Systems and methods for classifying malware based on feature reuse

A method of classifying malware based on the frequency of feature reuse, the method comprising:

• identifying, by a data processing system comprising one or more processors coupled to a memory, from a database:
• (1) a malicious feature frequency corresponding to a number of occurrences of a first feature in a plurality of known malicious binaries,
• (2) a benign feature frequency corresponding to a number of occurrences of the first feature in a plurality of known benign binaries, and
• (3) a first weight value of the first feature corresponding to a size of the first feature;
• generating, by the data processing system, a first reuse vector based on the malicious feature frequency and the benign feature frequency, the first reuse vector being a bit string comprising a first half and a second half, the first half comprising a first plurality of bits and the second half comprising a second plurality of bits, said generating the first reuse vector comprising:
• determining that the malicious feature frequency falls within a malicious threshold range;
• setting a first bit of the first plurality of bits to a binary one and a second bit of the first plurality of bits to a binary zero responsive to the determination that the malicious feature frequency falls within the malicious threshold range;
• determining that the benign feature frequency falls within a benign threshold range;
• and
• setting a first bit of the second plurality of bits to a binary one and a second bit of the second plurality of bits to a binary zero responsive to the determination that the benign feature frequency falls within the benign threshold range;
• determining, by the data processing system, that a training binary associated with a known classification includes the first feature and a second feature, wherein the second feature is associated with a second reuse vector and a second weight value corresponding to a size of the second feature;
• constructing, by the data processing system, responsive to determining that the training binary includes the first feature and the second feature, a reuse tensor using the first reuse vector, the second reuse vector, the first weight value, and the second weight value;
• and
• training, by the data processing system, a malware classification model using the reuse tensor and the known classification associated with the training binary.

One or more computer storage media encoded with computer program instructions that when executed by one or more computers cause the one or more computers to perform operations for classifying malware based on the frequency of feature reuse comprising:

• identifying, from a database:
• (1) a malicious feature frequency corresponding to a number of occurrences of a first feature in a plurality of known malicious binaries,
• (2) a benign feature frequency corresponding to a number of occurrences of the first feature in a plurality of known benign binaries, and
• (3) a first weight value of the first feature corresponding to a size of the first feature;
• generating, by the data processing system, a first reuse vector based on the malicious feature frequency and the benign feature frequency, the first reuse vector being a bit string comprising a first half and a second half, the first half comprising a first plurality of bits and the second half comprising a second plurality of bits, said generating the first reuse vector comprising:
• determining that the malicious feature frequency falls within a malicious threshold range;
• setting a first bit of the first plurality of bits to a binary one and a second bit of the first plurality of bits to a binary zero responsive to the determination that the malicious feature frequency falls within the malicious threshold range;
• determining that the benign feature frequency falls within a benign threshold range;
• and
• setting a first bit of the second plurality of bits to a binary one and a second bit of the second plurality of bits to a binary zero responsive to the determination that the benign feature frequency falls within the benign threshold range;
• determining, by the data processing system, that a training binary associated with a known classification includes the first feature and a second feature, wherein the second feature is associated with a second reuse vector and a second weight value corresponding to a size of the second feature;
• constructing, by the data processing system, responsive to determining that the training binary includes the first feature and the second feature, a reuse tensor using the first reuse vector, the second reuse vector, the first weight value, and the second weight value;
• and
• training, by the data processing system, a malware classification model using the reuse tensor and the known classification associated with the training binary.