It seems functions can change trigger type between two days. After it changes, the trigger type remains stable.
I identified 1987 functions that change triggers through the traces.
Re-reading the explanation about the dataset, I believe only the names of the function and its owning application are hashed? So if a user changes the trigger type of a function, it does not change its hash? Then, would it be sensible to identify a function by its hash AND by its trigger type?
It seems functions can change trigger type between two days. After it changes, the trigger type remains stable.
I identified 1987 functions that change triggers through the traces.
Re-reading the explanation about the dataset, I believe only the names of the function and its owning application are hashed? So if a user changes the trigger type of a function, it does not change its hash? Then, would it be sensible to identify a function by its hash AND by its trigger type?