Malware classification method via binary content comparison

Abstract

With the wide spread uses of the Internet, the number of Internet attacks keeps increasing, and malware is the main cause of most Internet attacks. Malware is used by attackers to infect normal users' computers and to acquire private information as well as to attack other machines. The number of new malware and variants of malware is increasing every year because the automated tools allow attackers to generate the new malware or their variants easily. Therefore, performance improvement of the malware analysis is critical to prevent malware from spreading rapidly and to mitigate damages to users. In this paper, we proposed a new malware classification method by analyzing similarities of malware. Our method analyzes a small part of malware to reduce analysis overheads, and experimental results showed that our approach can effectively classify malware families.