extfieldsofstudy:
Mathematics
Computer Science

text:
Automatic Malware Description via Attribute Tagging and Similarity Embedding

With the rapid proliferation and increased sophistication of malicious software (malware), detection methods no longer rely only on manually generated signatures but have also incorporated more general approaches like machine learning detection. Although powerful for conviction of malicious artifacts, these methods do not produce any further information about the type of threat that has been detected neither allows for identifying relationships between malware samples. In this work, we address the information gap between machine learning and signature-based detection methods by learning a representation space for malware samples in which files with similar malicious behaviors appear close to each other. We do so by introducing a deep learning based tagging model trained to generate human-interpretable semantic descriptions of malicious software, which, at the same time provides potentially more useful and flexible information than malware family names. We show that the malware descriptions generated with the proposed approach correctly identify more than 95% of eleven possible tag descriptions for a given sample, at a deployable false positive rate of 1% per tag. Furthermore, we use the learned representation space to introduce a similarity index between malware files, and empirically demonstrate using dynamic traces from files' execution, that is not only more effective at identifying samples from the same families, but also 32 times smaller than those based on raw feature vectors.

Abstract-With the rapid proliferation and increased sophistication of malicious software (malware), detection methods no longer rely only on manually generated signatures but have also incorporated more general approaches like machine learning detection. Although powerful for conviction of malicious artifacts, these methods do not produce any further information about the type of threat that has been detected neither allows for identifying relationships between malware samples. In this work, we address the information gap between machine learning and signature-based detection methods by learning a representation space for malware samples in which files with similar malicious behaviors appear close to each other. We do so by introducing a deep learning based tagging model trained to generate humaninterpretable semantic descriptions of malicious software, which, at the same time provides potentially more useful and flexible information than malware family names.
We show that the malware descriptions generated with the proposed approach correctly identify more than 95% of eleven possible tag descriptions for a given sample, at a deployable false positive rate of 1% per tag. Furthermore, we use the learned representation space to introduce a similarity index between malware files, and empirically demonstrate using dynamic traces from files' execution, that is not only more effective at identifying samples from the same families, but also 32 times smaller than those based on raw feature vectors.

I. INTRODUCTION
Whenever one or more malicious files are found in a computer network, the first step towards remediation is to understand the nature of the attack in progress. Knowing the malicious capabilities associated with each suspicious file gives important context to network defenders which helps them define and prioritize counter-measures.
Generally, anti-virus (AV) or anti-malware solutions provide a detection name when they alert about potentially harmful files detected in a machine as a way to provide this context. These detection names usually come from specific signatures written by reverse engineers to identify particular threats, therefore encoding expert knowledge about a given malware sample. While this is theoretically useful for categorizing known malware variants, differing malware naming conventions among vendors have led to detection names that are inconsistent and highly vendor-specific [1], [2]. For example, Worm.Ludbaruma.B and Win32.Worm.VB.k, are detection names produced by two different vendors for the same file. The problem of inconsistent naming conventions has been compounded due to more feature-rich malware and increased quantities of threats over time. Moreover, some detection names serve only as unique identifiers and do not provide actionable information about what type of harm the malicious sample could do if it infects a system (e.g. Gen:Variant.Razy.260309 or Trojan (005153df1)).
When a novel malware variant appears, applying existing detection names, or even measuring similarity with known malicious files is problematic, since current rule-based signatures will likely not trigger on these variants at all. Machine learning (ML) malware detectors have the potential to identify these new malware samples as malicious, but generally do not provide further information about the type of threat encountered neither on how it relates with the universe of known malware.
In this paper, with existing detection naming issues in mind, we propose to use Semantic Malware Attribute Relevance Tagging (SMART) to approach malicious software description. In contradistinction to prior malware (family) detection names, this semantic malware attribute tags approach yields human interpretable, high level descriptions of the capabilities of a given malware sample. They can convey different types of information such as purpose ('crypto-miner', 'dropper'), family ('ransomware'), and file characteristics ('packed'). SMART tags are related to malware family names in the sense that they attempt to describe how a piece of malicious software executes and the intent behind it. However, unlike malware family names, malware tags are non-exclusive, meaning that one malware campaign (or family) can be associated with multiple tags and a given tag can be associated with multiple malware families.
The number of tags is also inherently bounded by types of malicious behavior and chosen granularity in description. Thus, a fixed number of tags can roughly describe all malicious samples, even when the number of malware families increases dramatically. Because of this, the tagging approach makes the task of malware description suitable to be addressed with machine learning methods.
Semantic attribute tags also serve as a common ground to integrate knowledge from multiple sources or detection technologies since they do not presume standard naming conventions. For the experiments in this paper, we derive tags by leveraging the underlying knowledge encoded in detection names from different anti-malware vendors in the industry, although the general framework applies whenever we have multiple analyses of the same file.
Using our derived tags, we then train a multi-label deep neural network to automatically predict tags for new (unseen) files in real time. Our approach only assumes access to the files' static binary representations. We find that our network yields impressive performance on the tag prediction task. It does so by learning a low dimensional Euclidean representation space in which malware samples with similar characteristics are close to each other. Figure 1 provides an overview of the proposed tagging system: during the model training phase we use binary files and malware descriptions generated by multiple expert systems to train a machine learning model, that can later be deployed to automatically produce descriptive tags for new files in a fraction of a second.
Moreover, the proposed approach of describing malicious capabilities by learning a low dimensional embedding space (and associated embedding function) for malicious files enables us to compare malware samples by semantic similarity in terms of type of malicious content. This compressed representation further allows for efficient indexing, searching and querying of malware corpora along explainable dimensions. This ability is particularly useful for identifying new samples of a novel malware campaign from which we only have identified a small number of samples -even one. As we will show, this similarity metric in latent space also opens the door to novel applications in the context of endpoint detection and response (EDR) technologies, such as natural language queries, mapping how a given (potentially novel) malware campaign relates to and compares with known malware, and alerts prioritization based on malicious content, among others.
The primary contributions of this paper are as follows: 1) We introduce the task of automatic malicious tag pre-diction for malware description, and propose a Joint Embedding neural network architecture and training methodology that allows us to generate descriptive tags for malware files with high true positive rates at low false positive rates in a static fashion (without executing the software). 2) We empirically demonstrate that our neural networks learn a compact, yet expressive representation space for binary files which is informed by their malicious capabilities. 3) We propose a novel file-file similarity index based on the representation space of our neural networks that enables for efficient indexing and searching in large malware corpora along interpretable dimensions. The remainder of this paper is structured as follows: In Section II we discuss existing approaches to malware description, particularly family names and hierarchies and review attempts to establish industry-wide standard naming conventions. We also discuss related research in the machine learning for information security (ML-Sec) space as well as similar applications in other domains, such as image tagging, music information retrieval, and semantic facial attribute recognition. In Section III, we define the concept of describing malware with semantic tags, and present one method for deriving semantic tags from binary executable files by aggregating detection names from multiple vendors in the industry, that can easily scale to millions of files. We then formalize the problem of malware characterization as a tagging problem in Section IV, and propose two neural network architectures for tag prediction. In Section V, we train several neural networks and evaluate their performance on the tagging task. We analyze our results and their ramifications in Section VI. In Section VII we analyze the latent space learned by the proposed neural networks and identify practical applications in the domain of information security. Finally, we present conclusions and propose directions for future research in Section VIII.

II. BACKGROUND AND RELATED WORK
In this section we revisit the idea of malware description by using family classification, review the concept of attribute tagging in other domains, and survey related machine learning approaches in the field of machine learning for information security (ML-Sec).

