Fast Malware Classification using Counting Bloom Filter

Abstract

As attackers make variants of existing malware, it is possible to detect unknown malware by using already-known malware's information. Control Flow Graphs (CFGs) have been used in malware analysis but the graph isomorphism problem is well-known as one of the most difficult problem to solve. In this paper, we proposed a new fast method which can detect malware binaries using CFGs by abstracting common characteristics of malware families. Our method also uses Counting Bloom Filter to find approximate solution of the graph isomorphism problem. The experimental results showed that processing overhead of our proposed method is much lower than n-gram based methods.