Clustering

EMBER-based binary clustering with UMAP + HDBSCAN

Vector Database Statistics

Loading stats...

TLSH database not available

UMAP n_neighbors(5-100)

Controls local vs global structure

UMAP min_dist(0.0-1.0)

Minimum distance between points

HDBSCAN min_cluster_size(2-100)

Minimum points for a cluster

Limit(optional)

Maximum samples to process

EMBER Extraction: Extracts 2381-dimensional static features from PE files (imports, exports, headers, etc.)
UMAP: Reduces 2381 dimensions to 3D while preserving similarity structure
HDBSCAN: Density-based clustering that automatically determines number of clusters
Noise Points (gray): Samples that don't fit well into any cluster - potentially unique or rare binaries
Use Cases: Group similar macro binaries, identify malware families, detect outliers