Hamm-Grams: An Algorithm for Mining Regular Expressions of Bytes

2026-07-01

AI Summary

Traditional n-gram features exhibit insufficient robustness in malware detection, as they are highly sensitive to minor code perturbations. To address this limitation, this work proposes an efficient algorithm that introduces fixed-length regular expressions with single-character wildcards—termed hamm-grams—as static features for the first time. The approach incorporates a tailored locality-sensitive hashing scheme combined with an intra-bucket clustering strategy to enable scalable and effective feature extraction. By capturing more resilient syntactic patterns, the proposed method substantially enhances resistance to code obfuscation and perturbation. Empirical evaluations demonstrate that models leveraging hamm-grams achieve simultaneous improvements in both robustness and predictive performance across malware classification and detection tasks.

Abstract

Malware poses a critical and ever-evolving threat, and robust and effective systems for detecting and classifying malware are of essential importance. $n$-grams features are among the common static features used in effective machine learning systems for malware, but these features are inherently brittle. We propose an algorithm for constructing more robust features, hamm-grams, which are a special class of regular expressions having a fixed length and single-character wildcards. We devise an efficient algorithm for finding common hamm-grams using a new locality-sensitive hash designed to produce collisions among pairs of small Hamming distance and a clustering within hash buckets to place wildcards. We then demonstrate the advantages of these features in malware classification and detection tasks.

Problem

• malware detection
• n-grams
• feature robustness
• static analysis
• malware classification

Innovation

• Hamm-Grams
• locality-sensitive hashing
• malware detection
• regular expressions
• n-grams