mlsanityData to 7 Oct 2026

Hamm-Grams: An Algorithm for Mining Regular Expressions of Bytes

arXiv 2607.01445 ↗First posted 1 Jul 2026cs.CR cs.LGcited by 0

Not on the map. Why?

Abstract (arXiv)

Malware poses a critical and ever-evolving threat, and robust and effective systems for detecting and classifying malware are of essential importance. n-grams features are among the common static features used in effective machine learning systems for malware, but these features are inherently brittle. We propose an algorithm for constructing more robust features, hamm-grams, which are a special class of regular expressions having a fixed length and single-character wildcards. We devise an efficient algorithm for finding common hamm-grams using a new locality-sensitive hash designed to produce collisions among pairs of small Hamming distance and a clustering within hash buckets to place wildcards. We then demonstrate the advantages of these features in malware classification and detection tasks.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Builds on 12 of its 47 references that are in the map. First posted on arXiv 1 Jul 2026.

Builds on

12 of 47 references.

References · 12

  1. 2020MCUNet: Tiny Deep Learning on IoT Devicescited by 269
  2. 2018EMBER: An Open Dataset for Training Static PE Malware Machine Learning Modelscited by 164
  3. 2019An Observational Investigation of Reverse Engineers' Processescited by 20
  4. 2021MOTIF: A Large Malware Reference Dataset with Ground Truth Family Labelscited by 17
  5. 2021A Framework for Cluster and Classifier Evaluation in the Absence of Reference Labelscited by 16
  6. 2025ClarAVy: A Tool for Scalable and Accurate Malware Family Labelingcited by 10
  7. 2019KiloGrams: Very Large N-Grams for Malware Classificationcited by 9
  8. 2017Lempel-Ziv Jaccard Distance, an Effective Alternative to Ssdeep and Sdhashcited by 8
  9. 2023Small Effect Sizes in Malware Detection? Make Harder Train/Test Splits!cited by 4
  10. 2024Living off the Analyst: Harvesting Features from Yara Rules for Malware Detectioncited by 3
  11. 2025Zipf-Gramming: Scaling Byte N-Grams Up to Production Sized Malware Corporacited by 2
  12. 2025Intermediate N-Gramming: Deterministic and Fast N-Grams For Large N and Large Datasetscited by 2

Built on by

Not cited yet.