[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-82609-en":3,"doc-seo-82609-105":29,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},82609,8796095360427,"Lucas Martin","https://ap-avatar.wpscdn.com/davatar_994ba38a5ba835b3df7d355c54d3ed8d",8,"Research & Report","Hamm-Grams: An Algorithm for Mining Regular Expressions of Bytes","Malware remains a critical, evolving threat, driving demand for robust machine-learning features for static detection under severe compute constraints. 􀀽-grams are widely used but brittle because exact byte subsequences must recur. The work introduces hamm-grams, fixed-length regular expressions with single-character wildcards, mined efficiently via a locality-sensitive hash that targets collisions for small Hamming distances and clustering within hash buckets. Experimental results support improved malware family classification and malicious-vs-benign detection on public datasets.","arXiv :2607 .0 1445v 1 [ cs .CR] 1 Jul 2026  \nHamm-Grams: An Algorithm for Mining Regular Expressions of Bytes  \nDEREK EVERETT, Amazon, USA EDWARD RAFF, CrowdStrike, USA JAMES HOLT, CrowdStrike, USA  \nMalware poses a critical and ever-evolving threat, and robust and effective systems for detecting and classifying malware are of essential importance. 􀀽-grams features are among the common static features used in effective machine learning systems for malware, but these features are inherently brittle. We propose an algorithm for constructing more robust features, hamm-grams, which are a special class of regular expressions having a fixed length and single-character wildcards. We devise an efficient algorithm for finding common hamm-grams using a new locality-sensitive hash designed to produce collisions among pairs of small Hamming distance anda clustering within hash buckets to place wildcards. We then demonstrate the advantages of these features in malware classification and detection tasks.  \n1 Introduction  \nThe detection of malware is a problem of utmost importance. Therefore, designing reliable and robust machine-learning features for malware detection is an ongoing field of research and activity. The need for cheap deployment and training costs is of particular relevance, as malware is increasingly observed in extremely limited compute environments with resources too limited to run parsing. Notable incidents have included industrial control systems [23] and satellites [41] as targets of malware. Such systems may have as little as 256 KB of system RAM [25], requiring especially small models.  \n􀀽-gram features, sequences of 􀀽 consecutive characters, form a powerful tool in the machine learning toolbox. Combined with linear classifiers such as 􀀡1-penalized logistic regression, 􀀽-grams create a formidable and effective baseline and are commonly used in practice. Such models are cheap to train, do not require GPU co-processors, and are small and fast enough to deploy in almost all situations. For static malware detection, 􀀽-grams of bytes are commonly used features; however, as 􀀽 increases, the likelihood of an 􀀽-gram re-occurring decreases, as all 􀀽 tokens from the alphabet Σ must match. If any single entry changes, the feature effectively “disappears”, making 􀀽-grams brittle when larger values of 􀀽 are desired.  \nAn example that illustrates one failure case of 􀀽-grams for malware detection is the following x86 assembly sequence:  \npush ebp sub edx, edxmov ebp, esp  \nwhich corresponds to the byte 5-gram (in hex) 55 29 D2 89 E5 . The second assembly instruction sets the value to zero and could be equivalently replaced with the instruction xor edx,edx, which would change the 5-gram to 55 31 D2 89 E5 . A Hamming distance of one separates these two 5-grams, and many other assembly instructions also have fixed-length equivalent counterparts. Situations like this one are especially likely to occur in register renaming and changes of the function or data addresses that are prevalent even in non-adversarial recompilation. If we could learn to detect the regular expression 55 ? D2 89 E5, we would have a feature that is robust to these changes.  \nThus far, automated methods for constructing regular expressions for use in detecting malware have been hampered by the technical limitations of existing algorithms. For example, regular language induction methods, having been  \nAuthors’ Contact Information: Derek Everett, derekeverett@gmail.com, Amazon, Baltimore, USA; Edward Raff, edward.raff@crowdstrike.com, CrowdStrike, Austin, USA; James Holt, [james@holt.net](james@holt.net), CrowdStrike, Austin, USA.  \n2 Derek Everett, Edward Raff, and James Holt  \ndesigned for problems in natural language rather than assembly, can not be applied directly due to the much larger sequence lengths and sample sizes. Prior approaches have also relied on genetic algorithms and similar search strategies that are not scalable [2, 3] . The open challenge is in f","cbCaipDDqWDD8bEA","https://ap.wps.com/l/cbCaipDDqWDD8bEA","pdf",1138083,1,15,"English","en",105,"# Introduction\n# Related Work","[{\"question\":\"Why are traditional 􀀽-gram byte features brittle for malware detection?\",\"answer\":\"Because a 􀀽-gram requires all tokens to match exactly; when any byte changes, the feature effectively disappears. This makes larger 􀀽 values undesirable for robustness.\"},{\"question\":\"What are hamm-grams and how do they improve robustness?\",\"answer\":\"Hamm-grams are fixed-length regular expressions with single-character wildcards. They match multiple 􀀽-grams within a Hamming distance determined by the number of wildcards, capturing common patterns despite small changes.\"},{\"question\":\"How does the proposed method mine common hamm-grams efficiently?\",\"answer\":\"It uses a locality-sensitive hash designed to produce collisions among pairs of small Hamming distance, then clusters candidates within hash buckets to place wildcards and extract frequent patterns.\"}]",1784181784,38,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":27},"hamm-grams-an-algorithm-for-mining-regular-expressions-of-bytes","",{"@graph":35,"@context":85},[36,53,68],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":42,"position":52},"https://docshare.wps.com/document/hamm-grams-an-algorithm-for-mining-regular-expressions-of-bytes/82609/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":23,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":40,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-17","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"Why are traditional 􀀽-gram byte features brittle for malware detection?","Question",{"text":75,"@type":76},"Because a 􀀽-gram requires all tokens to match exactly; when any byte changes, the feature effectively disappears. This makes larger 􀀽 values undesirable for robustness.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"What are hamm-grams and how do they improve robustness?",{"text":80,"@type":76},"Hamm-grams are fixed-length regular expressions with single-character wildcards. They match multiple 􀀽-grams within a Hamming distance determined by the number of wildcards, capturing common patterns despite small changes.",{"name":82,"@type":73,"acceptedAnswer":83},"How does the proposed method mine common hamm-grams efficiently?",{"text":84,"@type":76},"It uses a locality-sensitive hash designed to produce collisions among pairs of small Hamming distance, then clusters candidates within hash buckets to place wildcards and extract frequent patterns.","https://schema.org",{"og:url":51,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,135],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":45,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":45,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":45,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":45,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":45,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":45,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":45,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":136,"doc_module":4,"doc_module_name":45,"category_name":137,"show_sort_weight":106,"slug":138},19,"General","general"]