A. Malware Family Categorization
Identifying the family and variant of a particular malicious sample can provide important intelligence to the end user, administrator or security operator of a system about what type of attack might be underway. This extra contextual information can help define a remediation procedure, identify possible root causes, and evaluate the severity and potential consequences of the attack. In fact, numerous vendors provide in their websites detailed information about popular family/variant information, with associated description of what that variant does, and suggest how a particular piece of malware can be removed. Without such identifying information, we are left only with the offending file itself as its own description. Unless some reverse engineering effort is taken, which can be costly, it is difficult to discern much about the internals of the file.
The idea to identify all malware under a consistent family naming scheme across multiple vendors has been around for decades. It first came to the attention of the security community in the early 1990's and prompted the Computer Antivirus Research Organization (CARO) to propose a first naming convention in 1991 [3], which was was later extended to add coverage for new kinds of malicious software such as backdoors, trojans, joke programs and droppers, among others [4].
The threat landscape has changed dramatically since the introduction of the CARO standard nearly 30 years ago. The quantity of new malware samples that security vendors' labs receive has increased dramatically, to millions per month. Some of these samples are variations of previously known malware, while others take code from older campaigns and re-purpose it for new tasks. Yet still others, are entirely novel types of malware. In this scenario it becomes practically unfeasible to manually and consistently group each malicious file into a well defined hierarchy of families. Even the arguably simpler task of assigning a malware file into an existing family has also become much harder, as malware became more resistant to signature-focused detection, thanks to advanced obfuscation measures such as polymorphism and metamorphism, (repeated) packing and obfuscation, recompilation, and self-updating [5].
The increasing quantities of malware samples and the resilience to signature methods caused the security community to start using more flexible analytic tools than signatures designed only to identify a single malware variant [6], and increasingly rely on dynamic analysis and more generic signatures when possible [7]. While generic signatures offer an advantage for malware conviction, the nature of this approach makes it more difficult to organize malware names into families. Moreover, the quantities of malicious files to be analyzed has led to less structured categorizations and greater inconsistencies between vendors. In particular, modern security vendor detection names typically fall into one of four categories, containing varying amounts of information about the threat family to which a malware sample belongs.
Traditional family based: Names are associated with unique and distinctive attributes of the malware and its variants. Malware classified under these names usually have a larger amount of original source code or a novel exploit mechanism and often come from the same origins. This not only gives them a distinctive attribute that can aid in the classification, but also requires researchers to put forth more effort to analyze their inner-workings. These types of detection names are often of high-quality and have more consistency across vendors.
Today, these detection names are most often seen in parasitic file-infectors and specific botnet campaigns with distinctive attributes, e.g. Virut, Sality, Conficker, etc. These types of names usually use a suffix to identify specific variants, which often denotes a revision to the malware or change in the con-figuration data for use in a different campaign. E.g. Mal/Sality-D.
Technique based: These types of detection names group together malware that may come from different origins and/or have multiple authors but share a common method or technique. For example, many executable autorun worms have been written in the past using languages languages like Visual Basic 6 or AutoIt that change explorer's file and folder view settings to hide filename extensions and employ an icon resource similar to that of a popular document format. Due to the relatively low complexity of the infection method many amateurs copied this technique resulting in a large amount of similar malware that was not necessarily of the same origin, neither tries to perform the same action in the host machine.
Some anti-malware solutions would generically detect and classify many of these malware samples under the same generic family name, where other vendors may have have defined different more specific criteria for each family classification based on other attributes of the payload. When a generic family name provided by the AV vendor, they oftentimes replace the detection name suffix with a partial hash of the file data in order to identify a specific sample. The difference in detection methods employed often results in less consistency in detection names across vendors. E.g. Troj/AutoIt-CHN.
Method based: This type of detection name simply denotes the detection technology used to detect the malware sample. Some detection names can simply be that of a patented technology, project, or internal code name specific to the AV vendor, indicating the use of heuristics, ML, or realtime detection technologies like cloud look-ups. In these cases the detection name is not that of a malware family, but that of the method that was utilized to detect the sample. E.g. Unsafe.AI Score 64%.
Kit based: AV vendors will often use more generic family names for detecting malware that has been generated by a known kit. These kits are often referred to as grey hat tools, as they can be used both offensively by penetration testing teams and by malware authors. Many of these kits obfuscate their payloads in attempt to circumvent detection by AV software. Detection names in this category tend to not describe the origins or functionality of the specific malicious payload, but instead identify methods used by the kit or tool to obfuscate or hide their payload. E.g. Trojan:Win32/Meterpreter.gen!C.
In [8], Marcos et al. identified a number of naming inconsistencies across cybersecurity vendors, and proposed AVClass: a malware labeling tool that uses data-mining techniques to distill family names for malware samples by combining detection names from multiple anti-malware solutions. Complementary to AVclass, Perdisci et. al. proposed an automated technique in [9] which relies on individual detection names from multiple vendors, for evaluating the quality of a given malware clustering. We follow the idea of combining detection names from multiple vendors to better understand the nature of malware samples, but instead of trying to fit each new sample to a naming scheme with mutually exclusive hierarchical categories such as families, we propose an alternate approach to describing the functionality and the relationship between malicious samples by using attribute tags. A set of attribute tags describes a piece of malware through easy to interpret properties, and can be thought of as a soft-family classification, since it describes the sample and relates it with other samples described with the same (or an overlapping) set of tags. The advantage of the tagging approach is that it does not presume a partition on the malware space by genealogy, while providing potentially more actionable information about a malware sample.
The idea of describing malware through a set of descriptive attributes instead of using malware families is not new: The MITRE corporation developed the Malware Attribute Enumeration and Characterization (MAEC) Effort [10], a standardized language for attribute-based malware characterization, in version 5.0 at the time of writing. This structured language aims to encode all possible known information about malware based upon an extensive list of attributes such as behaviors, capabilities, artifacts, and relationships between malware samples, among others. Because the level of detail in the descriptions proposed in MAEC, it becomes prohibitively expensive to characterize a large corpus of malware samples with these attributes. Furthermore, the set of samples that it is possible to characterize with this method is highly biased towards those that can be executed in a controlled sandbox environment. For the purpose of this work, we decide to work with a reduced, independently defined set of tags. Nevertheless, the techniques we explore throughout this paper apply to broader attribute definitions.

B. Semantic Attribute Tagging
Semantic attribute tagging refers to the association of samples with key-words that convey various types of high-level information about their content. These tags can later be used to interpret or summarize the content of the sample, for information retrieval in a large database of samples or for clustering, among others. In the last decade the use of tags has become a popular method for organizing and describing digital information. Content platforms use tags for images, video, audio, news articles, blog posts, and even questions in question-answering forums.
Automatic content tagging algorithms attempt to annotate data by learning the relationships between the tags and the content. Because any given sample can be related to multiple tags, this task can be, and usually is, framed as a multilabel prediction problem within the field of machine learning. Automatic image [11]- [16] and audio [17]- [19] tagging are among the most popular areas of research in automatic attribute tag prediction today. State of the art text, image and audio tagging algorithms use deep learning techniques which require massive datasets of tagged samples to train on. These datasets are often generated collaboratively (either directly or indirectly), meaning that multiple sources annotate some part of the dataset independently of each other. As noted by Choi et al. in [18], this way of obtaining labeled information is a noisy process which has to be accounted for in the design and evaluation of the learning algorithm. Particularly Choi et al. study the effect of noisy labels when training deep neural networks in the multi-label classification setup, particularly when the noise is skewed towards the negative labels.
Semantic attribute tagging has two important characteristics worth considering: i) it can convey a lot of identifying information about a sample, even if the the sample is novel. Facial attribute tagging [20]- [25], for example, has repeatedly demonstrated that vectors of attribute predictions (e.g., gender, hair color, ethnicity, etc.) from one or more classifiers can themselves be powerful feature vector representations for face recognition and verification algorithms; ii) semantic tags can be stored, structured, and retrieved in a human interpretable manner [25]. Both of these characteristics are appealing in a commercial computer security use case where the type of the threat can be roughly identified by a description that makes sense to security researchers and end users.

C. Multi-Label Classification
We briefly mentioned in Section II-B that semantic attribute tagging relies on multi-label classification, wherein we aim to predict multiple labels simultaneously. There are several ways to do this, the most trivial of which is to learn one classifier per label. This naive approach is not efficient in the sense that one classifier does not benefit from what the other classifiers have learned about a given sample. Furthermore, it can be unfeasible from a deployment perspective, particularly as the number of labels grow. For correlated labels, a popular approach is to use a single classifier with multiple outputs, one per output label. The total loss for the classifier is obtained by adding together the loss terms across the model's outputs during training and optimizing over a multi-objective loss. Not only does this yield a more compact representation but it also improves classification performance over using independent classifiers [21]. We use as our baseline architecture a multilabel deep neural network architecture in Section IV which exploits a shared representation of the input samples, and has multiple binary cross entropy loss functions atop stacks of hidden layers, or heads, with final sigmoid outputs -one per tag.
An alternative approach to multi-label classification, first introduced in the image tagging and retrieval literature, is to learn a compact shared vector space representation to which map both input samples and labels -a joint embedding [11]- [15], [26] -where similar content across modalities (images and tags for image tagging) are projected into similar vectors in the same low dimensional space. At query time, a similarity comparison between vectors in this learned latent space is performed, e.g., via inner product, to determine likely labels. A variety of models could be employed to form a joint embedding, but crucially, the embedding is optimized across input modalities/labels. In Section IV we present a joint embedding model that maps malware tags and executable files into the same low dimensional Euclidean space for the malware description problem.

