// Comparison

Malware Data Science vs Practical Malware Analysis: Which Should You Read?

Two cybersecurity books on Malware, compared honestly: who each is for, what each does best, and which to read first.

Intermediate

4/52018

Attack Detection and Attribution

Joshua Saxe, Hillary Sanders

Saxe and Sanders apply machine-learning techniques (classification, clustering, deep learning) to malware detection and attribution, with working Python code and real corpora.

Intermediate

5/52012

Practical Malware Analysis

The Hands-On Guide to Dissecting Malicious Software

Michael Sikorski, Andrew Honig

Still the gold standard textbook for static and dynamic malware analysis on Windows.

Read this if

Malware analysts and detection engineers who want to scale beyond manual triage. Saxe and Sanders apply classification, clustering, similarity analysis, and deep learning to the malware corpus, with working Python code throughout.

Aspiring threat researchers, blue-teamers who want to read samples instead of forwarding them to a vendor, anyone preparing for GREM.

Skip this if

Analysts whose work is one-sample-at-a-time, or readers without basic Python and statistics comfort. The book is for telemetry-rich environments where ML scales matter.

Mac/Linux malware, mobile, or modern packed loaders that defeat IDA's autoanalysis. The book is x86 Windows in spirit.

Key takeaways

Static-feature classifiers can route a triage queue effectively even at scale; the book's chapters on feature engineering pay back the cost.
Similarity analysis (locality-sensitive hashing, ssdeep, imphash, function-level fuzzy hashing) is the analyst's lever for clustering campaigns and tracking actor evolution.
Deep learning is overhyped for malware in many contexts and exactly the right tool in others; the book is honest about the trade-offs in a way most ML/security books aren't.

Static and dynamic analysis are two halves of one workflow, not alternatives.
The labs are the book, the chapters are scaffolding to make the labs solvable.
Anti-analysis techniques deserve more time than newcomers usually give them.

How they compare

We rate Practical Malware Analysis higher (5/5 against 4/5 for Malware Data Science). For most readers, that means Practical Malware Analysis is the primary pick and Malware Data Science is a useful follow-up.

Both books target intermediate-level readers, so the choice is about topic, not difficulty.

Malware Data Science and Practical Malware Analysis both cover Malware, so reading them in sequence reinforces the same material from different angles.

Keep reading

Malware Data Science

→ Alternatives to Malware Data Science → What to read after Malware Data Science