks-260c2de0a050, 2018

    work page 2018

  8. [8]

    Computer Hope

    Cridex malware. Computer Hope. https://www.computerhope.com/ jargon/c/cridex-malware.htm, 2017

    work page 2017

Show all 46 references
  1. [9]

    Austin, and Mark Stamp

    Anusha Damodaran, Fabio Di Troia, Corrado Aaron Visaggio, Thomas H. Austin, and Mark Stamp. A comparison of static, dynamic, and hybrid analysis for malware detection. Journal of Computer Virology and Hacking Techniques, 13(1):1–12, 2015

    2015

  2. [10]

    A comprehensive guide to PE structure, the layman’s way

    Satyajit Daulaguphu. A comprehensive guide to PE structure, the layman’s way. https://tech-zealots.com/malware-analysis/pe- portable-executable-structure-malware-analysis-part-2/#: ~: text=And%20PE%20file%20format%20is,scr%2C%20and%20

  3. [11]

    A beginner’s guide to understanding convolutional neu- ral networks

    Adit Deshpande. A beginner’s guide to understanding convolutional neu- ral networks. https://adeshpande3.github.io/A-Beginner%27s-Guide- To-Understanding-Convolutional-Neural-Networks/ , 2018

    2018

  4. [12]

    Machine learning for windows malware detection and classi- fication: Methods, challenges, and ongoing research

    Daniel Gibert. Machine learning for windows malware detection and classi- fication: Methods, challenges, and ongoing research. In Dimitris Gritzalis, Kim-Kwang Raymond Choo, and Constantinos Patsakis, editors, Malware: Handbook of Prevention and Detection , pages 143–173. Spri...

    2025

  5. [13]

    Steunebrink, and J¨ urgen Schmidhuber

    Klaus Greff, Rupesh Kumar Srivastava, Jan Koutn´ ik, Bas R. Steunebrink, and J¨ urgen Schmidhuber. LSTM: A search space odyssey. IEEE Transac- tions on Neural Networks and Learning Systems , 28(10):2222–2232, 2017. https://arxiv.org/pdf/1503.04069.pdf

    2017 arXiv

  6. [14]

    MDENet: Multi-modal dual-embedding networks for malware open-set recognition

    Jingcai Guo, Yuanyuan Xu, Wenchao Xu, Yufeng Zhan, Yuxia Sun, and Song Guo. MDENet: Multi-modal dual-embedding networks for malware open-set recognition. https://arxiv.org/abs/2305.01245, 2023. 21

    2023 arXiv

  7. [15]

    Alexa blogs: How Alexa is learning to converse more naturally

    Arpit Gupta. Alexa blogs: How Alexa is learning to converse more naturally. https://developer.amazon.com/blogs/alexa/post/15bf7d2a-5e5c- 4d43-90ae-c2596c9cc3a6/how-alexa-is-learning-to-converse- more-naturally, 2018

    2018

  8. [16]

    Long short-term memory

    Sepp Hochreiter and J¨ urgen Schmidhuber. Long short-term memory. Neural Computation, 9(8):1735–1780, 1997. http://www.bioinf.jku.at/ publications/older/2604.pdf

    1997

  9. [17]

    Convolutional neu- ral networks and extreme learning machines for malware classification.Jour- nal of Computer Virology and Hacking Techniques , 16(3):229–244, 2020

    Mugdha Jain, William Andreopoulos, and Mark Stamp. Convolutional neu- ral networks and extreme learning machines for malware classification.Jour- nal of Computer Virology and Hacking Techniques , 16(3):229–244, 2020

    2020

  10. [18]

    Modeling visual neurons with convolutional neural net- works

    Ioannis Kalfas. Modeling visual neurons with convolutional neural net- works. https://towardsdatascience.com/modeling-visual-neurons- with-convolutional-neural-networks-e9c01ddfdfa7 , 2018

    2018

  11. [19]

    Convolutional neural networks for visual recognition

    Andrej Karpathy. Convolutional neural networks for visual recognition. http://cs231n.github.io/convolutional-networks/, 2018

