K-ary codes are a form of obfuscation used by malware in which the code is distributed
across K distinct files. Detecting them is difficult because recognizing the pieces that belong …

For digital forensics, eliminating the uninteresting is often more critical than finding the
interesting. We discuss methods exploiting the metadata of a large corpus. Tests were done …

ABSTRACT A cyberweapon is weaponized software code that exploits flaws in software. It is
only effective if the flaw still exists at the time of weapon deployment. Because of this, there …

We studied differences between versions of software by comparing their executable files.
We used a large database (“corpus”) of around 2600 digital-forensic copies of secondary …

Traditional signature-based malware detection is effective, but it can only identify known
malicious programs. This thesis attempts to use machine-learning techniques to successfully …