D. Malware Analysis with Neural Networks
In recent years multiple advances in machine learning for information security (ML-Sec) have taken place. This can be attributed to several factors including an explosion in labeled data available from vendor aggregation services and threat intelligence feeds, and more powerful hardware and software frameworks for fitting highly expressive classifiers, along with a need of the cybersecurity industry to incorporate more flexible methods to improve their detection pipelines. In this work we focus particularly on analysis over Windows Portable Executable (PE) files based on static features, i.e. information that can be extracted from the binary files without having to execute them.
In contrast to our work which focuses on malware description and representation, most modern applications of deep learning have focused on malware detection. Saxe et al. [27] applied deep neural network detection to feature vectors derived from 2-dimensional histogram statistics of PE files along with hashed delimited strings and hashed elements from the file header, including metadata and import tables. Further applications of deep learning exploiting similar feature sets have been used to categorize web content [28], office documents [29], and archive formats [29]. Other types of features and classifiers have also been used for the task of PE malware detection. For instance, Raff et al. demonstrated in [30] a way to effectively identify malware using solely an embedding of the first 300 bytes from the PE header. In later work, Raff et al. proposed an embedding strategy which takes in the entire PE file [31] for the same problem. In [32], Bugra and Erdogan use a disassembler to retrieve the opcodes of the executable files and then a shallow network based on WORD2VEC [33] to embed them into a continuous vector space. Afterwards, they train a gradient search algorithm based on Gradient Boosting Machines for the malware classification task.
The two approaches that are most related to our work are the works conducted by Huang et al. in [34] which uses the auxiliary task of predicting family detection names with the goal of improving the performance on their detection model, and by Rudd et al. in [35], work that is contemporaneous to ours, where the authors study the impact of using multiple auxiliary loss terms on a multitude of tasks, one of which is tag prediction, in parallel to the main binary detection task and conclude that using these auxiliary information during training is beneficial for the performance on the main task. Note, however, that the purposes of the auxiliary losses in these works were to improve performance on the main malicious/benign detection task and are not concerned with descriptions of malicious software, similarities between them, or latent representations.

III. SEMANTIC MALWARE ATTRIBUTE TAGS
We define SMART tags (which we will also refer to as a malicious or malware tags) as a potentially informative, highlevel attributes of malicious or potentially unwanted software. These tags are loosely related to malware families, in the sense that they attempt to describe how a piece of malicious software executes and the intent behind it, but they do so in a more general and flexible way. One malware campaign (or family) can be associated with more than one tag, and a given tag is associated with multiple families. For the purpose of this study, and without loss of generality, we define a set of malicious tags T , with |T | = 11 different tags (or descriptive dimensions) of interest that we can use to describe malicious PE files: adware, crypto-miner, downloader, dropper, file-infector, flooder, installer, packed, ransomware, spyware, and worm. We chose this particular set of tags so that we can generate concise descriptions for most common malware currently found in the wild. The definitions for each of the tags can be found in Appendix A.
Since malware tags are defined at a different level of abstraction than malware families, we can bypass the problem of not having a common naming strategy for malicious software, and thus exploit the knowledge contained in multiple genealogies generated from different sources in a quasiindependent manner: detection technologies, methodologies, etc. It becomes irrelevant if one source identifies a sample as being part of the Qakbot family while another calls it Banking Trojan so long as we have a way to associate those two correctly with the spyware tag 1 . Furthermore, this approach allows us to exploit the fact that some sources might have stronger detection rules for certain kinds of malware.
In the remainder of this section we propose a simple labeling strategy used to generate tags at scale for a given set of files that combines information encoded in the detection names of several anti-malware solutions and then translates them into semantic tags.
In later sections we will use this labeled set for both training and evaluation of deep neural networks (DNNs) that annotate previously unseen samples in real time, by solely looking at their binary representation.

A. Tag Distillation from Detection Names
High quality tags for malware samples at the scale required to train deep learning models can be prohibitively expensive to create manually. Instead, we rely on semi-automatic strategies that are noisier than manual labeling, but allow us to label millions of files that can then be used to train our classifiers. For this purpose, we propose a labeling function that annotates PE files using the previously defined set of tags by combining information contained in detection names from multiple vendors 2 . In this work we use family names from ten antimalware solutions that are known to produce high quality detection names, as our starting point. We note that, using multiple anti-malware vendors is one possible strategy for labeling that leverages expert knowledge about a given sample. Nevertheless, the overall framework we propose can easily  None INDICATES THAT THE VENDOR HAS NOT IDENTIFIED THE SAMPLE AS MALICIOUS. IN THE  SECOND COLUMN THE TOKENS PARSED AND NORMALIZED FROM THE DETECTION NAMES ARE LISTED. THE LAST COLUMN SHOWS THE TAGS  ASSOCIATED WITH THE TOKENS IN THE MIDDLE COLUMN. THIS ASSOCIATION IS REPRESENTED BY USING THE SAME COLOR IN THE TOKENS AND THEIR   RELATED TAGS accommodate multiple other sources for labeling information, including manual and sandbox-derived (dynamic) analyses.
The labeling process for our experiments consists of three main stages: i) token extraction, ii) token-to-tag mapping, and iii) token relationship mining. The token extraction phase consists normalizing and parsing the multiple detection names and converting them in sets of sub-strings (bag of tokens representation). In a similar way that the AVClass labeling tool [8] does, the token-to-tag mapping stage uses rules that associate relevant tokens with the set of tags of interest. These association rules were created from expert knowledge by a group of malware analysts. Finally, we extend this mapping by mining statistical relationships between tokens to improve tagging stability and coverage. Example outputs of each intermediate stage of the tag distillation are represented in Table I. The full details for the proposed labeling procedure can be found in Appendix B.
The tags obtained with this labeling strategy can be noisy because of the "crowd-sourcing" nature of the method used in extracting information (tokens) from multiple quasiindependent sources. On the other hand, this methodology has the advantage of being cheap to compute and having high coverage over samples, which is critical for developing a high quality ML model.
It is also important to note that this labeling technique generates primarily positive relations: meaning that a tag being present identifies a relationship between the sample and the tag, but its absence does not necessarily imply a strong negative relation.

IV. TAGS PREDICTION
The goal our work is to flexibly predict important malware qualities from static features, which we more formally define as multi-label classification problem, since zero or more tags from the set of T possible tags T = {t 1 , t 2 , . . . , t T } can be present at the same time for a given sample. In order to predict these tags, we propose two different neural network architectures, both represented in Figure 2, which we will refer to as Multi-Head (top) and Joint Embedding (bottom). Using samples and corresponding tags we train two neural network architectures to predict malware tags. Top: Multi-Head architecture, consisting of a base feed-forward network with one "head" for each tag t i that it is trained to predict. Each of the heads is composed of dense layers followed by ELU nonlinearities, and a final sigmoid activation function. Bottom: Joint Embedding model, which represents (embeds) both the binary samples x and the malicious tags in the same low dimensional space. The prediction layer issues predictions based on the distances between sample embeddings h and tag embeddings e in this space.
The Multi-Head architecture can be thought as an extension of the network used in [27] to multiple outputs. It consists of a base topology that is common to the prediction of all tags, and one output (or "head") per tag. The base topology can be thought of a feature extraction (or embedding) network that transforms the input features x into low dimensional hidden vector h, while each head is a binary classifier that predicts the presence or absence of each tag from it. Both parts of the architecture consist of multiple blocks composed of dropout [36], a dense layer, batch normalization [37], and an exponential linear unit (ELU) activation function [38]. The only exceptions are the input layer, which does not use dropout, and the very last layer of each head, which uses a sigmoid activation unit to compute the predicted probability for each label.
The Joint Embedding model, as shown at the bottom of Figure 2, is introduced with three main purposes: i) in an attempt to better model semantic similarities between tags; ii) to explicitly define a low dimensional space that allows us to naturally measure similarities between files; and iii) to have a more flexible architecture that can scale to larger number of tags.
This model maps both the labels (malware tags) and the binary file features x to vectors in a joint Euclidean latent space. These embedding functions of files and tags are learnt via stochastic gradient descent in a way such that, for a given similarity function, the transformations of semantically similar labels are close to each other, and the embedding of a binary file should be close to that of its associated labels in the same space. This architecture consists on a PE embedding network, a tag embedding matrix E, and a prediction layer.
The PE embedding network learns a nonlinear function φ θ (·), with parameters θ that maps the input binary representation of the PE executable file x ∈ R d into a vector h ∈ R D in low dimensional Euclidean space, The tag embedding matrix E ∈ R T ×D learns a mapping from a tag t n ∈ T = {t 1 , . . . , t T }, to a distributed representation e ∈ R D in the joint embedding space, In practice, the embedding vector for the tag t n is simply the n-th row of the tag embedding matrix, i.e. φ E (t n ) = E n . Finally, the prediction layer compares both the tag and the sample embeddings (e and h respectively) and produces a similarity score that is run through a sigmoid non-linearity to estimate the probability that sample x is associated with tag t for each t ∈ T . In our final model implementation, the similarity score is the dot product between the embedding vectors. The output of the network f n (x|θ, E) then becomes, where σ is the sigmoid activation function, andŷ n is the probability estimated by the model of tag t n being a descriptor for x.
We further constrain the embedding vectors for the tags as suggested in [15], such that: which acts as a regularizer for the model. We observed in practice that this normalization indeed leads to better results on the validation set. Unless stated differently we fixed the value of C to 1. We also experimented with constraining the norm of the PE embeddings to 1, and analogously using cosine similarity instead of a dot product as a similarity score between tags' and files' embeddings. In both cases we observed deteriorated performance on the validation set. This drop in performance was more noticeable for those samples with multiple tags (more than 4), suggesting that the network is using the magnitude of the PE embedding vector to achieve high similarity scores for multiple tags concurrently. As part of our experimentation we also tried to learn the similarity score by concatenating together the PE and tag embeddings and running the resulting vector through feed forward layers with nonlinearities. However, we found that that the simpler approach of using dot product was both more effective on the tag prediction task and also lead to easier to interpret predictions.
Our goal, for a given PE file, is to learn a distributed, low dimensional representation of it, that is both "close" to the embedding of the tags that describe it and to other PE files with similar characteristics. The parameters of both embedding functions φ θ (·) and φ E (·) are jointly optimized to minimize the binary cross-entropy loss for the prediction of each tag via backpropagation and stochastic gradient descent. The loss function to minimize for a mini-batch of M samples becomes: where t (i) n = 1 if sample i is labeled with tag t n or zero otherwise, andŷ (i) n is the probability predicted by the network of that tag being associated with the i-th sample.
In practice, to get a vector of tag similarities for a given sample x with PE embedding vector h we multiply the matrix of tag embeddings E ∈ R T ×D by h ∈ R D and scale the output to obtain a prediction vectorŷ = σ(E·h) ∈ R T , where σ is the element-wise sigmoid function for transforming the similarity values into a valid probability. Each element inŷ is then the predicted probability for each tag.
We note that, because this model maps every tag into the same low dimensional space, it can explicitly account for similarities on the labels. That is, if two tags are likely to occur together, they will be mapped close to each other in embedding space. With this architecture, it is possible to train the model without the need of computing the loss for all negative labels using techniques such as negative sampling, where only positive labels and a randomly selected subset of negative labels are used in the inner summation of Equation IV. It would be possible to use a ranking loss as proposed in [15]. We defer the study of these optimizations for future work.
Finally, if we compare both models in Figure 2, they are mathematically similar, with the main differences being the explicit modeling of the tag embedding step (and its regularization), the subsequent explicit modeling of the joint embedding space that allows us to naturally perform label-tolabel and sample-to-sample similarity searches, and the ability to use various distance functions in the prediction layer.