    2018

  12. [20]

    The number of new malicious files detected every day increases by 5.2% to 360,000 in 2020

    Kaspersky. The number of new malicious files detected every day increases by 5.2% to 360,000 in 2020. https://www.kaspersky.com/about/press- releases/the-number-of-new-malicious-files-detected-every- day-increases-by-52-to-360000-in-2020 , 2020

    2020

  13. [21]

    Virus Bulletin: Inside the PE file format

    Sanjay Katkar. Virus Bulletin: Inside the PE file format. https://www.virusbulletin.com/virusbulletin/2006/06/inside- pe-file-format/, 2006

    2006

  14. [22]

    Swarm optimization and machine learning applied to pe malware detection towards cyber threat intelligence

    Santosh Jhansi Kattamuri, Ravi Kiran Varma Penmatsa, Sujata Chakravarty, and Venkata Sai Pavan Madabathula. Swarm optimization and machine learning applied to pe malware detection towards cyber threat intelligence. Electronics, 12(2), 2023

    2023

  15. [23]

    Google AI blog: Chat smarter with Allo

    Pranav Khaitan. Google AI blog: Chat smarter with Allo. https://ai. googleblog.com/2016/05/chat-smarter-with-allo.html, 2016

    2016

  16. [24]

    Robust IoT malware detection and classification using opcode cat- egory features on machine learning

    Hyunjong Lee, Sooin Kim, Dongheon Baek, Donghoon Kim, and Doosung Hwang. Robust IoT malware detection and classification using opcode cat- egory features on machine learning. IEEE Access, 11:18855–18867, 2023

    2023

  17. [25]

    The iBrain is here—and it’s already inside your phone

    Steven Levy. The iBrain is here—and it’s already inside your phone. Wired. https://www.wired.com/2016/08/an-exclusive-look-at-how- ai-and-machine-learning-work-at-apple/ , 2016

    2016

  18. [26]

    Lecture 10: Recurrent neu- ral networks

    Fei-Fei Li, Justin Johnson, and Serena Yeung. Lecture 10: Recurrent neu- ral networks. http://cs231n.stanford.edu/slides/2017/cs231n_2017_ lecture10.pdf, 2017

    2017

  19. [27]

    A comparison of graph neural networks for malware classification

    Vrinda Malhotra, Katerina Potika, and Mark Stamp. A comparison of graph neural networks for malware classification. Journal of Computer Virology and Hacking Techniques, 20:53–69, 2024. 22

    2024

  20. [28]

    Zubair Rafique, and Juan Caballero

    Antonio Nappa, M. Zubair Rafique, and Juan Caballero. The MALICIA dataset: Identification and analysis of drive-by download operations. Inter- national Journal of Information Security , 14(1):15–33, 2015

    2015

  21. [29]

    Carbonell

    George Philipp, Dawn Song, and Jaime G. Carbonell. The exploding gradi- ent problem demystified — Definition, prevalence, impact, origin, tradeoffs, and solutions. https://arxiv.org/pdf/1712.05577.pdf, 2018

    2018 arXiv

  22. [30]

    https://pillow.readthedocs.io/en/stable/, 2011

    Pillow. https://pillow.readthedocs.io/en/stable/, 2011

    2011

  23. [31]

    An empirical analysis of image- based learning techniques for malware classification

    Pratikkumar Prajapati and Mark Stamp. An empirical analysis of image- based learning techniques for malware classification. In Mark Stamp, Mamoun Alazab, and Andrii Shalaginov, editors, Malware Analysis Using Artificial Intelligence and Deep Learning , pages 411–435. Springer, 2021

    2021

  24. [32]

    Nicholas

    Edward Raff, Jon Barker, Jared Sylvester, Robert Brandon, Bryan Catan- zaro, and Charles K. Nicholas. Malware detection by eating a whole EXE. In The Workshops of the The Thirty-Second AAAI Conference on Artificial Intelligence, volume WS-18 of AAAI Technical Report, pages 268...

