Reply to thread

Message

<blockquote data-quote="smither" data-source="post: 826445" data-attributes="member: 81284">Guys,first of all thank you for tests and feedback.We excluded all installation PEs from training set due to it&#039;s features (basically all installers use compression and almost all encryption) as result their resource sections (or overlay) will be highly likely as malicious.Later we&#039;ll add more rules to process installer PE files too, but for now we are focused on detecting malicious (packed\crypted) files and avoid legit.Also from training set was excluded dotnet files. Will be processed in near future.I forgot to say about anomalies detection ability - in fact this is AV with white-box or advanced version of pe viewer with prediction and indicators.Everyone is able to download any sample and test it personally. (Be careful and use virtual environments, password is infected).For new dataset we&#039;ll try to train neural network to increase the success rate of classification.</blockquote>

[QUOTE="smither, post: 826445, member: 81284"] Guys, first of all thank you for tests and feedback. We excluded all installation PEs from training set due to it's features (basically all installers use compression and almost all encryption) as result their resource sections (or overlay) will be highly likely as malicious. Later we'll add more rules to process installer PE files too, but for now we are focused on detecting malicious (packed\crypted) files and avoid legit. Also from training set was excluded dotnet files. Will be processed in near future. I forgot to say about anomalies detection ability - in fact this is AV with white-box or advanced version of pe viewer with prediction and indicators. Everyone is able to download any sample and test it personally. (Be careful and use virtual environments, password is infected). For new dataset we'll try to train neural network to increase the success rate of classification. [/QUOTE]

Verification