A. Evaluation of Tagging Algorithms
There are different ways to evaluate the performance of tagging algorithms. Particularly, the evaluation can be done in a per-tag or a per-sample dimension. The former seeks to quantify how well our tagging algorithm performs on identifying each tag, while the latter focuses on the quality of the predictions for each sample instead.
In the per-tag case, one suitable way to evaluate the performance of the model is to measure the area under the receiver operating characteristic curve (AUC-ROC, or simply AUC) for each of the tags being predicted. A ROC curve is created by plotting the true positive rate (TPR) against the false positive rate (FPR). Also, since the target value for the n-th tag of a given sample is a binary True/False value (t n ∈ {0, 1}), binary classification evaluation metrics such as 'Accuracy', 'Precision', 'Recall', and 'F-score' also apply. To compute these metrics, the output probability prediction needs to be binarized. For the binarization of our predictions, we choose a threshold independently for each tag such that the FPR in the validation set is 0.01 and use the resulting 0/1 predictions. The fact that our labeling methodology introduces label noise -mostly associated with negative labels, as pointed out in Section III -makes recall the most adequate of these last four metrics to evaluate our tagging algorithms, since it ignores incorrect negative labels.
The per-sample evaluation dimension seeks to evaluate the performance of a tagging algorithm for a given sample, across all tags. Let T (i) be the set of tags associated with sample i andT (i) the set of tags predicted for the same sample after binarizing the predictions. We can use the Jaccard similarity (or index) J(T (i) ,T (i) ) as a figure of how similar both sets are. Furthermore, let y ∈ {0, 1} T be the binary target vector for a PE file, where y n indicates whether the n-th tag applies to the file andŷ be the binarized prediction vector from a given tagging model. We define the per-sample accuracy as the percentage of samples for which the target vector is equal to the prediction vector, i.e., all tags correctly predicted, or, in other words, the Hamming distance between the two vectors is zero. For an evaluation dataset with M samples we can use, Mean per-sample accuracy as our per-sample performance metrics for the tagging problem, where I is the indicator function which is 1 if the condition in the argument is true, and zero otherwise.

V. EXPERIMENTS
We trained the two proposed model architectures on the task of malware tagging from static analysis of binary files. After training different model sizes with different hyper-parameters in a smaller scale dataset (details below) and evaluating in a validation set, we trained our final network architectures (those model configurations that performed the best) using a large scale dataset to produce our final evaluation results. Finally, we evaluate the quality of the embedding spaces learned by both models as a way of determining similarities between malware files, and compare them with the original feature representation.
In this section we provide the experimental details of this process: particularly a description and analysis of the data used for training and validation along with a definition of the model topology and training methodology.

A. Data Description
For training purposes we collected two different sets, a medium size training set containing 10 million unique binary Windows Portable Executable (PE) files (D train-M ), and a large training set containing 76,204,855 unique PE files (D train-XL ), such that D train-M ⊂ D train-XL . The smaller training set was used for experimenting with different architectures and validation purposes, while the larger one was used to train our final models, whose architectures performed the best in the validation set when trained in the smaller dataset. These sets were obtained by random sampling of files first observed in our intelligence feed in the period between 06/25/2018 and 05/26/2019, but not seen after that. Similarly, we created a validation set, D val composed of 3,159,377 PE files, randomly sampled from the samples seen during the period of one month after the the training set (05/26/2019 to 06/26/2019). We used this set to compare the performance of different candidate models and architectures.
For the final evaluation we sampled 3,456,288 malware samples first seen in the threat intelligence feed between 07/01/2019 and 07/29/2019. This test set, D test is composed solely of malware samples to better understand the performance of our models when implemented in a real-world scenario of malware description.
For all D train-M and D train-XL , D val and D test we derived the semantic tags following the procedure described in Section III-A and detailed in Appendix B, using detection names from ten anti-malware solutions that we consider provide highquality names. The set of tokens and mappings used was based only on detection names from samples in D train , in order to avoid polluting our time split evaluation. We further derived a malicious/benign label for the samples in those sets using a voting scheme similar to [27], but extended to assign more importance to trusted vendors, and complemented with internal proprietary reputation scores, white and black lists. The large training set is composed of 79% malware samples and 21% benign samples. This ratio is similar for the small training set as well as the validation set.
For all the binary files in the three datasets we then extracted 1024-element feature vectors using the same feature representation as proposed in [27], which uses windowed byte statistics, 2-dimensional histograms of delimited string hash vs. length, and histograms of hashes of PE-format specific metadata such as imports from the import address table.
Table II summarizes the coverage for each of the tags across our train dataset D train . Most of our tags are almost exclusively associated with malicious samples, except for installer and packed which are associated with both benign and malicious files. Moreover, we see that 90% of the malicious samples have at least one tag describing them, indicating that the labeling approach has effectively a high coverage over the set of samples of interest. The mean number of tokens observed for each time that a tag appears is 5.57, which represents the degree of robustness of our labeling strategy against vendor mis-classifications or missing scans. Statistical synonym and parent-child relationships used to produce the tags were computed from the samples in the train dataset. Using both synonym and parent-child relationships derived from the empirical conditional probabilities of tokens improves not only the mean token redundancy but also the tag coverage for malicious samples for almost all our tags, leaving unaffected the tagging for benign samples. The coverage statistics for the validation and test sets are similar to the ones presented in the table and not shown here for space considerations.
We further analyze the distribution and pairwise relationships of the tags in our training dataset. In Figure 3 we plot the empirical conditional probability of the tags in the train set computed in a similar fashion as in Equation 6 by replacing token counts with tag counts. The value in row i and column j represents the empirical conditional probability of the tag t i given that tag t j is present,p(t i |t j ). This representation is useful to identify possible issues with the labeling mechanism as well as understanding the distribution of our tags. Furthermore, we can compare this matrix generated on the test set with the one derived from the predictions of the model (instead of the labels), to have a better understanding of the errors that the model is making. The value of the element in the i-th row and j-th column represents the empirical conditional probability of tag i given tag j,p(t i |t j ) for our labeling strategy.

