Abstract: Methods and systems for out-of-distribution (OOD) detection in autonomous driving systems are described. A method for use in an autonomous driving system may include filtering feature vectors. The feature vectors may be filtered using a first filter to obtain clusters of feature vectors. The method may include assigning one or more images to a respective cluster based on a feature vector of the image. The method may include filtering a subset of the images using a second filter to determine a classification model. The method may include storing the classification model on a vehicle control system of a vehicle. The method may include detecting an image using a vehicle sensor. The method may include classifying the detected image based on the classification model. The method may include performing a vehicle action based on the classified detected image.

Abstract: Methods and systems for out-of-distribution (OOD) detection in autonomous driving systems are described. A method for use in an autonomous driving system may include filtering feature vectors. The feature vectors may be filtered using a first filter to obtain clusters of feature vectors. The method may include assigning one or more images to a respective cluster based on a feature vector of the image. The method may include filtering a subset of the images using a second filter to determine a classification model. The method may include storing the classification model on a vehicle control system of a vehicle. The method may include detecting an image using a vehicle sensor. The method may include classifying the detected image based on the classification model. The method may include performing a vehicle action based on the classified detected image.

Abstract: Techniques are disclosed for identifying legitimate files using a hash-based cloud reputation using parts of a file to generate a hash value for reputation score lookup. A reputation service receives a request for a reputation score associated with a file. The request specifies a hash value for the file. The hash value is generated based on one or more parts of the file. The service identifies one of a plurality of file clusters that includes one or more files that matches to the specified hash value. The service determines a reputation score for the file based on the identified file cluster. The reputation score indicates a rating of the file based on a distribution of the file in a user base. The service returns the reputation score in response to the request.

Abstract: A system and method for .Net PE files malware detection is provided. The method may include accessing two or more portable executable (PE) files and detecting at least one identical global user identifier (GUID) attribute. In response to finding identical GUID attributes, the method may include clustering a group of files into family clusters each having the same GUID attribute. The method may generate and release a signature for the family cluster. An exoneration criteria level may be set in accordance with matching characteristics associated with an acceptable software standard for the computing system or network, such that when the exoneration criteria level is reached, the PE file is exonerated from being associated with PUA or malware. Until this criterion is met, the PE file will be identified as PUA or malware. Additional GUID attributes may be identified as further proof that the PE file is polymorphic.