// Comparison

Evading EDR vs Malware Data Science: Which Should You Read?

Two cybersecurity books on Malware, compared honestly: who each is for, what each does best, and which to read first.

Advanced

4/52024

The Definitive Guide to Defeating Endpoint Detection Systems

Matt Hand

A component-by-component teardown of how modern EDR sensors actually collect telemetry, and where each data source can be starved, blinded, or bypassed.

Intermediate

4/52018

Malware Data Science

Attack Detection and Attribution

Joshua Saxe, Hillary Sanders

Saxe and Sanders apply machine-learning techniques (classification, clustering, deep learning) to malware detection and attribution, with working Python code and real corpora.

Read this if

Red teamers and detection engineers who want to reason about EDR from the sensor up rather than copy-pasting the bypass of the week.

Malware analysts and detection engineers who want to scale beyond manual triage. Saxe and Sanders apply classification, clustering, similarity analysis, and deep learning to the malware corpus, with working Python code throughout.

Skip this if

Anyone wanting a turnkey list of working bypasses. Skip this if you don't run Windows or won't sit through the internals.

Analysts whose work is one-sample-at-a-time, or readers without basic Python and statistics comfort. The book is for telemetry-rich environments where ML scales matter.

Key takeaways

EDR is a collection of telemetry sources, not a monolith; evasion means knowing which source sees what.
Most durable bypasses attack the sensor's data collection, not its detection logic.
Vendor-agnostic understanding outlives any specific bypass, which vendors patch fast.

Static-feature classifiers can route a triage queue effectively even at scale; the book's chapters on feature engineering pay back the cost.
Similarity analysis (locality-sensitive hashing, ssdeep, imphash, function-level fuzzy hashing) is the analyst's lever for clustering campaigns and tracking actor evolution.
Deep learning is overhyped for malware in many contexts and exactly the right tool in others; the book is honest about the trade-offs in a way most ML/security books aren't.

How they compare

Evading EDR and Malware Data Science are both rated 4/5 in our catalog. Pick by topic preference and reading style rather than by rating.

Evading EDR is pitched at advanced level. Malware Data Science is pitched at intermediate level. Read the easier one first if you're not yet comfortable with the topic.

Evading EDR and Malware Data Science both cover Malware, Detection, so reading them in sequence reinforces the same material from different angles.

Keep reading

Evading EDR

→ Alternatives to Evading EDR → What to read after Evading EDR