document: Learning to detect malicious executables in the wild In this paper , we describe the development of a fielded application for detecting malicious executables in the wild . We gathered 1971 benign and 1651 malicious executables and encoded each as a training example using n-grams of byte codes as features . Such processing resulted in more than 255 million distinct n-grams . After selecting the most relevant n-grams for prediction , we evaluated a variety of inductive methods , including naive Bayes , decision trees , support vector machines , and boosting . Ultimately , boosted decision trees outperformed other methods with an area under the roc curve of 0.996 . Results also suggest that our methodology will scale to larger collections of executables . To the best of our knowledge , ours is the only fielded application for this task developed using techniques from machine learning and data mining .
doc_bio_tags: O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O