B. Training Details
We trained the two model architectures introduced in Section IV on the training dataset D train-M with different number of layers and number of nodes per layer, each for 200 epochs using an Adam optimization procedure [39] on minibatches of 4096 samples and at a learning rate of 5 · 10 −4 . The combination of layer sizes and number of layers that performed best when trained in the smaller training set where then trained in the large training set D train-XL .
The shared base topology of the final Multi-Head architecture consists of an input feed-forward layer of output size 2048, followed by a batch normalization layer, an ELU nonlinearity and three blocks, each composed by dropout, a linear layer, batch normalization and ELU of output sizes 512, 128, and 32 respectively. Each output head is simply a linear layer (the same for each head) composed of the same type of basic blocks as are in the main base architecture, but with output size 11 (number of tags being predicted) and a sigmoid non-linearity instead of the ELU. Binary cross-entropy loss is computed at the output of each head and then added together to form the final loss.
The Joint Embedding architecture uses the same base topology as the Multi-Head model for the embedding of the PE files into a 32 dimensional joint latent space. An embedding matrix (E) of learnable parameters with size T ×32 is used for the embedding of the tags. We used dot product to compute the similarity between the PE file embedding and the tag embedding followed by a sigmoid non-linearity to produce an output probability score. As before, the sum of the pertag binary cross-entropy losses is used as the mini-batch loss during model training.
We found experimentally, for both network architectures, that having a wide input layer, i.e. increasing the number of dimensions in the first layer from an input representation of 1024 to 2048 dimensions was crucial to obtaining good performance in the tag prediction task.

VI. TAGGING RESULTS
As mentioned in Section IV-A there are two main dimensions of interest when analyzing the performance of malware tagging algorithm: a per-tag dimension, which evaluates how well each tag is predicted and a per-sample dimension, which focuses on how many samples are correctly predicted and how accurate those predictions are. In the following we analyze the performance of our models across these dimensions after training in the large scale dataset D train-XL and evaluating in the test dataset D test .
The evaluation results presented in this section take into consideration only those samples identified as malware by our labeling scheme. This is because the goal of our current tagging algorithm is to describe only malicious or potentially unwanted behaviors. At deployment time, we assume that the tagging models analyze samples already convicted by a complementary mechanism, and so we only evaluate on actual malware to resemble this deployment scenario. Only evaluating in malicious samples also allows us to compare results across different test sets that might not have the same malware/benign ratio of samples. In Appendix C we complement this results by evaluating the performance on a version of the test set D test that also contains benign samples, and show that the models' performance does not degrade in the presence of them, meaning that the trained models do not compulsory assign malicious tags to benign samples.

A. Per-Tag Results
After training the two proposed architectures we proceed to evaluate their performance on the test set D test . In Figure 4 we compare the per-tag true positive rate (TPR or recall) of both the Multi-Head and Joint Embedding architectures at a per-tag false positive rate (FPR) of 1%. The Joint Embedding architecture outperforms the baseline Multi-Head model by a small margin for all the tags except for packed and flooder for which the latter performs slightly better. The largest improvements over the baseline appear for the downloader and dropper tags, for which the Joint Embedding model outperforms the baseline by 3.6% and 2.4% respectively. We have observed this trend of obtaining better results with the Joint Embedding architecture consistently for other experiments -with different datasets, layer sizes, and activation functions -that we carried out during the development of this study. Table III provides a more thorough comparison of these two methods. Not only does the Joint Embedding model outperforms the baseline in terms of mean recall, but it also does so in terms of AUC for every tag except adware. For computing both recall and F-score we binarized the output using a threshold such that the FPR in the test set is 1% for each tag. For these two binary classification metrics, the Joint Embedding model exhibits better performance than the Multi-Head model on average: the Multi-Head architecture achieves a mean recall of 0.862 and mean F-score of 0.837 while the proposed Joint Embedding model achieves an average recall of 0.867 and a F-score of 0.841.

B. Per-Sample Results
Another way of analyzing our results is to measure the percentage of samples for which our models accurately predicted all tags. We are also interested in knowing how many tags on average (out of the 11 possible tags) each model correctly predicts per sample. For this we measure both the Jaccard similarity and the per-sample accuracy of our predictions according to equations 4 and 5 respectively. Under both   TABLE III  PER-TAG EVALUATION RESULTS FOR THE TWO PROPOSED ARCHITECTURES ON THE MALWARE SAMPLES OF THE TEST DATASET (DTEST ). BOTH RECALL  AND F-SCORE ARE COMPUTED BY BINARIZING EACH CLASSIFIERS OUTPUTS AT A FALSE POSITIVE RATE OF 0.01 ON THE TEST SET FOR EACH TAG. THE  WEIGHTED MEAN WEIGHTS THE CONTRIBUTION OF EACH TAG BY ITS SUPPORT. THE BEST RESULT BETWEEN THE TWO PROPOSED ARCHITECTURES FOR   EACH ROW IS HIGHLIGHTED IN  metrics the Joint Embedding model outperforms the Multi-Head approach. For the Joint Embedding architecture, the average number of samples for which we predict all the tags correctly is 66.8% while if we choose a sample at random, the model correctly predicts the presence (and absence) of each tag for almost 96% of the tags (10.53 over 11 possible tags correctly predicted) on average. It is important to note that, because of the relatively low number of tags per samplea mean of 2.26 in D test -the mean Jaccard similarity for a tagging algorithm that never predicts any tag would be 79.4% in this test set. Even though this baseline is already high, both our tagging models outperform it by a large margin, which signals that the models are effectively learning to identify relationships between tags and binary feature vectors.

VII. LATENT SPACE: ANALYSIS AND APPLICATIONS
Our results from Section VI show that the Joint Embedding approach is more suitable for malware tagging than the Multi-Head model architecture. Because the number of parameters in both networks is comparable, it means that the Joint Embedding network is learning a more informative internal representation of the binary files, guided by the ability to model, and therefore exploit tag relationships (labels structure) in the latent space.
This improved internal representation has, in turn, two main advantages compared with the original feature representation: i) it is highly compressed (32 dimensions versus 1024) which allows for indexing malware databases in a more efficient way, and perform similarity computations and nearest neighbor searches faster; and ii) this representation also provides a more informative space where to measure files' similarities in terms of malicious capabilities that is aligned with the original underlying family structure of malware.
In Section VII-A, we verify that the Joint Embedding model has learned a proper representation by examining its latent space and validating that PE file embeddings tend to cluster around their corresponding tag embeddings. We then explore the practical applications of having such a representation space within the context of information retrieval. In Section VII-B we compare the learnt representation space by the Joint Embedding model, with the intermediate 32 dimensional representation of the Multi-Head model (output of the Shared Base Topology, see Figure 2 top figure), and the input features, in terms of their ability to represent malware characteristics. We found that the more informed representation learned by the Joint Embedding model can be used to identify novel malware campaigns for which we may have a very small set of samples.

A. Malware-Tag Joint Embedding Space
As a way to validate and understand the latent space learned by our Joint Embedding model we used t-SNE [40] to reduce the dimensionality of the 32-dimensional latent space to a 2-dimensional representation as shown in Figure 5. In this visualization, large markers correspond to the embeddings of the tags themselves while small markers are the transformed embedding vectors for a subset of samples in the test set. Particularly, we randomly selected 750 samples annotated with a single tag for every tag, for a total of 8,250 test samples.
As one can see, the embeddings of the PE files labeled with the same tag tend to cluster together. Furthermore, the embeddings of the tag labels lie close to the clusters of samples they describe. This suggests that the Joint Embedding model has effectively learned to group file representations close to their corresponding tag representations, as intended. This structure in embedding space is a powerful representation for information retrieval (IR) applications. The task of malware tagging itself can be thought of as a particular case of IR, in which we we retrieve descriptive information for a query point (binary file) based on a distance function in latent space. Similarly, it is also be possible to perform file similarity searches: using one malware sample to retrieve other samples with similar malicious characteristics by simply retrieving files for which the embedding representation is close to the representation of the query sample. We explore how this can be used in the context of identifying samples from novel campaigns in Section VII-B. Furthermore, it can also be used for obtaining examples of malicious programs that fit a given tag description, where with given a combination of descriptive tags we can define a subspace within the embedding space containing those samples that closely match that particular tag combination of interest.

