Clustering versus SVM for Malware Detection by Usha NarraPrevious work has shown that we can effectively cluster certain classes of malware into their respective families. In this research, we extend this previous work to the problem of developing an automated malware detection system. We first compute clusters for a collection of malware families. Then we analyze the effectiveness of classifying new samples based on these existing clusters. We compare results obtained using -means and Expectation Maximization (EM) clustering to those obtained using Support Vector Machines (SVM). Using clustering, we are able to detect some malware families with an accuracy comparable to that of SVMs. One advantage of the clustering approach is that there is no need to retrain for new malware families.

No abstract