Self-Supervised Representations for Binary Program Clustering: From Empirical Study to Retrieval-Augmented Learning
2026-08-03 • Cryptography and Security
Cryptography and SecurityMachine Learning
AI summaryⓘ
The authors studied how to group malware samples using new machine learning methods that learn from data without needing labels. They tested several self-supervised learning techniques adapted from image analysis on malware data and found some worked as well as fully supervised methods. Then, they examined other unsupervised methods for tabular data and identified VIME as a strong performer. Building on this, they created VIME-R, which improves VIME by using a smarter way to create training examples, leading to better grouping results. Their work suggests that enhancing training data with retrieval-based methods can help malware detection.
malware clusteringself-supervised learning (SSL)tabular representation learning (TRL)binary program clusteringBYOLSimSiamVIMEretrieval augmentationunsupervised learninghomogeneity
Authors
Martin Mocko, Daniela Chudá
Abstract
Malware clustering is a critical task in cybersecurity that helps discover threats and analyze evolving malware families. While self-supervised learning (SSL) and tabular representation learning (TRL) have achieved breakthroughs in other domains, their application to binary program clustering (the task of clustering all incoming samples regardless of label) remains largely unexplored. This study presents the first systematic investigation of SSL and TRL methods for binary program clustering, conducted in two phases on the public Ember and Bodmas datasets. In Phase 1, we establish a performance ceiling by adapting prominent vision-based SSL models (BYOL, SimSiam, Barlow Twins, VICReg) for tabular data with supervised pair generation, finding that BYOL and SimSiam achieve performance comparable to fully supervised models, while Barlow Twins and VICReg significantly underperform. In Phase 2, we evaluate purely unsupervised TRL methods against strong baselines (PCA, Autoencoder, UMAP), demonstrating that VIME establishes a new state of the art for binary program clustering. Informed by these findings, we propose VIME-R, a retrieval-augmented extension of VIME that replaces random marginal-distribution corruption with retrieval-based augmentation to generate more informative training pairs. VIME-R further improves upon VIME, achieving 2.7\%-5.8\% higher Homogeneity on both datasets. Our results highlight retrieval-augmented tabular representation learning as a promising direction for enhancing automated malware analysis. Code will be made available.