    2018

  25. [33]

    Moss´ e Cyber Security Institute

    Reverse engineering portable executables PE — part 2. Moss´ e Cyber Security Institute. https://library.mosse-institute.com/articles/ 2022/05/reverse-engineering-portable-executables-pe-part- 2/reverse-engineering-portable-executables-pe-part-2.html , 2022

    2022

  26. [34]

    A PE header-based method for malware detection using clustering and deep embedding tech- niques

    Tina Rezaei, Farnoush Manavi, and Ali Hamzeh. A PE header-based method for malware detection using clustering and deep embedding tech- niques. Journal of Information Security and Applications , 60:102876, 2021

    2021

  27. [35]

    Darknet traffic clas- sification and adversarial attacks using machine learning

    Nhien Rust-Nguyen, Shruti Sharma, and Mark Stamp. Darknet traffic clas- sification and adversarial attacks using machine learning. Computers & Security, 127:103098, 2023. https://www.sciencedirect.com/science/ article/pii/S0167404823000081

    2023

  28. [36]

    Microsoft Security Intelligence

    SecurityShield. Microsoft Security Intelligence. https://www. microsoft.com/en-us/wdsi/threats/malware-encyclopedia- description?Name=SecurityShield, 2019

    2019

  29. [37]

    ModCGAN: A multimodal approach to detect new malware

    Shobhit and Padmalochan Bera. ModCGAN: A multimodal approach to detect new malware. In 2021 International Conference on Cyber Situational Awareness, Data Analytics and Assessment , CyberSA, pages 1–2, 2021

    2021

  30. [38]

    Introduction to the PE file format

    Skr1x. Introduction to the PE file format. https://skr1x.github.io/ portable-executable-format/, 2020

    2020

  31. [39]

    Support vector machine algorithm in machine learning

    Qiyu Wang. Support vector machine algorithm in machine learning. In 2022 IEEE International Conference on Artificial Intelligence and Computer Ap- plications, ICAICA, pages 750–756, 2022

    2022

  32. [40]

    Qiaokun Wen and K.P. Chow. CNN based zero-day malware detection using small binary segments. Forensic Science International: Digital Investiga- tion, 38:301128, 2021. 23

    2021

  33. [41]

    Microsoft Security Intelligence

    Win32/Zbot. Microsoft Security Intelligence. https://www.microsoft. com/en-us/wdsi/threats/malware-encyclopedia-description?Name= Win32/Zbot, 2017

    2017

  34. [42]

    Google’s neural machine translation system: Bridging the gap between human and machine translation

    Yonghui Wu et al. Google’s neural machine translation system: Bridging the gap between human and machine translation. https://arxiv.org/ abs/1609.08144, 2016

    2016 arXiv

  35. [43]

    Deep learning versus gist descriptors for image-based malware classi- fication

    Sravani Yajamanam, Vikash Raja Samuel Selvin, Fabio Di Troia, and Mark Stamp. Deep learning versus gist descriptors for image-based malware classi- fication. In Paolo Mori, Steven Furnell, and Olivier Camp, editors, Proceed- ings of the 4th International Conference on Informat...

    2018

  36. [44]

    Byte-level malware classification based on Markov images and deep learning

    Baoguo Yuan, Junfeng Wang, Dong Liu, Wen Guo, Peng Wu, and Xuhua Bao. Byte-level malware classification based on Markov images and deep learning. Computers & Security , 92:101740, 2020

    2020

  37. [45]

    ODTC: An online darknet traffic classification model based on multi- modal self-attention chaotic mapping features

    Jiangtao Zhai, Haoxiang Sun, Chengcheng Xu, and Wenqian Sun. ODTC: An online darknet traffic classification model based on multi- modal self-attention chaotic mapping features. Electronic Research Archive, 31(8):5056–5082, 2023

    2023

  38. [46]

    EnigmaSoft: Rootkit.HareBot

    ZulaZuza. EnigmaSoft: Rootkit.HareBot. https://www.enigmasoftware. com/rootkitharebot-removal/, n.d. Appendix The results of all multimodal combinations tested are given in Figure A.1. For additional details on the multimodal experiments used to generate these results, see Sec...

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.