{'fraction_non_alphanumeric': 0.01867816091954023, 'fraction_numerical': 0.0, 'mean_word_length': 5.5754716981132075, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Performance Evaluation of Features and Clustering Algorithms for Malware

Malware has become a huge problem and obfuscation techniques used by attackers means that signature management for malware becomes too time and space consuming. If we can cluster different versions of the same malware together, we can attain many benefits. In this paper, we study the malware clustering problem systematically using several algorithms, distance functions and sets of features. A real-world, ground-truth dataset and multiple metrics are used to evaluate the performance of these suite of approaches. Agglomerative Hierarchical clustering, Spectral clustering, and DBSCAN emerged as the winning algorithms.