Clustering the polymorphic malware traces

Abstract

A common threat for maximum computers today are due to malwares. In recent years attackers created different types of malwares which has become a challenge for many anti malware software. The malware companies have generated various forms of same malware. The different forms of the same malware will have similar functionality and same behaviour but with various representation. Here we cluster (group) the similar behaviour malware using number of distance measure. For clustering (group) malware samples we have many approaches which are published. There by different similarity measures are used but without thoroughly discussing their choice. Here we discuss about various similarity measure and their properties to get the accurate output. Our main focus is on behavioural features of malware and compare. Here we have used K means for clustering the malware samples.