Malware classification based on call graph clustering

摘要: Each day, anti-virus companies receive tens of thousands samples potentially harmful executables. Many the malicious are variations previously encountered malware, created by their authors to evade pattern-based detection. Dealing with these large amounts data requires robust, automatic detection approaches. This paper studies malware classification based on call graph clustering. By representing as graphs, it is possible abstract certain away, enabling structural similarities between samples. The ability cluster similar together will make more generic techniques possible, thereby targeting commonalities within a cluster. To compare graphs mutually, we compute pairwise similarity scores via matchings which approximately minimize edit distance. Next, facilitate discovery samples, employ several clustering algorithms, including k-medoids and Density-Based Spatial Clustering Applications Noise (DBSCAN). experiments conducted collection real results evaluated against manual classifications provided human analysts. Experiments show that indeed accurately detect families We anticipate in future, can be used analyse emergence new families, ultimately automate implementation schemes.