Venue: ICLR 2018 Workshop

Reviews:

final_score: rating: 7: Good paper, accept
review_content: The manuscript considers malware detection when following a piece of software run as online process. There is a good motivation: existing methods work in batch mode, and can be fooled compensating malign activity with lots of benign activities. They propose monotonic malware detection, where more execution can only increase how malign the software is. This feels somewhat faulty assumption as well since it could lead to false positives by software that often does something slightly malign. The introduction and motivation are excellent.

The method description suffers from brevity, but seems ok. In the expermients the monotonic approach works well on online setting as expected, while suffers a bit in batch mode. 

Overall the presented idea is interesting and results are good. The abstract is clearly written.
review_title: review

final_score: rating: 7: Good paper, accept
review_content: This paper proposes a method of real-time malware detection through a program's execution time. It assumes that the probability of being malicious increases monotonically as new lines of codes are added into the execution log. As a result, the risk of a benign program is expected to be stable, but that of a malicious program will increase until it passes a threshold. The paper applies the monotonic classifier (e.g., min-max network) and modifies the feature extraction process under the monotonicity constraint. Experiments show that in the full-log setting, the monotonic models are close to non-monotonic models. In the real-time setting, however, monotonic models perform much better than the non-monotonic models. The paper explains that "such behavior is that the non-monotonic model learns to use a lot of ‘benign’ features while we
forbid monotonic models to do so". But does that mean the experiments involve inconsistent feature sets? While non-monotonic model learns to use a lot of ‘benign’ features, but the real-time setting does not have such features. What if we totally forbid these features for both models? The paper should give more explains since the gap between the two models are big in the real-time setting. Moreover, the analysis in the appendix is very interesting. It will be even better if the paper can include the case when the monotonic model makes mistake. In the full-log setting, the monotonic model is worse than the non-monotonic model. Is it because it makes more false-positive predictions or vice-versa?
review_title: Interesting application of real-time malware detection

final_score: rating: 7: Good paper, accept
review_content: The paper discusses real time detection of malware using a monotonic network, for which the output probability is restricted to monotonically increase as more events become available. The paper is interesting to read, and presented well. I didn't fully understand why the non-monotonic network performs at a random level for real-time detection. The authors mention that this happens since non-monotonic network learn benign features. Some experimental result to elaborate this further would be helpful.
review_title: An interesting read

Meta-review: Congratulations, your paper was accepted to the ICLR workshop.
Decision: Accept