MACE: Malware Analysis and Clustering Engine

Analysing malicious files is a lengthy task and, given a set of hundreds, even thousands of files, a security researcher would have to spend multiple hours looking at each sample. Considering that new malware is created every day, a way to reduce the analysis time is mandatory. This paper presents the Malware Analysis and Clustering Engine (MACE), a solution implemented to address this problem. It offers the user a modular framework implementing multiple feature extraction methods and clustering algorithms, which can provide a multitude of clustering configurations. The users can experiment with differ-ent configurations and choose one that best suits their scenario, obtaining a clustering result that allows them to analyse only a single sample from each cluster and draw a conclusion both for it and all its peers. This approach significantly accelerates the analysis process. The engine was tested on four different datasets, each trying to exemplify a scenario that is likely to be encountered in real situations. The results indicate that MACE does achieve its goal, providing multiple configurations for each dataset that reach both great accuracy and a number of clusters that is close to the one that was expected.