Discriminant malware distance learning on structural information for automated malware classification

The voluminous malware variants that appear in the Internet have posed severe threats to its security. In this work, we explore tech-niques that can automatically classify malware variants into their corresponding families. We present a generic framework that ex-tracts structural information from malware programs as attributed function call graphs, in which rich malware features are encoded as attributes at the function level. Our framework further learns discriminant malware distance metrics that evaluate the similarity between the attributed function call graphs of two malware pro-grams. To combine various types of malware attributes, our method adaptively learns the confidence level associated with the classifi-cation capability of each attribute type and then adopts an ensem-ble of classifiers for automated malware classification. We evaluate our approach with a number of Windows-based malware instances belonging to 11 families, and experimental results show that our automated malware classification method is able to achieve high classification accuracy