Malware Clustering Based on Analysis of Execution-Behavior Reports

A non-transitory, computer-readable medium having instructions stored thereon that, when executed by a processor of a computer system, cause the processor to perform operations comprising:

• executing, in a test environment of the computer system, a plurality of malware samples;
• logging respective features corresponding to respective execution behaviors of each of the plurality of malware samples, wherein the respective features corresponding to the respective execution behaviors of each of the plurality of malware samples comprise internal behavioral features associated with execution behaviors of each of the plurality of malware samples that are local to the computer system on which each of the plurality of malware samples is executed and external behavioral features associated with execution behaviors of each of the plurality of malware samples that attempt to communicate with a device that is external to the computer system;
• generating a report for each of the plurality of malware samples, wherein the report comprises the respective features corresponding to the respective execution behaviors for a respective one of the plurality of malware samples;
• selecting a subset of features from the respective features to generate a reduced feature set for the report for each of the plurality of malware samples;
• processing the report with the reduced feature set for each of the plurality of malware samples to generate a plurality of vectors that include, for each of the plurality of malware samples, a corresponding vector indicative of a respective execution behavior of a corresponding malware sample of the plurality of malware samples;
• based on the plurality of vectors, generating, by the computer system, similarity values indicative of a similarity between ones of the plurality of vectors;
• and
• based on the similarity values, assigning, by the computer system, each of the plurality of malware samples to one of a plurality of clusters of related malware samples.

A system comprising:

• at least one processor;
• and
• a memory storing instructions that are executable by the at least one processor to cause the system to perform operations comprising:
• executing, in a test environment of the system, a plurality of malware samples,
• logging respective features corresponding to respective execution behaviors of each of the plurality of malware samples, wherein the respective features corresponding to the respective execution behaviors of each of the plurality of malware samples comprise internal behavioral features associated with execution behaviors of each of the plurality of malware samples that are local to the system on which each of the plurality of malware samples is executed and external behavioral features associated with execution behaviors of each of the plurality of malware samples that attempt to communicate with a device that is external to the system,
• generating a report for each of the plurality of malware samples, wherein the report comprises the respective features corresponding to the respective execution behaviors for a particular malware sample,
• selecting a subset of features from the respective features to generate a reduced feature set for the report for each of the plurality of malware samples,
• processing the report for each of the plurality of malware samples to generate a plurality of vectors that include, for each of the plurality of malware samples, a corresponding vector indicative of a respective execution behavior of a corresponding malware sample of the plurality of malware samples,
• based on the plurality of vectors, generating similarity values indicative of a similarity between ones of the plurality of vectors, and
• based on the similarity values, assigning each of the plurality of malware samples to one of a plurality of clusters of related malware samples.