Automated identification of malware families based on shared evidences

A computer program product comprising a computer readable storage medium having a computer readable program stored therein, wherein the computer readable program, when executed on a computing device, causes the computing device to implement a malware family identification engine for automatically identifying family tree relationships among malware based on reasoning of indirect relations from observed entities to family entities, wherein the computer readable program causes the computing device to:

• construct a graph data structure of direct relationships between malware instances and malware families, direct relationships between malware instances and detected tags, and indirect relationships between detected tags and malware families, wherein each detected tag node has one or more outgoing links (OGLs) to malware family nodes;
• build a dictionary data structure comprising detected tag entries linking each detected tag to one or more malware family nodes based on the graph data structure;
• identify significant indirect entities (SIEs) within the detected tag entries of the dictionary data structure;
• select a SIE with a highest number of out-going links (OGLs) as a root node in a family tree data structure;
• recursively connect SIEs with a number of OGLs less than the highest number of OGLs to the root node in the family tree data structure;
• and
• convert each SIE name in the family tree data structure to a chained family entity name in the family tree data structure.

An apparatus comprising:

• a processor;
• and
• a memory coupled to the processor, wherein the memory comprises instructions which, when executed by the processor, cause the processor to implement a malware family identification engine for automatically identifying family tree relationships among malware based on reasoning of indirect relations from observed entities to family entities, wherein the instructions cause the processor to:
• construct a graph data structure of direct relationships between malware instances and malware families, direct relationships between malware instances and detected tags, and indirect relationships between detected tags and malware families, wherein each detected tag node has one or more outgoing links (OGLs) to malware family nodes;
• build a dictionary data structure comprising detected tag entries linking each detected tag to one or more malware family nodes based on the graph data structure;
• identify significant indirect entities (SIEs) within the detected tag entries of the dictionary data structure;
• select a SIE with a highest number of out-going links (OGLs) as a root node in a family tree data structure;
• recursively connect SIEs with a number of OGLs less than the highest number of OGLs to the root node in the family tree data structure;
• and
• convert each SIE name in the family tree data structure to a chained family entity name in the family tree data structure.