The features given to their random forest classifier appear to be: * assembly language instruction features: "token unigrams and bigrams" * decompiled lexical

The features given to their random forest classifier appear to be: * assembly language instruction features: "token unigrams and bigrams" * decompiled lexical features (unparsed decompiled text): "word unigrams, which capture the integer types used in a program, names of library functions, and names of internal functions when symbol information is available" * syntactic features (from the parsed AST of the decompiled text): "AST node unigrams, labeled AST edges, AST node term frequency inverse document frequency (TFIDF), and AST node average depth" * basic block features: TF-IDF weighted "unigrams and bigrams, that is, single basic blocks and sequences of two basic blocks" source: http://www.princeton.edu/~aylinc/papers/caliskan-islam_when.pdf http://www.princeton.edu/~aylinc/papers/caliskan-islam_when....