B. File-File Similarity Index
The proposed representation of PE files in embedding space, along with the distance function defined in this space, allows us to measure not only similarities between files' and tags' embeddings, but between files' representations as well.
Because of how our models were trained, two pieces of malware that are close to each other in latent space should exhibit similar malicious capabilities. This means that it is possible to use the latent representation of the files to measure how similar two pieces of malware are in terms of their capabilities. Moreover, the size of the file embedding representation (32 dimensions) is 32 times smaller than the original file feature representation (1024 dimensions). This makes the task of storing, indexing and querying large databases of malware more efficient.
In this section we evaluate the degree to which the embedding representation is more informative in terms of malware attributes when compared with the original 1024-dimensional feature representation. If the learned embedding function is effectively modeling malicious characteristics of the executable files, then a similarity analysis of files in this space should be more informative in terms of malware attributes' similarity than the original feature space. In other words, because we are indirectly training our models with malware families' information generated by a group of (quasi-)independent "experts" (anti-malware vendors), via tagging decomposition, then we expect to be able to differentiate malware campaigns from each other, even if they are described by the same set of tags.
We set to evaluate this, by first identifying well known malware families in the test set. To do so, we rely on a proprietary behavioral sandbox environment where we run a subset of the samples from the test set and look for specific patterns, known via reverse engineering, to be associated with notable malware campaigns. This patterns come from information in memory dumps, network traffic packet captures, file read and write operations, as well as many other activities that would not necessarily be observable with a static scan alone (and thus information not available to our models), since in its binary state, this data could be encrypted, or possibly not even present (as it may be downloadded at runtime).
With this method, we identified the top f = 13 most prominent malware campaigns in the test set that can be convicted with high confidence. Table VI in the Appendix lists the family names as well as their associated tags and counts in the test set. We note that there are a number of families with the same tag description, for instance remcos and emotet families are both described with the sypware tag.
Next, we created the joint embedding representation for these files using our already trained Joint Embedding network. For each file, we also created a continuous vector representation from the trained Multi-Head model by simply computing the output of the last layer (after the ELU activation) of the shared base topology, represented by h in the top diagram of Figure 2.
Finally, we set up the task of f -way family classification via nearest neighbor search. It consists in randomly sampling k files per family as anchor samples, and q files per family as query samples. Each of the (f · q) query samples is then predicted to belong to the same class as its closest anchor sample in feature space. A more descriptive representational space should separate malware families, i.e. pull those samples that belong to the same family close to each other while pushing away samples from other families, thus performing better on the nearest neighbor classification task.
We consider the neural network embeddings and the original choose 23 query samples per family and vary the number of anchor samples k from 1 to 10. We repeat the sampling process (for both anchors and query samples), classification and evaluation 15 times per value of k to obtain uncertainty estimates for our accuracy results. Figure 6 shows the f -way accuracy results for the 3 feature representations: derived from the Joint Embedding model (full orange line), derived from the Multi-Head model (dashed blue line) and computed directly from the binary files (same features that are the input to the neural network models during training -dotted green line). The baseline accuracy for a model that randomly picks a class is 7.7%, independently of the number of anchors. We see that the representation learnt by both the Joint Embedding and Multi-Head models is more effective in identifying family membership than the original set of features.
When the number of anchors is smaller, the mean accuracy for the neural embedding approaches outperforms the input features by a large margin. By only having access to a single malware sample from a given family (the case of one anchor) our approach accurately identifies, on average, 47% of the remaining samples from that family compared to 36% identified with the raw feature representation (more than 30% accuracy improvement). As the number of anchors grows, the task becomes simpler due to the fact that there is a higher likelihood of having an anchor that is a near duplicate of the query sample, and the improvements over the baseline smaller, although still noticeable. Particularly, the similarity metric from the Joint Embedding model performs slightly better than the one derived from the Multi-Head network representations. These results imply that, by learning a representation of malware files in a low dimensional space with a neural network informed by tagging labels, we not only gain the ability to perform tagging on new samples directly from the binary files, but can use it to cheaply compute files' similarities in a low dimensional space, based on their malicious characteristics.
This file similarity metric can then be effectively used in one or few-shot learning scenarios. This is incredibly useful when dealing with novel malware campaigns, as it provides an efficient and fast way of identifying files belonging to a new, recently introduced family for which we only have a limited number of samples (or even one).

VIII. CONCLUSION
In this paper we first introduced a novel method for malware description via automatic tagging with deep neural networks that learns to characterize malicious software by combining knowledge from multiple quasi-independent sources. With the proposed Joint Embedding model it is possible to accurately predict user interpretable attribute and behavioral descriptions of malicious files from static features, correctly predicting an average of more than 10.52 out of 11 tag descriptors per sample at a per-tag false positive rate of 0.01.
We then analyzed the embedding space learned by our neural networks trained on the task of malware description and showed that the files' representation in this space is more informative in terms of malicious capabilities, and also more compact, than the input feature space used to train the networks initially.
Finally, we introduced a file-to-file similarity index that is highly compressed (32 times with respect to the original feature representation), that allows us to perform more effective and better informed similarity searches over large malware databases along interpretable dimensions of malicious capabilities. We showed how this new metric can be used effectively in the context of few and one shot learning in which we aim to identify specimens of a new malware campaign. When only one example of a given malware family is available, our similarity index improves family classification accuracy by more than 30% over the baseline features. We also proposed a number of further applications of this similarity index for information retrieval applications.
We foresee multiple research paths as natural follow-ups to the ideas proposed herein as well as potential applications. Framing malware characterization as a tagging task not only provides a common lightweight description framework that can be extended to various detection and analysis technologies, but also allows for malware clustering, and alerts prioritization.
We are also interested in expanding the set of tags used to describe malware samples to a more, potentially hierarchical, taxonomy as well as experimenting with constrained embedding spaces such as hyperbolic spaces.

APPENDIX A TAG DEFINITIONS
• Downloader: Malicious program whose primary purpose and functionality is to download additional content. Often similar in usage to a Dropper. • Dropper: Malicious program that carries another program concealed inside itself, and drops that program onto an infected machine. • Ransomware: Malware whose goal is to encrypt or otherwise make inaccessible a user's files, to then demand payment to regain access to them. • Crypto-miner: A program that uses a machine's computational resources to mine cryptocurrency, without the user's knowledge or consent, sending the results back to a central location. • Worm: Software that automatically spreads itself. • Adware: Potentially unwanted software that shows the user an excessive number of -often in browser -ads, or changes the user's home page to an ad, to get more clicks. • Spyware: Covers programs that collect confidential information and send it to an attacker. This confidential information could range from web browsing habits, keystroke logging, password stealing or banking information among others. • Flooder: Designed to overload a machine's network connections. Servers are common targets of these attacks. • Packed: Indicates that the malware was packed for the sake of avoiding detection. • File-Infector: Infects executable files with the intent to cause permanent damage or make them unusable. A fileinfecting virus overwrites code or inserts infected code into a executable file. • Installer: Installs other unwanted software.
APPENDIX B LABELING DETAILS 1) Token Extraction: The first step for deriving tags from detection names is parsing the individual detection names to extract relevant tokens within these names. A token is defined as a sequence of characters in the detection name, delimited by punctuation, special characters or case transitions from lowercase to uppercase (we create tokens both splitting and not splitting on case transitions). These are then normalized to lowercase. For example, from the detection name Win32.PolyRansom.k we extract the set of tokens {win32, polyransom, poly, ransom, k}. Once all the tokens from all the vendor detection names for a given dataset are created, we keep those tokens that appear in a fraction of samples larger than α in our dataset. In practice we set the threshold α to 0.06%, resulting in 1,500 unique tokens. A manual inspection of the tokens with lower occurrence rates found that they were mostly non-informative pseudo-random strings of characters usually present in detection names (e.g. '31e49711', '3004dbe01').
2) Token to Tag Mapping: Once the most common tokens were defined, we manually built an association rule from tokens to tags for those tokens related with well-known malware family names or those that could be easily associated with one or more of our tags. For example, nabucur is the family name of a type of ransomware and therefore can be associated with that tag. Similarly, the token xmrig, even though it is not the name of a family of malware can be recognized as referring to a crypto-currency mining software and therefore can be associated with the crytpo-miner tag. This way, we created a mapping from tokens to tags based on prior knowledge. With this mapping, we can now associate a sample with a tag if any of the tokens that map to that tag are present in any of the detection names given by the set of trusted vendors.
3) Token Relationship Mining: In order to understand how tokens relate to each other, we compute the empirical token conditional probability matrix K, where #k j is the number of times the token k j appears in a given dataset, and #(k i ∩ k j ) is the number of times k i and k j occur together. K(i, j) is then, by definition, the empirical conditional probability of token i given token j for a given dataset of samples. We then define the following pairwise relationships between tokens based on their empirical conditional probabilities: • Tokens k i and k j are synonyms under threshold β if and only ifp(k i |k j ) > β andp(k j |k i ) > β. • Token k i is a parent of token k j under threshold β if and only ifp(k i |k j ) > β andp(k j |k i ) ≤ β. • Token k i is a child of k j under threshold β if and only if p(k i |k j ) ≤ β andp(k j |k i ) > β.
With this in mind, we extend our previously proposed labeling function as follows. We use the tag t i , associated with a set of tokens K i = {k 1 , . . . , k l }, to describe a given malware sample x if, after parsing the detection names for x we find that: • any of the tokens k ∈ K i is present for sample x, • OR any of the synonyms of k is present for the sample (for every k ∈ K i ), • OR any of the children of k is present (for every k ∈ K i ). The first bullet refers to the use of a manually created mapping between tags and tokens, i.e. our original labeling function. The following two bullets define automatic steps for extending the tag definitions and improving the stability of the tagging method. Empirically, we observed that when computing the token co-occurrence statistics in our training set as in Equation 6, the automatic steps improved the tag coverage in the validation set in average by 13%, while increasing the mean token redundancy, or the mean number of tokens observed per tag from 2.9 to 5.57.This increase in mean token redundancy makes the labeling function more stable against mis-classifications or missing scans from the set of trusted vendors.
The parameter β was set to 0.97, the value at which the coverage of malicious tags improved for malware samples in our validation set, while remaining constant for benign samples. file read and writes operations, as well as many other activities can be captured that would not necessarily be observable in a static scan alone as in its packaged state this data would be encrypted, or possibly not even present as it may be downloaded at the time of execution. Sophos researchers have created family specific signatures for this scanbox environment that are able to analyze dropped, downloaded and modified files, as well as memory dumps, network traffic, and many other artifacts in addition to static binany scans to develop dynamic signatures with much more stringent criteria to define family membership. Table V shows the results of the tagging models for a complete test set, which includes 328,458 benign samples on top of the only-malware evaluation dataset of size 3,456,288 as introduced in Section V-A. We see that there is no degradation in performance when adding benign samples to the evaluation. This is an indication that the model has learnt not to assign malicious tags to benign samples. Table VI summarizes the families, the number of examples per family and their associated tags for the anchor experiment described in Section VII-B. The two different crypto-miner families refer to alternate approaches to perform crypto mining in a host machine without administrator knowledge.


