Three Approaches, Often Mixed Together
Work in malware analysis and security-focused machine learning tends to follow one of three broad approaches, and a single paper often mixes more than one.
Empirical, benchmark-driven work. A method is proposed and measured against a fixed dataset and a fixed baseline: a public malware corpus, say, or a standard intrusion-detection traffic set. The claim rests on a measured improvement, under stated conditions.
Theoretical or algorithmic work. An algorithm or a proof is derived analytically. Experiments, if there are any, illustrate the theory rather than establish it.
Systems or applied-engineering work. The contribution is a working tool, a detector, or a pipeline, and the evaluation is operational: latency, resource cost, real-world detection rate.
Applied Research in Real Time: the WannaCry Kill Switch
On 12 May 2017, the WannaCry ransomware worm began spreading across Windows machines worldwide, using a leaked NSA exploit called EternalBlue to jump from one unpatched computer to the next without anyone having to click anything. Within hours, more than 200,000 systems in over 150 countries were affected, including large parts of the UK's National Health Service, which had to divert ambulances away from some hospitals.
A security researcher, Marcus Hutchins, started reverse-engineering the malware's binary that same day. He noticed something odd: before encrypting a victim's files, WannaCry queried a long, meaningless domain name, and if that domain resolved to a live server, the malware quietly stopped. Hutchins registered the domain, mostly out of curiosity, and the query started resolving. That single action halted the original strain's spread within the day.
That piece of reverse engineering is applied research in its purest form. It had a specific, answerable question ("what does this binary do right before it encrypts a file?"), a method anyone with a disassembler could repeat, and a result that changed a real-world outcome almost immediately. Nothing about it required a lab, a grant, or months of planning, just a precise question and a method rigorous enough that the answer could be trusted and acted on within hours.
Check Your Understanding
Which of the three approaches above best describes a project that trains a malware classifier on a public dataset and reports its accuracy against two existing baseline models? Which approach best describes the WannaCry kill-switch discovery, and why does it not fit the other two as well?