Cluster Analysis of Malware Family Relationships

TL;DR

This paper employs $K$-means clustering to analyze relationships among malware families and types, demonstrating its effectiveness for malware data exploration and understanding family similarities.

Contribution

It introduces a clustering approach to analyze malware family relationships and types, providing insights into their similarities and distinctions.

Findings

$K$-means effectively clusters malware families and types.

Clustering reveals meaningful relationships between malware families.

Results support $K$-means as a tool for malware data analysis.

Abstract

In this paper, we use $K$-means clustering to analyze various relationships between malware samples. We consider a dataset comprising~20 malware families with~1000 samples per family. These families can be categorized into seven different types of malware. We perform clustering based on pairs of families and use the results to determine relationships between families. We perform a similar cluster analysis based on malware type. Our results indicate that $K$-means clustering can be a powerful tool for data exploration of malware family relationships.