extfieldsofstudy:
Physics
Computer Science

text:
Design of phase coded spiral resonator based Chipless RFID tag for tracking applications

RFID (Radio identification) is a technology which deals with the wireless identification of people and products. This chipless RFID tag design is on research to replace chipped RFID tags, which employs high cost silicon wafer to store unique identification code. The main challenge in the design of chipless RFID tag is how to encode the data without a chip. This challenge is overcome by the use of electromagnetic properties of the resonators, filters etc to encode the data bits. In this work RFID tag is designed based on multiresonators with each resonator representing a data bit. The proposed tag consists of the multiresonating circuit to store information bits and transmitting and receiving UWB antenna for wireless communication with the RFID reader for identification. The multiresonating circuit designed consists of 4-spiral resonators electromagnetically coupled to the microstip coupled line. Each spiral resonates at unique resonating frequency representing the unique data bit. The data encoding is carried out with the help of phase ripples at the resonating frequency of the spirals. Three variations are observed and corresponding 3-logic states (0, 1, 2) are encoded. The designed tag is simulated in Advanced Design System (ADS) using RO-4003 substrate with the dielectric constant 3.38 and thickness of 20 mil. From the proposed methodology, a total of 34=81 unique tags can be designed that can be employed in cheap item tracking. The Monopole disc antenna is designed which operates for wide band covering all resonating frequency of the spiral resonator.

Introduction
RFID (Radio Frequency Identification) can be defined as the Automatic identification technology which used to identify objects carrying tags when they come close to a reader. It is recently being used in a wide range of applications such as Supply Chain Management (SCM), health care, traffic monitoring, retail, access control, etc. The idea behind the RFID tag is to store a unique identification number, same as that of a bar code or a magnetic strip. To retrieve information stored in the bar code or magnetic strip, the device must be scanned in a close proximity with its scanning device. But in RFID, the data transfer between RFID tag and RFID Reader is done wirelessly and hence enables remote identification. The paper [1] deals with the design of spiral resonator based RFID tag. Each spiral resonator resonates at unique frequency and three states in any resonant frequency (encoding in base-3) can be realized and more data bits can be encoded using the same bandwidth as base-2 encoding method [3].
Microstrip Spiral Resonator for the UWB chipless RFID Tag [2] deals with the simulation of the single spiral resonator coupled to the transmission line. Employment of circular and rectangular resonators in the multiresonating circuit of the chipless RFID is compared with its simulations results and the area occupied.
In [3], the tag encodes data based on spectral signature using a multiresonator. Both amplitude and phase components of the spectral signature are used for data encoding with base-2 coding methods. A novel chipless RFID tag using spiral resonator to achieve the pentamerous data encoding form [4] and deals with the new method of data encoding to increase the number of coded bits in multiresonator circuit. The phase of scattering parameters (S-parameters) at a certain frequency is considered for coding bits. The different phases of S parameters created by different coupling positions of the spiral resonator are considered for bit encoding.
This book [5] gives a complete review of the chipless RFID tag and the advantages of chipless tag over chipped tags and its future growth of replacing barcode. It also gives an complete overview of the employment of spiral resonators in chipless RFID design. In [6], a fully passive flexible chipless RFID system is presented in this paper. The designed chipless tag uses the magnitude and phase of the frequency signature of a multiresonator circuit for encoding of data bits. The tag comprises of a microstrip spiral multiresonator and cross-polarized transmitting and receiving microstrip UWB monopole antennas.
The chipless RFID transponder consists of three microstrip patch antennas, which are loaded with open circuited stubs. The antennas are resonant at nearby frequencies, and when excited with their respective resonant frequency signals, they re-radiate backscattered signals with distinct phase characteristics. This phase information is encoded as hexadecimal bits [7].

Multiresonating circuit design
The proposed circuit consists of transmission line with coupled spiral resonators along its sides. The line is matched to 50Ω at the both ends and the spiral resonators have different resonance frequencies.
Every spiral resonators produces attenuation in magnitude and ripple in phase at its resonating frequency. The resonating frequency can be modified by changing the dimensions of the spiral resonators. Every resonating frequency carry a bit binary data bit, and by increasing the number of data bits more bits can be encoded. The following Table 1. shows the design specification of the proposed design.

Coupled line and Multiresonator design
The concept in the coupled transmission line is achieved using two couple line between the input and output ports with impedance matching of 50Ω at its end. The geometry is depicted as follows, Length of the coupled line=11mm, width of the coupled line=0.5 and spacing between coupled line=0.24mm. The 50Ω impedance matching is achieved by the following equations, for Z0=50Ω, thickness of the substrate H=20 mil, Dielectric constant ɛr=3.38, Where, w=width of the 50Ω line, Where, (4) From the above equations the length of the line=3mm and width of the line=1.15mm.
The 4 spiral resonators are designed which resonates for a unique frequencies, this could be achieved by using varying number of turns and length of the spiral resonators. The spiral resonators are designed to resonate at different frequencies. This unique frequency resonation is being achieved by the variation of the length of the spiral resonator. The designed spiral resonators specification is shown in the Table 2.

Antenna design
The Monopole disc antenna designed covers all the resonating frequency of the spiral resonators. This Monopole UWB antenna is used for the reception of interrogating signals from the reader and transmission of the encoded information to the reader. The designed ultra wideband monopole antenna has the following specifications as shown in the Table 3. In this design, for each resonating frequency 3-logic states are employed as the base-3 code (0, 1, 2).This is achieved by encoding the corresponding phase ripples of the each spiral resonator with respect to frequency. Hence coding capacity is improved with higher bandwidth efficiency.

Results and discussion
The designed coupled line with impedance matching is shown in the Figure1. Based on the operating frequency of the coupled transmission line, spiral resonators are designed. The Figure 2. which shows the S21 magnitude and phase variation for coupled transmission line of 7mm, the start frequency is from 1GHz up to the range of 12GHz.  Each spiral resonator coupled to the transmission line with a distance of 0.1mm acts as the band stop filter, producing attenuation and phase ripples at resonating frequencies. This phase ripples corresponding to each spiral is taken for the corresponding bit encoding, when the spirals are coupled above the line, the current distribution in the coupled line and the spiral are in phase (current flow in same direction), hence maximum phase ripple occurs which corresponds to a single unique bit '1', similarly when the spirals are coupled below the line, the current distribution in the coupled line and the spiral are out of phase (current flow in opposite direction), hence minimum phase occurs which corresponds to a single unique bit '2', also absence of spiral produces no phase ripples which corresponds to bit '0' which are shown in below Figure .3, Figure . Figure 4., Figure 5. shows the S12 magnitude and phase simulations for different specific codes of 1111, 2222 and 1102 for the corresponding layout designed in ADS. The magnitude simulation shows that the loss corresponding to the layout designed is optimum and corresponding phase simulation with the desired output of phase ripples which can be taken for encoding the base-3 code.
The steps involved in base-3 encoding is as follows, x If minimum happened in S21 phase, this phase state is set to '2' in base-3 code x If maximum happened in S21 phase, this phase state is set to '1' in base-3 code x If no changes happened in S21 phase, this phase state is set to '0' in base-3 code In this design M=4, hence number of unique ID's generated are 81 Unique identification can be designed.
In the proposed design there is a reduction in the size of the tag, which is the major challenge in wireless identification. Also, there is increase in operating frequency of the spiral resonators and

Conclusion
In the proposed work reduction of tag size has been successfully implemented with same encoding methods and substrate elements [1]. This method of chipless RFID tag design has many advantages in terms of printability/fabrication, wide range of applications, computation and cost compared to that of the chipped tag design. In future, the number of bits encoded can be increased by increasing the number of spiral resonators. The operating frequency of the spiral resonators can be made higher, which increases the range of communication. The resonating circuit part and the antenna part can be designed as a single prototype and wireless measurements can be made using signal analyzers. The alternative shape of the spiral which has the better performance can also be employed instead of the conventional rectangular spiral resonator design.


