Kind of malicious software clustering method expressed based on tlsh feature

It is a kind of malicious software clustering method expressed based on TLSH feature, whose features include the steps as below:

• Step 1:
• Used Cuckoo Sandbox to analyze the sample and acquire the behave analysis report;
• Step 2:
• Acquire the static characteristics of the sample from the behavior analysis report, The static characteristics of the sample include DLL information, the import and export function information of DLL information and the character string information captured during the analysis process, And sort the information mentioned above in accordance with the dictionary to get a character string;
• Step 3:
• Acquire the resource access record of the sample from the behavior analysis report, The resource access record of the sample includes the information as follows:
• sample files/catalogue, registry, service, DLL and the used mutex, Sort the information of every catalogue in accordance with the dictionary and combine them to a character string;
• Separate the mentioned files/catalogue and registry information into subitems with the separator “\\” and then sort them;
• Step 4:
• Acquire the dynamic API of the sample and the API called by the loaded DLL from the behavior analysis report, and sort the information mentioned above in accordance with the dictionary to get a character string;
• Step 5:
• Calculate the TLSH value of the character string gotten from Step 2, Step 3 and Step 4 respectively;
• Step 6:
• Adopt TLSH distance calculation formula to get the TLSH distance of two TLSH values and take the average value of two minimum values as the final distance of two samples, Adopt OPTICS algorithm to cluster the sample.