# SK-Tree: a systematic malware detection algorithm on streaming trees via the signature kernel

arXiv: https://arxiv.org/abs/2102.07904 · HTML: https://mlsanity.com/paper/2102.07904/

## Key facts

- Cited by 16 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 16 Feb 2021.

## Built on by (most cited first, 16 of 16)

- [Theoretical Foundations of Deep Selective State-Space Models](https://mlsanity.com/paper/2402.19047/) (2024)
- [Non-adversarial training of Neural SDEs with signature kernel scores](https://mlsanity.com/paper/2305.16274/) (2023)
- [Neural signature kernels as infinite-width-depth-limits of controlled ResNets](https://mlsanity.com/paper/2303.17671/) (2023)
- [Signature Kernel Conditional Independence Tests in Causal Discovery for Stochastic Processes](https://mlsanity.com/paper/2402.18477/) (2024)
- [Structured Linear CDEs: Maximally Expressive and Parallel-in-Time Sequence Models](https://mlsanity.com/paper/2505.17761/) (2025)
- [Lecture notes on rough paths and applications to machine learning](https://mlsanity.com/paper/2404.06583/) (2024)
- [Capturing Graphs with Hypo-Elliptic Diffusions](https://mlsanity.com/paper/2205.14092/) (2022)
- [Exact Gradients for Stochastic Spiking Neural Networks Driven by Rough Signals](https://mlsanity.com/paper/2405.13587/) (2024)
- [pySigLib -- Fast Signature-Based Computations on CPU and GPU](https://mlsanity.com/paper/2509.10613/) (2025)
- [ParallelFlow: Parallelizing Linear Transformers via Flow Discretization](https://mlsanity.com/paper/2504.00492/) (2025)
- [ANUBIS: A Provenance Graph-Based Framework for Advanced Persistent Threat Detection](https://mlsanity.com/paper/2112.11032/) (2021)
- [Numerical Schemes for Signature Kernels](https://mlsanity.com/paper/2502.08470/) (2025)
- [Log-PDE Methods for Rough Signature Kernels](https://mlsanity.com/paper/2404.02926/) (2024)
- [Novelty detection on path space](https://mlsanity.com/paper/2512.03243/) (2025)
- [Random Controlled Differential Equations](https://mlsanity.com/paper/2512.23670/) (2025)
- [Faithful Embeddings of Irregular and Asynchronous Data for Online Log-NCDEs](https://mlsanity.com/paper/2605.30213/) (2026)

## Abstract (arXiv)

The development of machine learning algorithms in the cyber security domain has been impeded by the complex, hierarchical, sequential and multimodal nature of the data involved. In this paper we introduce the notion of a streaming tree as a generic data structure encompassing a large portion of real-world cyber security data. Starting from host-based event logs we represent computer processes as streaming trees that evolve in continuous time. Leveraging the properties of the signature kernel, a machine learning tool that recently emerged as a leading technology for learning with complex sequences of data, we develop the SK-Tree algorithm. SK-Tree is a supervised learning method for systematic malware detection on streaming trees that is robust to irregular sampling and high dimensionality of the underlying streams. We demonstrate the effectiveness of SK-Tree to detect malicious events on a portion of the publicly available DARPA OpTC dataset, achieving an AUROC score of 98%.