Check out the new USENIX Web site. next up previous
Next: During Deployment Up: System Performance Previous: System Performance


In order for the data mining algorithm to quickly generate the models, it requires all calculations to be done in memory. The algorithm consumed space in excess of a gigabyte of RAM. By splitting the data into smaller pieces, the algorithm was done in memory with no loss in accuracy.

The training of a classifier took 2 hours 59 minutes and 49 seconds running on a Pentium III 600 Linux machine with 1GB of RAM. The classifier took on average 2 minutes and 28 seconds for each of the 4,301 binaries in the data set.

Matthew G. Schultz