arXiv preprint ·
Trouble With Time: Compile Timestamps and First-Seen Date Regression in EMBER2024
- Published
- Source
- arXiv preprint, posted before peer review
- Original
- Read it at arXiv
- Topics
Abstract
Reliable first-seen dates are important for constructing temporal malware evaluation splits, but this information often comes from external services that are not equally accessible to all researchers. We investigate whether machine learning can instead estimate an executable's first-seen date or determine when its PE/COFF compilation timestamp is unreliable. Using EMBER2024, we evaluate feature-based and raw-byte models across classification, regression, ranking, and latent-reliability formulations. Direct first-seen regression produces errors comparable to a substantial portion of the dataset's collection window, and none of the evaluated scores provides a useful chronological ordering of files. Current models therefore cannot replace externally sourced first-seen metadata. In contrast, classifiers can identify timestamps that fall within specified tolerances of first seen and can detect clearly implausible timestamps with high discrimination. We also find substantial timestamp disagreement among both benign and malicious executables, indicating that unreliable timestamps are not exclusively a product of malicious manipulation. These results establish baselines and identify timestamp reliability as a distinct direction for future security-ML research.
The authors’ abstract, as arXiv lists it. arXiv’s listings, abstracts included, are free for anyone to reuse.
Read it on ReadSearch
Each opens after you create an account, and brings you back to this paper.
More in Cryptography & Security
Threat Modeling Intimate Partner Abuse in Agentic Systems
CipherFlow: Compiling AI Programs for Efficient Cryptographically Secure Inference
DERED: Enhancing Third-Party Library Detection in Binaries via Deceptive Reuse Mitigation
Detecting Generated-Depth Injection Attacks on RGB-D Place Authentication
Compressed Oracle Duality: A simple framework for knowing what quantum adversaries know
Get the few papers worth your time in Cryptography & Security every morning.
ReadSearch reads the new papers in your field each day and brings you the few worth reading, each with its key finding in a sentence.