Automatic malware categorization using cluster ensemble

Malware categorization is an important problem in malware analysis and has attracted a lot of attention of computer security researchers and anti-malware industry recently. Today’s malware samples are created at a rate of millions per day with the development of malware writing techniques. There is thus an urgent need of effective methods for automatic malware categorization. Over the last few years, many clustering techniques have been employed for automatic malware categorization. However, such techniques have isolated successes with limited effectiveness and efficiency, and few have been applied in real anti-malware industry. In this paper, resting on the analysis of instruction frequency and function-based instruction sequences, we develop an Automatic Malware Categorization System (AMCS) for automatically grouping malware samples into families that share some common characteristics using a cluster ensemble by aggregating the clustering solutions generated by different base clu...

• Type: Journal
• Year: 2010
• Where: KDD
• Authors: Yanfang Ye, Tao Li, Yong Chen, Qingshan Jiang
• Keywords: Automatic Malware Categorization, Data Mining, KDD 2010, Malware, Malware Categorization