Methods and apparatus for unknown sample classification using agglomerative clustering

A non-transitory computer readable storage medium comprising instructions which, when executed, cause at least one processor to at least:

• extract a feature from a sample source code, the feature including at least one of a register, a variable, or a library based on a threshold of occurrence in a corpus of samples, the corpus of samples including malware samples;
• generate a dendrogram based on features extracted from the sample source code, the dendrogram representing a collection of samples clustered based on similarity among the samples, the samples including sample clusters belonging to known malware families;
• traverse the dendrogram to identify similarity of an unknown sample to the sample clusters based on a confidence score;
• and
• identify anchor point samples from the sample clusters identified as similar to the unknown sample, the anchor point samples to provide metadata for use in extrapolating information to classify the unknown sample.

A method, comprising:

• extracting a feature from a sample source code, the feature including at least one of a register, a variable, or a library based on a threshold of occurrence in a corpus of samples, the corpus of samples including malware samples;
• generating a dendrogram based on features extracted from the sample source code, the dendrogram representing a collection of samples clustered based on similarity among the samples, the samples including sample clusters belonging to known malware families;
• traversing the dendrogram to identify similarity of an unknown sample to the sample clusters based on a confidence score;
• and
• identifying anchor point samples from the sample clusters identified as similar to the unknown sample, the anchor point samples to provide metadata for use in extrapolating information to classify the unknown sample.