{
  "id": 12651,
  "title": "Model that based upon assembly language instructions",
  "url": "/competitions/malware-classification/discussion/12651",
  "author_name": "",
  "post_date": "2015-03-02T01:57:08.630Z",
  "votes": 4,
  "comment_count": 3,
  "views": 1776,
  "content": "<p>Seems&nbsp;in the forum we are all talking about models that&nbsp;use byte counts. But I found using&nbsp;assembly language instructions(such as mov, jmp, add) as features&nbsp;has&nbsp;a better performance.&nbsp;</p>\n<p>A random forest with instruction count features gives me&nbsp;a LB lower than 0.04. It surprised me a lot since this model has only 13 features, while byte counts model has 256.&nbsp;</p>",
  "messages": [
    {
      "id": "65206",
      "postDate": "03/02/2015 01:57:08",
      "content": "<p>Seems&nbsp;in the forum we are all talking about models that&nbsp;use byte counts. But I found using&nbsp;assembly language instructions(such as mov, jmp, add) as features&nbsp;has&nbsp;a better performance.&nbsp;</p>\n<p>A random forest with instruction count features gives me&nbsp;a LB lower than 0.04. It surprised me a lot since this model has only 13 features, while byte counts model has 256.&nbsp;</p>",
      "rawMarkdown": "",
      "votes": null
    },
    {
      "id": "65209",
      "postDate": "03/02/2015 02:36:07",
      "content": "<p>[quote=Jiming Ye;65206]</p>\n<p>Seems&nbsp;in the forum we are all talking about models that&nbsp;use byte counts. But I found using&nbsp;assembly language instructions(such as mov, jmp, add) as features&nbsp;has&nbsp;a better performance.&nbsp;</p>\n<p>A random forest with instruction count features gives me&nbsp;a LB lower than 0.04. It surprised me a lot since this model has only 13 features, while byte counts model has 256.&nbsp;</p>\n<p>[/quote]</p>\n<p>Sure they do. but byte also gives complementary&nbsp;information to instructions.</p>",
      "rawMarkdown": "",
      "votes": null
    },
    {
      "id": "65215",
      "postDate": "03/02/2015 04:55:00",
      "content": "<p>@Jiming Ye</p>\n<p>I haven't dug into the .ASM files yet but have managed .03ish with very simple byte-based model.</p>\n<p>Curious how you (or anyone else)&nbsp;were approaching the ASM files?</p>\n<p>Just querying common commands? or are you chewing through the whole file and thresholding based on what you are seeing.</p>\n<p>Not asking for any secret sauce but any thoughts would be appreciated. &nbsp;Good luck!</p>",
      "rawMarkdown": "",
      "votes": null
    },
    {
      "id": "65219",
      "postDate": "03/02/2015 07:09:03",
      "content": "<p>[quote=Timothy Scharf;65215]</p>\n<p>@Jiming Ye</p>\n<p>I haven't dug into the .ASM files yet but have managed .03ish with very simple byte-based model.</p>\n<p>Curious how you (or anyone else)&nbsp;were approaching the ASM files?</p>\n<p>Just querying common commands? or are you chewing through the whole file and thresholding based on what you are seeing.</p>\n<p>Not asking for any secret sauce but any thoughts would be appreciated. &nbsp;Good luck!</p>\n<p>[/quote]</p>\n<p>Just number of each commands like mov, cmp, db, dd,.etc</p>\n<p>Very simple, and I know nothing about assembly language</p>",
      "rawMarkdown": "",
      "votes": null
    }
  ],
  "comments": [
    {
      "id": 65209,
      "author_name": "jiweiliu",
      "author_url": "",
      "post_date": "03/02/2015 02:36:07",
      "content": "<p>[quote=Jiming Ye;65206]</p>\n<p>Seems&nbsp;in the forum we are all talking about models that&nbsp;use byte counts. But I found using&nbsp;assembly language instructions(such as mov, jmp, add) as features&nbsp;has&nbsp;a better performance.&nbsp;</p>\n<p>A random forest with instruction count features gives me&nbsp;a LB lower than 0.04. It surprised me a lot since this model has only 13 features, while byte counts model has 256.&nbsp;</p>\n<p>[/quote]</p>\n<p>Sure they do. but byte also gives complementary&nbsp;information to instructions.</p>",
      "votes": null,
      "replies": []
    },
    {
      "id": 65215,
      "author_name": "scharf",
      "author_url": "",
      "post_date": "03/02/2015 04:55:00",
      "content": "<p>@Jiming Ye</p>\n<p>I haven't dug into the .ASM files yet but have managed .03ish with very simple byte-based model.</p>\n<p>Curious how you (or anyone else)&nbsp;were approaching the ASM files?</p>\n<p>Just querying common commands? or are you chewing through the whole file and thresholding based on what you are seeing.</p>\n<p>Not asking for any secret sauce but any thoughts would be appreciated. &nbsp;Good luck!</p>",
      "votes": null,
      "replies": []
    },
    {
      "id": 65219,
      "author_name": "yejiming",
      "author_url": "",
      "post_date": "03/02/2015 07:09:03",
      "content": "<p>[quote=Timothy Scharf;65215]</p>\n<p>@Jiming Ye</p>\n<p>I haven't dug into the .ASM files yet but have managed .03ish with very simple byte-based model.</p>\n<p>Curious how you (or anyone else)&nbsp;were approaching the ASM files?</p>\n<p>Just querying common commands? or are you chewing through the whole file and thresholding based on what you are seeing.</p>\n<p>Not asking for any secret sauce but any thoughts would be appreciated. &nbsp;Good luck!</p>\n<p>[/quote]</p>\n<p>Just number of each commands like mov, cmp, db, dd,.etc</p>\n<p>Very simple, and I know nothing about assembly language</p>",
      "votes": null,
      "replies": []
    }
  ],
  "raw_markdown_by_id": {
    "65206": "",
    "65209": "",
    "65215": "",
    "65219": ""
  },
  "source": "meta"
}