{
  "id": 13474,
  "title": "Golden feature",
  "url": "/competitions/malware-classification/discussion/13474",
  "author_name": "",
  "post_date": "2015-04-17T23:37:24.457Z",
  "votes": 4,
  "comment_count": 6,
  "views": 1441,
  "content": "<p>Ok, we don't know how this is going to end, but we're posting this before the final results (cause you know, if finals ain't good no one will know as it ain't gonna be said). We feel it should be shared anyway. The ratio of header lines count and header size in characters(from asm files) is great feature. It allows you to distinguish between classes very accurately. We suspect this has no real value in&nbsp; distinguishing between malware and normal SW, but here it plays great role. We discovered this by running various interactions between features.</p>\n<p>We're writing this cause we think we should help the malware companies to keep our data safe.</p>\n<p>P.S. this is not a shitty excuse for ideas cause we are out of submissions anyway.</p>\n<p>best of luck,</p>\n<p>gmilosev &amp; abhishek</p>",
  "messages": [
    {
      "id": "72194",
      "postDate": "04/17/2015 23:37:24",
      "content": "<p>Ok, we don't know how this is going to end, but we're posting this before the final results (cause you know, if finals ain't good no one will know as it ain't gonna be said). We feel it should be shared anyway. The ratio of header lines count and header size in characters(from asm files) is great feature. It allows you to distinguish between classes very accurately. We suspect this has no real value in&nbsp; distinguishing between malware and normal SW, but here it plays great role. We discovered this by running various interactions between features.</p>\n<p>We're writing this cause we think we should help the malware companies to keep our data safe.</p>\n<p>P.S. this is not a shitty excuse for ideas cause we are out of submissions anyway.</p>\n<p>best of luck,</p>\n<p>gmilosev &amp; abhishek</p>",
      "rawMarkdown": "",
      "votes": null
    },
    {
      "id": "72199",
      "postDate": "04/18/2015 00:05:03",
      "content": "<p>I wish I had more time to use the image binary data. I didnt see that post until too late.</p>",
      "rawMarkdown": "",
      "votes": null
    },
    {
      "id": "72200",
      "postDate": "04/18/2015 00:07:31",
      "content": "<p>As I said it's posted before the final results, cause with 33th place it would not be published.</p>",
      "rawMarkdown": "",
      "votes": null
    },
    {
      "id": "72202",
      "postDate": "04/18/2015 00:10:11",
      "content": "<p>[quote=gmilosev;72200]</p>\n<p>As I said it's posted before the final results, cause with 33th place it would not be published.</p>\n<p>[/quote]</p>\n<p>It was more of a general comment about features. I ended up building a model with the binary data and another model with the asm data then blending but didnt think to use ASM/BIN combined data. My computational setup was kind of slow which made feature making cumbersome (Need to get a multi TB drive).&nbsp;</p>",
      "rawMarkdown": "",
      "votes": null
    },
    {
      "id": "72209",
      "postDate": "04/18/2015 00:27:51",
      "content": "<p>We have submissions that could have got a very good rank. I think in the end it was just because of one malware that fucked up our results. Anyways, we will post the best result on private set with all the documentation about features soon.... Maybe it will help others...</p>",
      "rawMarkdown": "",
      "votes": null
    },
    {
      "id": "72210",
      "postDate": "04/18/2015 00:28:48",
      "content": "<p>I used gzip compression ratio to normal file size as a feature. It seemed pretty good at the start of the competition.</p>",
      "rawMarkdown": "",
      "votes": null
    },
    {
      "id": "72212",
      "postDate": "04/18/2015 00:32:36",
      "content": "<p>&gt;&gt;I used gzip compression ratio to normal file size as a feature. It seemed pretty good at the start of the competition.</p>\n<p>I've tried to use it too (as approximation for Kolmogorov complexity), but it performs slightly worse &nbsp;than simple asm\\bytes sizes ratio.</p>",
      "rawMarkdown": "",
      "votes": null
    }
  ],
  "comments": [
    {
      "id": 72199,
      "author_name": "jbsilva",
      "author_url": "",
      "post_date": "04/18/2015 00:05:03",
      "content": "<p>I wish I had more time to use the image binary data. I didnt see that post until too late.</p>",
      "votes": null,
      "replies": []
    },
    {
      "id": 72200,
      "author_name": "gmilosev",
      "author_url": "",
      "post_date": "04/18/2015 00:07:31",
      "content": "<p>As I said it's posted before the final results, cause with 33th place it would not be published.</p>",
      "votes": null,
      "replies": []
    },
    {
      "id": 72202,
      "author_name": "jbsilva",
      "author_url": "",
      "post_date": "04/18/2015 00:10:11",
      "content": "<p>[quote=gmilosev;72200]</p>\n<p>As I said it's posted before the final results, cause with 33th place it would not be published.</p>\n<p>[/quote]</p>\n<p>It was more of a general comment about features. I ended up building a model with the binary data and another model with the asm data then blending but didnt think to use ASM/BIN combined data. My computational setup was kind of slow which made feature making cumbersome (Need to get a multi TB drive).&nbsp;</p>",
      "votes": null,
      "replies": []
    },
    {
      "id": 72209,
      "author_name": "abhishek",
      "author_url": "",
      "post_date": "04/18/2015 00:27:51",
      "content": "<p>We have submissions that could have got a very good rank. I think in the end it was just because of one malware that fucked up our results. Anyways, we will post the best result on private set with all the documentation about features soon.... Maybe it will help others...</p>",
      "votes": null,
      "replies": []
    },
    {
      "id": 72210,
      "author_name": "mikeskim",
      "author_url": "",
      "post_date": "04/18/2015 00:28:48",
      "content": "<p>I used gzip compression ratio to normal file size as a feature. It seemed pretty good at the start of the competition.</p>",
      "votes": null,
      "replies": []
    },
    {
      "id": 72212,
      "author_name": "mikhailtrofimov",
      "author_url": "",
      "post_date": "04/18/2015 00:32:36",
      "content": "<p>&gt;&gt;I used gzip compression ratio to normal file size as a feature. It seemed pretty good at the start of the competition.</p>\n<p>I've tried to use it too (as approximation for Kolmogorov complexity), but it performs slightly worse &nbsp;than simple asm\\bytes sizes ratio.</p>",
      "votes": null,
      "replies": []
    }
  ],
  "raw_markdown_by_id": {
    "72194": "",
    "72199": "",
    "72200": "",
    "72202": "",
    "72209": "",
    "72210": "",
    "72212": ""
  },
  "source": "meta"
}