Automated Classification and Analysis of Internet Malware

By Michael Bailey, Jon Oberheide, Jonathon Andersen, Z. Morley Mao, Farnam Jahanian, Jose Nazario. 2007

620 citations recorded by the source corpus.

Subfields: Computer Networks and Communications, Information Systems, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Information Systems

In Signal Processing

Citations in the corpus

Poisoning behavioral malware clustering (2014, background): “[1] have been the first to apply clustering algorithms to this information.”
Security analysis of online centroid anomaly detection (2010, background): “Machine learning methods can also help researchers to better understand the design of malicious software by using classification or clustering techniques together with special malware acquisition and monitoring tools (Bailey et al., 2007; Rieck et al., 2008).”
Deep Learning for Classification of Malware System Call Sequences (2016, background): “Although most of papers investigate malware clustering [5, 6], supervised learning is also a prominent topic.”
AVclass: A Tool for Massive Malware Labeling (2016, methodology): “Prior work has identiﬁed the problem of different AV engines disagreeing on labels for the same sample [2, 6, 18, 20].”
BotMiner: Clustering Analysis of Network Traffic for Protocol- and Structure-Independent Botnet Detection (2008, background): “One may also directly apply normalized compression distance (NCD [5, 41]) on the original (maybe packed) binaries.”
BitShred: feature hashing malware for scalable triage and semantic analysis (2011, neutral): “, [12, 13, 28, 29, 33, 35].”
Behavioral Clustering of HTTP-Based Malware and Signature Generation Using Malicious Network Traces (2010, methodology): “In this section we present our experimental results.”
Hunting for undetectable metamorphic viruses (2011, methodology): “A sophisticated similarity measure based on the call graph and control flow graph is discussed in [4], while a similarity measure based on code behavior is given in [3].”
Malware Analysis and Classification: A Survey (2014, background): “[44] pointed out that the antivirus (AV) products characterize the malwares in ways that are not consistent across various AV products, not complete across malwares and are not concise in their semantics.”
Scalable fine-grained behavioral clustering of HTTP-based malware (2013, methodology): “As a consequence, clustering algorithms such as [7, 8] may generate clusters that are useful when the objective is to extract systemlevel behavioral signatures, but may not perform as well when the goal is to generate network-level behavioral signatures, as shown in [31].”
Towards an understanding of anti-virtualization and anti-debugging behavior in modern malware (2008, background): “For example, behavior-based clustering of malware programs was proposed [8].”
Ether: malware analysis via hardware virtualization extensions (2008, background): “Recent advances in malware analysis [17, 24, 25, 33] show promise in understanding modern malware, but before these and other approaches can be used to determine what a malware instance does or might do, the runtime behavior of that instance and/or an unobstructed view of its code must be obtained.”
A Probabilistic Discriminative Model for Android Malware Detection with Decompiled Source Code (2015, methodology): “Other work has used the same general idea of behavioral analysis, but extended the technique of matching malicious code using several machine learning techniques such as support vector machines [18] and clustering [19].”
Automatic analysis of malware behavior using machine learning (2011, positive): “The ﬁrst clustering system for observed behavior has been introduced by [3] and later on extended by [4] to be scalable, where the system devised by [4] provides an excellent run-time performance in practice.”
Malware images: visualization and automatic classification (2011, background): “These include both static analysis [13-19] as well as dynamic analysis [20-24].”
VAMO: towards a fully automated malware clustering validity analysis (2012, background): “Furthermore, in [1]”
Effective and Efficient Malware Detection at the End Host (2009, methodology): “Such reports can be evaluated to find clusters of samples that behave similarly [5, 7] or to classify the type of observed, malicious activity [39].”
MARVIN: Efficient and Comprehensive Mobile App Classification through Static and Dynamic Analysis (2015, background): “One application of unsupervised learning is finding clusters of samples that exhibit similar behavior based on dynamic analysis [19,20].”