Impact of Mobile Phone Usage on Some Health Aspects of Children and Adolescents: Evidence Based Review Article

The Wi-Fi devices in mobile phones have a key role in exchanging information and data to show images, audios, videos, and to transfer applications from mobile emitting radio waves. These waves emitted by mobile devices are radiofrequency waves, where many kinds of researches in this field have shown that they negatively affect, especially when using the mobile phone for a long time during the day on the vision and the level of hearing in the young people, as well as the effect on the nervous system caused Headache and muscle aches, as well, it has also been derived from these researches and studies that these waves can cause more depression or psychological stress in children and young users of mobile phones. Moreover, it can cause damage to the brain cells and may have caused a brain tumor even though many studies have not proved it. Also, these studies, which were presented in this article, have concluded that the use of mobile phones, especially late at night, can negatively affect the quality of sleep.

INTRODUCTION
In the last era of our time, the display of various types of mobile phones that contain Wi-Fi technology has increased, resulting in increased popularity among people, including children, to own such kinds of smart devices [1] . The Wi-Fi devices in mobile phones have a key role in exchanging information and data to show images, audios, videos, and to transfer applications from mobile emitting radio waves [1] .
The human body absorbs part of these emitted waves, especially when the voice call is made, its health and biological effects can be classified as thermal and non-thermal. Where the heating caused by the use of mobile phones occurs mainly in the head and neck area which is really neutralized by the activity of the circulatory system in the brain area [2] . The cause is that the frequency of radiations emitted from the mobile are utilize in range from 3 kHz to 300 GHz [1] . Children are often using Wi-Fi services available in mobile devices, and they often more vulnerable to the impact of radio microwaves because their skulls are thin and contain high fluid, their nervous system still develop, the increased activity of cell division in their bodies, plus a weakness of their Immune response. However, scientific research has not demonstrated the extent to which these waves affect children's health in the long term [13 . Many medical explorations using magnetic resonance imaging (MRI) technology have proven that children aged between 5 and 8 years have a higher specific absorption rate than adults [4] .
The urgency of using the mobile by adults near young children may increase their attraction to the experience of using it, as well as many adults allow them to hold it to play or fun, and this enhances the likelihood of the child continue using the mobile in the period of growth and development and until attaining the age of majority [5] . Because the children using mobile for longer time when they grow older [6] . It's found that the prevalence of use of mobile phones in children aged 15-19 years in North America is ranging from 42% to 52%, 2002 and < 90% in the UK and Nordic nations. While it was 79.1% in Swedish children aged 7-14 years, 2007 [6] . Some shocking facts have been announced from a report prepared by the Global system for mobile communication (GSM), in which the report showed that children who use mobile phones were too young (7)(8) years in five countries including Japan, Indonesia, India, Chile, and Egypt [7] . Since 2006, WHO has focused on its need to conduct numerous research to illustrate the impact of the radio-frequency waves on children [6] . The review aims to identify the possible evident of impact of mobile phone use on some health aspects of children and adolescents.

METHODS
An evidentiary subject review study to reveal the results of the newly published research about the impact of the mobile phone usage on some health aspects on children and adolescents, these health aspects were eye and ear health, nervous system, psychological effects, brain health and quality of sleep and all the chosen articles were published for the year 2014 till 2019. The evidences of the required articles were collected from different source databases including the Pub Med databases, Google Scholar website and Researchgate website and the these chosen articles were written in English.
The keywords specified in the search including (use of mobile phones, children and adolescents, eye effects, Ear problems, neurological and psychiatric effects, brain tumor, sleep quality, long term effect) after confirming the desired search topic and the year of the search by looking at the study setting, date of carrying out, year of publication depending on the sub-topics of the chosen article including (search methods and results).
All published articles that have been chosen in this subject review were read carefully to take the desired evidence. To identify and determine the possible or causal evidence of health aspects in relation to the use of mobile phone, the researcher has chosen the results based on statistical analysis and either taken from a constructed table or presented to other research results.

Evidence based Impacts of mobile phone
•

Eye health
Repeated use of the mobile phone for long periods of time harms the visual system of the eye in different ways where it can cause eye tumor due to the high temperature of the eye due to exposure to electromagnetic radiation and close these radiation from the lens of the eye increases the probability of eye exposure to cataract disease later [8] . Bansal and Mahajan, 2018 found in a study of 450 Indian children under 15 years of age in the pediatric department at the teaching for tertiary care that more than one third of them ( 35.7%) were suffering from eye symptoms including eye strain and eye watering (8). In another recent study, which included 177 Saudi students studying at a middle school in the city of Riyadh, their ages ranged 12 to 116 years old, found that using the smartphone for more than 28 hours a week causes visual disturbance [9] . •

Ear problem
Increase the temperature in the ear lobes by approximately 10 degrees Celsius may cause auditory disturbances when using the mobile for a period of 20 minutes continuously and for longer periods because the radiation emitted from the mobile may cause damage to the sensitive parts of the inner ear, as well as people who use phones including children for 2-3 hours a day and for a period of 3-5 years may be exposed to the occurrence of partial deafness and even may eventually exposed to ear tumor or permanent hearing [8] . •

Neurological effects
Neurologically, the microwave radiation emitted from mobile phones through the Wi-Fi device is mostly affects the head region [10] . In a study carried out by Cerutti R, et al (2016) they revealed that exposure the adolescents to some harmful effects like headache attacks and other somatic problems as result to excessive use of mobile devices [11] . And exposure to headache was significantly associated with mobile phone use among Twainish children in another study published in 2015 [6] . Recently, Jo Fowler and Jan Noyes, found that the children aged 11-14 years in south west of England at risk of muscular skeletal problems due to mobile use [4] . •

Psychiatric effects
In a recent study conducted in South Korea by Seong-Soo Cha and Bo-Kyung Seo revealed that the lethargy and depression were more in risk group (excessive mobile users) than the normal user group, and these findings were tendency to significant difference [12] . But in another study carried out on a group of Japanese young people aged 15-19 years, it revealed that the use of mobile phone for social networking services, and conversation with others for two hours or more is significantly linked to a high risk rate with depression [13] . Some studies indicate that there is a correlation between the use of mobile phones and stress, some of which negate this as it is difficult to interpret and summarize the relationship between them [14] . Some researchers have proven that mobile use causes increased stress and others have proven the opposite [14] . In a study conducted on a group of high school respondents, their mean age was 11.97 years [15] . The reason for this may be that Children may experience various biological and psychological changes during their lifetime for a daily period [15] . As for the correlation between exposure to anxiety and the use of mobile phones, two recent studies proved to have been set forth investigating by Elhai, et al and another by Nassehi, et al [14] . They proved that there is an important correlation between the occurrence of anxiety and the use of mobile phones. •

Brain Tumors
Over the past two decades, several medical studies have been carried out, the purpose of which was to assess the health risks arising from the use of mobile phones, where some researchers suggested that the use of mobile for long periods has a high risk of developing brain tumor and specifically the sides of the head but these investigations did not achieve an overall rise in the risk of cancer and the extent of its decline on the other side of the head [16] . Where it showed that the levels of glucose metabolism are high in the brain tissues when those tissues are exposed to the radiofrequency radiations emitted from mobile phones and for long periods of 50 minutes or more [16] . One multi-center study carried out by Sadetzki et al, on a sample of mobile phone users from children and teenagers aged between (7)(8)(9)(10)(11)(12)(13)(14)(15)(16)(17)(18)(19) years where that study revealed a statistically significant health risk of developing brain tumor in regular users (one call weekly and at least for six months). And there was no enough data for the long-term impact of mobile phones on the brain, and it's found that accumulative time from the first use of the mobile until the diagnosis of the tumor was only five years so it requires a lot of research to get more accurate results [17] . Mobile phone users from the children are more susceptible to brain tumors than adults and may be the reason for this is that children have smaller and lighter heads and their brain tissues of are high in conductivity. Thus all these factors help to ease the absorption of radiation into the brain [17] .

Sleep problems
Sleep is considered a need of the necessary human needs which constitute one-third of his/her daily life where sleep is a state of the reversible unconscious and in this case, the cells of the body and mind are renewed and work to repair and develop [18] . The results of several newly published studies apply to a group of young mobile phone users in Turkey [18] Japan [13] Iran [19] has shown that increasing the duration of mobile phone usage reduces the quality of sleep and affects it. Because of the lack of rational use of electronic media has negative effects on the quality of sleep in children and adolescents [18] .

CONCLUSION
The results of previous studies have shown that prolonged exposure to electromagnetic radiation emitted by mobile devices may damage the visual system and sensitive parts of the ear, exposure to frequent headaches, lethargy, and possibly They develop lethargy and depression and do not forget the risk of exposure to brain tumors.