Hamm-Grams: An Algorithm for Mining Regular Expressions of Bytes
For malware analysts and security systems, hamm-grams provide more robust features that improve classification accuracy.
The paper proposes hamm-grams, a robust regular expression-based feature for malware classification, and demonstrates their effectiveness over traditional n-grams in detection tasks.
Malware poses a critical and ever-evolving threat, and robust and effective systems for detecting and classifying malware are of essential importance. $n$-grams features are among the common static features used in effective machine learning systems for malware, but these features are inherently brittle. We propose an algorithm for constructing more robust features, hamm-grams, which are a special class of regular expressions having a fixed length and single-character wildcards. We devise an efficient algorithm for finding common hamm-grams using a new locality-sensitive hash designed to produce collisions among pairs of small Hamming distance and a clustering within hash buckets to place wildcards. We then demonstrate the advantages of these features in malware classification and detection tasks.