Performance Evaluation of Features and Clustering Algorithms for Malware
Houtan Faridi, Srivathsan Srinivasagopalan, Rakesh M Verma · 2018
Malware has become a huge problem and obfuscation techniques used by attackers means that signature management for malware becomes too time and space consuming. If we can cluster different versions of the same malware together, we can attain many benefits. In this paper, we study the malware clustering problem systematically using several algorithms, distance functions and sets of features. A real-world, ground-truth dataset and multiple metrics are used to evaluate the performance of these suite of approaches. Agglomerative Hierarchical clustering, Spectral clustering, and DBSCAN emerged as the winning algorithms.