EMBER2024 models cannot estimate executable first-seen dates
Original title: Trouble With Time: Compile Timestamps and First-Seen Date Regression in EMBER2024
Machine learning on EMBER2024 features or raw bytes cannot replace external first-seen metadata for malware evaluation splits.
The paper evaluates ML models for estimating executable first-seen dates using EMBER2024. Direct regression produces errors comparable to the dataset collection window and no scores provide useful chronological ordering. Classifiers identify unreliable timestamps with high discrimination. Timestamp disagreement exists among both benign and malicious executables.
- Direct regression errors match collection window
- No scores provide useful chronological ordering
- Classifiers detect implausible timestamps
- Timestamp disagreement not exclusive to malicious files
- Products
- EMBER2024
From the original article
1 min read at arxiv.orgReliable first-seen dates are important for constructing temporal malware evaluation splits, but this information often comes from external services that are not equally accessible to all researchers. We investigate whether machine learning can instead estimate an executable's first-seen date or determine when its PE/COFF compilation timestamp is unreliable.
By Edward Raff · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.