Automated Generation of Malware Metadata Signatures

In advanced, targeted malware attacks, the custom software tools used to package and send malicious files and messages can lead to distinctive metadata values that facilitate creation of a malware metadata signature.Manual creation of these signatures requires expert domain knowledge and is time-consuming and error-prone.Our goal is to automate this process.We created several methods of automatically generating malware metadata signatures for ZIP files and emails.We evaluated these methods by comparing signatures generated with these methods to existing expert-created signatures.We found automated methods for ZIP files and emails that are capable of generating metadata signatures that are comparable to the expert-created signatures.