Discriminating Malware Families using Partitional Clustering

Malware is malicious software that compromises the confidentiality, integrity, and availability of the infected devices,which is developed by skilled software engineers and is sold in a specialised black market economy. Internet security companies perform analysis of daily malware feeds and one of the challenges in this analysis is the identification of the family of the malware samples. Yara rules using regular expressions are widely applied in the industry to identify malware families, but may fail when malware families are updated. Malware clustering provides an alternative method to discriminate malware families that are not disrupted by minor updates. In this paper, we present Discriminating Malware Families using Partitional Clustering (DMFPC) approach and provide its comparison against previously used malware clustering algorithms, including K-means, Hierarchical, Spectral, and Density Based Spatial Clustering of Applications with Noise (DBSCAN). The results of this evaluation provide valuable input into the continuing design of the partitional clustering algorithms for malware detection.