Self-Supervised Representations for Binary Program Clustering: From Empirical Study to Retrieval-Augmented Learning
Not on the map. Why?
Abstract (arXiv)
Malware clustering is a critical task in cybersecurity that helps discover threats and analyze evolving malware families. While self-supervised learning (SSL) and tabular representation learning (TRL) have achieved breakthroughs in other domains, their application to binary program clustering (the task of clustering all incoming samples regardless of label) remains largely unexplored. This study presents the first systematic investigation of SSL and TRL methods for binary program clustering, conducted in two phases on the public Ember and Bodmas datasets. In Phase 1, we establish a performance ceiling by adapting prominent vision-based SSL models (BYOL, SimSiam, Barlow Twins, VICReg) for tabular data with supervised pair generation, finding that BYOL and SimSiam achieve performance comparable to fully supervised models, while Barlow Twins and VICReg significantly underperform. In Phase 2, we evaluate purely unsupervised TRL methods against strong baselines (PCA, Autoencoder, UMAP), demonstrating that VIME establishes a new state of the art for binary program clustering. Informed by these findings, we propose VIME-R, a retrieval-augmented extension of VIME that replaces random marginal-distribution corruption with retrieval-based augmentation to generate more informative training pairs. VIME-R further improves upon VIME, achieving 2.7%-5.8% higher Homogeneity on both datasets. Our results highlight retrieval-augmented tabular representation learning as a promising direction for enhancing automated malware analysis. Code will be made available.
Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 14 of its 33 references that are in the map. First posted on arXiv 3 Aug 2026.
Builds on
14 of 33 references.
References · 14
- 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
- 2020Bootstrap your own latent: A new approach to self-supervised Learningcited by 4,750
- 2020Exploring Simple Siamese Representation Learningcited by 2,866
- 2021Barlow Twins: Self-Supervised Learning via Redundancy Reductioncited by 1,838
- 2021VICReg: Variance-Invariance-Covariance Regularization for Self-Supervised Learningcited by 1,057
- 2018EMBER: An Open Dataset for Training Static PE Malware Machine Learning Modelscited by 165
- 2021SCARF: Self-Supervised Contrastive Learning using Random Feature Corruptioncited by 156
- 2021SubTab: Subsetting Features of Tabular Data for Self-Supervised Representation Learningcited by 104
- 2024SwitchTab: Switched Autoencoders Are Effective Tabular Learnerscited by 38
- 2023Nebula: Self-Attention for Dynamic Malware Analysiscited by 8
- 2023Classification and Online Clustering of Zero-Day Malwarecited by 3
- 2024MalMixer: Few-Shot Malware Classification with Retrieval-Augmented Semi-Supervised Learningcited by 3
2 more
Built on by
Not cited yet.
Similar, not cited
Close in wording, no citation either way
- 2026Identifying Adversary Tactics and Techniques in Malware Binaries with an LLM Agent
- 2026LLM-Enhanced Hierarchical Heterogeneous Graph Representation Learning for Malicious Python Package Detection
- 2026Trident: Improving Malware Detection with LLMs and Behavioral Features
- 2025Beyond Embeddings: Interpretable Feature Extraction for Binary Code Similarity
- 2024Label-free Monitoring of Self-Supervised Learning Progress
- 2025MalVol-25: A Diverse, Labelled and Detailed Volatile Memory Dataset for Malware Detection and Response Testing and Validation
- 2026LCC-LLM: Leveraging Code-Centric Large Language Models for Malware Attribution
- 2026Toward Autonomous SOC Operations: End-to-End LLM Framework for Threat Detection, Query Generation, and Resolution in Security Operations