Malware clustering based on function call graph similarity

A non-transitory, computer-readable medium having instructions stored thereon that are executable by a server system to perform operations comprising:

• maintaining malware information corresponding to a plurality of malware samples, wherein, for each of the plurality of malware samples, the malware information includes:
• a string specifying a function call graph for a corresponding malware sample;
• and
• a set of statistical properties associated with the corresponding malware sample;
• receiving, from a computer system, information corresponding to a particular malware sample, wherein the information includes:
• a particular string specifying a function call graph for the particular malware sample;
• and
• a particular set of statistical properties associated with the particular malware sample;
• executing a query against the malware information to retrieve malware samples similar to the particular malware sample, wherein the query specifies one or more of the particular set of statistical properties;
• based on the query, identifying a subset of malware samples, of the plurality of malware samples, that match the particular malware sample;
• and
• assigning the particular malware sample and the subset of malware samples into one of a plurality of clusters of related malware samples.

A method, comprising:

• accessing, by a computer system, information corresponding to a plurality of malware samples;
• based on the information, generating, by the computer system, a function call graph for each of the plurality of malware samples, wherein, for a given malware sample of the plurality of malware samples, the generating includes:
• identifying a plurality of function calls included in the information for the given malware sample;
• assigning a label to each of the plurality of function calls;
• identifying relationships between the plurality of function calls;
• and
• generating the function call graph for the given malware sample based on the relationships and the labels;
• and
• based on the function call graphs, assigning, by the computer system, each of the plurality of malware samples into one of a plurality of clusters of related malware samples.