A close look on n-grams in intrusion detection: anomaly detection vs. classification
Classification of Packed Executables for Accurate Computer Virus Detection