Malware Data Science
Attack Detection and Attribution
Saxe and Sanders apply machine-learning techniques (classification, clustering, deep learning) to malware detection and attribution, with working Python code and real corpora.
As an Amazon Associate we earn from qualifying purchases. The link above is sponsored.
- Authors
- Joshua Saxe,Hillary Sanders
- Published
- 2018
- Publisher
- No Starch Press
- Pages
- 272
- Language
- English
Read this if
Malware analysts and detection engineers who want to scale beyond manual triage. Saxe and Sanders apply classification, clustering, similarity analysis, and deep learning to the malware corpus, with working Python code throughout.
Skip this if
Analysts whose work is one-sample-at-a-time, or readers without basic Python and statistics comfort. The book is for telemetry-rich environments where ML scales matter.
Key takeaways
- Static-feature classifiers can route a triage queue effectively even at scale; the book's chapters on feature engineering pay back the cost.
- Similarity analysis (locality-sensitive hashing, ssdeep, imphash, function-level fuzzy hashing) is the analyst's lever for clustering campaigns and tracking actor evolution.
- Deep learning is overhyped for malware in many contexts and exactly the right tool in others; the book is honest about the trade-offs in a way most ML/security books aren't.
Notes
Pair with Practical Malware Analysis (Sikorski/Honig) for the manual-analysis foundation and with Joshua Saxe's later work at Sophos for the production deployment view. Code samples on GitHub make this rare among security books in still being runnable years later. Useful for anyone designing detection at scale, less useful for boutique malware analysts.
What to read before
What to read before Malware Data Science →Beginner · 2014
Countdown to Zero Day
Kim Zetter's investigative reconstruction of Stuxnet, the joint US/Israeli operation that physically damaged Iranian uranium-enrichment centrifuges via a worm, and what its discovery revealed about state-level cyber capability.
Beginner · 2022
The Ransomware Hunting Team
Investigative journalism on the volunteers who quietly cracked ransomware to free victims for free, while the FBI mostly watched. A people-first look at the early ransomware economy.
Intermediate · 2012
Practical Malware Analysis
Still the gold standard textbook for static and dynamic malware analysis on Windows.
What to read next
What to read after Malware Data Science →Advanced · 2024
Evading EDR
A component-by-component teardown of how modern EDR sensors actually collect telemetry, and where each data source can be starved, blinded, or bypassed.
Advanced · 2023
The Android Malware Handbook
Machine-learning researchers and members of Meta's and Google's Android Security teams distill years of research into detecting banking trojans, ransomware, and SMS fraud on Android, combining manual analysis with classification models.
Advanced · 2025
The Art of Mac Malware, Volume 2
The detection-focused sequel to Volume 1, Wardle turns from analyzing Mac malware to building the heuristics and tooling that catch it, using macOS's security frameworks and real-world malware samples throughout.
Explore similar books
Alternatives to Malware Data Science →Advanced · 2025
The Art of Mac Malware, Volume 2
The detection-focused sequel to Volume 1, Wardle turns from analyzing Mac malware to building the heuristics and tooling that catch it, using macOS's security frameworks and real-world malware samples throughout.
Advanced · 2024
Evading EDR
A component-by-component teardown of how modern EDR sensors actually collect telemetry, and where each data source can be starved, blinded, or bypassed.
Advanced · 2023
The Android Malware Handbook
Machine-learning researchers and members of Meta's and Google's Android Security teams distill years of research into detecting banking trojans, ransomware, and SMS fraud on Android, combining manual analysis with classification models.