Trouble With Time: Compile Timestamps and First-Seen Date Regression in EMBER2024

概要

Reliable first-seen dates are important for constructing temporal malware evaluation splits, but this information often comes from external services that are not equally accessible to all researchers. We investigate whether machine learning can instead estimate an executable's first-seen date or determine when its PE/COFF compilation timestamp is unreliable. Using EMBER2024, we evaluate feature-based and raw-byte models across classification, regression, ranking, and latent-reliability formulations. Direct first-seen regression produces errors comparable to a substantial portion of the dataset's collection window, and none of the evaluated scores provides a useful chronological ordering of files. Current models therefore cannot replace externally sourced first-seen metadata. In contrast, classifiers can identify timestamps that fall within specified tolerances of first seen and can detect clearly implausible timestamps with high discrimination. We also find substantial timestamp disagreement among both benign and malicious executables, indicating that unreliable timestamps are not exclusively a product of malicious manipulation. These results establish baselines and identify timestamp reliability as a distinct direction for future security-ML research.

参考リンク

• Paper ↗

リンク先のライセンス・再現性・データ条件をご確認ください。自動分類や実装の目安は保証ではありません。

実装を始めるプロンプト

参考リンクを確認したうえで、次の内容をコピーして利用できます。

# 論文・記事
Trouble With Time: Compile Timestamps and First-Seen Date Regression in EMBER2024

# 概要
Reliable first-seen dates are important for constructing temporal malware evaluation splits, but this information often comes from external services that are not equally accessible to all…

# 原典
https://arxiv.org/abs/2611.01031

上記の手法を実装してください。実行前に依存関係とライセンスを確認してください。