A closing difficulty is that even the more sophisticated approaches described in the investigate literature are inclined to only exploit a person "feature domain," be it malware instruction sequences, simply call graph construction, software binary interface metadata, or dynamic API contact traces, leaving these techniques open up to defeat by smart adversaries.