# Identifying Authorship Style in Malicious Binaries: Techniques, Challenges & Datasets

arXiv: https://arxiv.org/abs/2101.06124 · HTML: https://mlsanity.com/paper/2101.06124/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 15 Jan 2021.

## Built on by (most cited first, 2 of 2)

- [CodeArt: Better Code Models by Attention Regularization When Symbols Are Lacking](https://mlsanity.com/paper/2402.11842/) (2024)
- [On Technique Identification and Threat-Actor Attribution using LLMs and Embedding Models](https://mlsanity.com/paper/2505.11547/) (2025)

## Abstract (arXiv)

Attributing a piece of malware to its creator typically requires threat intelligence. Binary attribution increases the level of difficulty as it mostly relies upon the ability to disassemble binaries to identify authorship style. Our survey explores malicious author style and the adversarial techniques used by them to remain anonymous. We examine the adversarial impact on the state-of-the-art methods. We identify key findings and explore the open research challenges. To mitigate the lack of ground truth datasets in this domain, we publish alongside this survey the largest and most diverse meta-information dataset of 15,660 malware labeled to 164 threat actor groups.