On exploiting static and dynamic features in malware classification

Abstract

The number of malwares is exponentially growing these days. Malwares have similar signatures if they are developed by the same group of attackers or with similar purposes. This characteristic helps identify malwares from ordinary programs. In this paper, we address a new type of classification that identifies the group of attackers who are likely to develop a given malware. We identify various features obtained through static and dynamic analyses on malwares and exploit them in classification. We evaluate our approach through a series of experiments with a real-world dataset labeled by a group of domain experts. The results show our approach is effective and provides reasonable accuracy in malware classification.