Malware remains a persistent and evolving cyber-security threat. Conventional detection methodologies rooted in static binary analysis or dynamic tracing of API calls suffer from critical limitations. The former is readily circumvented through code obfuscation, while the latter demands substantial computational resources and is often infeasible at enterprise scale. This work investigates an alternative approach to malware classification that forgoes both direct binary analysis and fine-grained instrumentation, instead utilizing high-level system telemetry such as process, file, registry, and network events. Such telemetry is routinely generated by Endpoint Detection and Response (EDR) systems and retained in centralized security logging platforms (e.g., SIEMs), rendering this method applicable to enterprise environments. Treating sequences of telemetry events as text-like data, we apply Natural Language Processing (NLP) techniques to model behavioral patterns and evaluate four neural architectures: Multi-Layer Perceptron (MLP), Convolutional Neural Network (CNN), Long Short-Term Memory (LSTM), and a Transformer-based model on the task of malware family classification. Our results show that telemetry-only data enables accurate classification, with the Transformer model achieving peak performance ( 95–96% accuracy) and the remaining models following closely. This study contributes (1) empirical evidence that high-level behavioral telemetry is sufficient for malware classification on real-world samples, (2) a novel application of NLP-based sequence modeling to malware behavior data, and (3) a comparative analysis of modern neural architectures, highlighting trade-offs in accuracy, efficiency, and deployability. The findings underscore the potential of leveraging existing enterprise telemetry for scalable, real-time malware detection. Code for this project is available at: https://github.com/schladt/GIMC/.

Deterministic multithreading (DMT) eliminates many pernicious software problems caused by nondeterminism. It works by constraining a program to repeat the same thread interleavings, or schedules, when given same input. Despite much recent research, it remains an open challenge to build both deterministic and efficient DMT systems for general programs on commodity hardware. To deterministically resolve a data race, a DMT system must enforce a deterministic schedule of shared memory accesses, or mem-schedule, which can incur prohibitive overhead. By using schedules consisting only of synchronization operations, or sync-schedule, this overhead can be avoided. However, a sync-schedule is deterministic only for race-free programs, but most programs have races.