# Malware Classification with GMM-HMM Models

arXiv: https://arxiv.org/abs/2103.02753 · HTML: https://mlsanity.com/paper/2103.02753/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 1 of its 38 references that are in the map.
- First posted on arXiv 3 Mar 2021.

## Builds on (most cited first, 1 of 1)

- [History of malware](https://mlsanity.com/paper/1302.5392/) (2013)

## Built on by (most cited first, 2 of 2)

- [A Natural Language Processing Approach to Malware Classification](https://mlsanity.com/paper/2307.11032/) (2023)
- [Malware Classification using a Hybrid Hidden Markov Model-Convolutional Neural Network](https://mlsanity.com/paper/2412.18932/) (2024)

## Abstract (arXiv)

Discrete hidden Markov models (HMM) are often applied to malware detection and classification problems. However, the continuous analog of discrete HMMs, that is, Gaussian mixture model-HMMs (GMM-HMM), are rarely considered in the field of cybersecurity. In this paper, we use GMM-HMMs for malware classification and we compare our results to those obtained using discrete HMMs. As features, we consider opcode sequences and entropy-based sequences. For our opcode features, GMM-HMMs produce results that are comparable to those obtained using discrete HMMs, whereas for our entropy-based features, GMM-HMMs generally improve significantly on the classification results that we have achieved with discrete HMMs.