Edward Raff

Why Is SHAP Not a Reliable Standalone Explanation Framework for Malware Detection?

Machine learning is widely used for malware detection, but its decisions must be explained. An analyst needs to know whether a model has learned genuine malicious behavior or only dataset-specific patterns \cite{gaur2021semantics}. SHapley Additive exPlanations (SHAP) is the standard tool for this, backed by formal pro...

Identifying Security Platform Product Abuse with Machine Learning

This work provides the first study of such a whole-system defense, especially with respect to a deployed and operational capability, and shows an increase in product abuse coverage, a 30% reduction in monthly alerts, and adaptability to changes in malicious actors'behavior.

Fast And Accurate Text Content File Type Identification

A common requirement across organizations is to have a tool that can identify file types based on their contents, particularly in the cybersecurity domain where magic numbers and file extensions can not be trusted. While existing tools work well in practice, there is plenty of room for improvement either in terms of co...

Bolstering Binary Datasets for Malware Detection Through Programmatic Data Augmentation

When LLM Decompilers Recompile More and Preserve Less

Decompile-Diverge is proposed, a behavioral comparison oracle not relying on fixed or hand-crafted tests: for each function it synthesizes a driver, grows a fuzzing corpus from the reference, and reruns the decompiled code on the same inputs to detect changes in the function's behavior.

Cybersecurity Detection Classification with Reasoning-enabled Language Models

This work trains a chain-of-thought reasoning-enabled triage classifier on real, human-labeled Windows endpoint detections by combining automated prompt optimization, self-training, and reinforcement learning with verifiable rewards, and shows that a finetuned 30B model significantly outperforms frontier general-purpos...