Scalable, Behavior-Based Malware Clustering

By Ulrich Bayer, Paolo Milani Comparetti, Clemens Hlauschek, Christopher Krügel, Engin Kirda. 2009

763 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Practical Evasion of a Learning-Based Classifier: A Case Study (2014, background): “Periodic retraining is also not carried out in the deployed system.”
Poisoning behavioral malware clustering (2014, background): “[3] counter this shortcoming with an approximate clustering using locality sensitive hashing (LSH).”
Is data clustering in adversarial settings secure? (2013, background): “When dmax takes on values approximately in [3, 4], the clustering algorithm creates only three clusters, corresponding effectively to the attacker’s goal C (this is witnessed by the fact that the averaged attacker’s objective is almost zero).”
Deep neural network based malware detection using two dimensional binary program features (2015, methodology): “stogram of all the ﬁle’s subsamples based on two or more properties of the individual subsample. Potentially the feature space can become large, in those cases methods like locality-sensitive hashing [20, 6], feature hashing (aka hashing “trick”) [32, 21], or random projections [22, 20, 14, 10] have”
On the feasibility of online malware detection with performance counters (2013, background): “Many of these schemes use machine learning techniques to learn and classify good and bad behaviors from labeled sets [14, 15, 16, 17].”
Juxtapp: A Scalable System for Detecting Code Reuse among Android Applications (2012, unknown): “[36] use locality sensitive”
Detection of Intrusions and Malware, and Vulnerability Assessment (2013, methodology): “Our network clustering uses the features in [4].”
Practical Attacks Against Graph-based Clustering (2017, background): “Community discovery identifies criminal networks [39], connected components track malvertising campaigns [21], spectral clustering on graphs discovers botnet infrastructure [9, 20], hierarchical clustering identifies similar malware samples [11, 45], binary download graphs group potential malware do”
A Survey on Malware Detection Using Data Mining Techniques (2017, background): “Bayer et al. [2009] applied Locality Sensitive Hashing (LSH) [Indyk and Motwani 1998] on the behavior proﬁles (more concise than system call traces) to achieve efﬁcient and scalable malware clustering.”
ANDRUBIS -- 1,000,000 Apps Later: A View on Current Android Malware Behaviors (2014, methodology): “For example, experiments applying clustering [22] to Android apps yielded promising results and showed that the feature set produced by ANDRUBIS is rich enough to allow researchers to build various post-processing methods upon [23].”
A survey on automated dynamic malware-analysis techniques and tools (2012, methodology): “The analysis of unknown binaries (Anubis) project [Anubis] is based on TTAnalyze presented in Bayer et al. [2006]. Anubis executes the sample under analysis in an emulated environment consisting of a Windows XP operating system running as the guest in Qemu [Bellard 2005].”
VAMO: towards a fully automated malware clustering validity analysis (2012, methodology): “In particular, by using plagiarism detection algorithms to measure the similarity between malware samples, they show that a factor contributing to the strong results reported in [2] might be that the 2,658 validation instances selected via majority voting on multiple AVs are simply easy to classify.”
DUET: integration of dynamic and static analyses for malware clustering with cluster ensembles (2013, background): “More recently, Bayer et al. [6] adopted locality-sensitive hashing (LSH) and Rieck et al. [20] developed a prototype-based clustering al-gorithm to improve the scalability of behavior-based clustering.”
Deep Learning for Classification of Malware System Call Sequences (2016, background): “Although most of papers investigate malware clustering [5, 6], supervised learning is also a prominent topic.”
Automatic analysis of malware behavior using machine learning (2011, unknown): “It is necessary to note that the clustering of [4] has been performed separately by courtesy of Vienna University of Technology.”
Scalable fine-grained behavioral clustering of HTTP-based malware (2013, methodology): “As a consequence, clustering algorithms such as [7, 8] may generate clusters that are useful when the objective is to extract systemlevel behavioral signatures, but may not perform as well when the goal is to generate network-level behavioral signatures, as shown in [31].”