Skip to main content
Article
Hidden Markov models for malware classification
Journal of Computer Virology and Hacking Techniques (2014)
  • Chinmayee Annachhatre, San Jose State University
  • Thomas H. Austin, San Jose State University
  • Mark Stamp, San Jose State University
Abstract
Previous research has shown that hidden Markov model (HMM) analysis is useful for detecting certain challenging classes of malware. In this research, we consider the related problem of malware classification based on HMMs. We train multiple HMMs on a variety of compilers and malware generators. More than 8,000 malware samples are then scored against these models and separated into clusters based on the resulting scores. We observe that the clustering results could be used to classify the malware samples into their appropriate families with good accuracy. Since none of the malware families in the test set were used to generate the HMMs, these results indicate that our approach can effective classify previously unknown malware, at least in some cases. Thus, such a clustering strategy could serve as a useful tool in malware analysis and classification.
Keywords
  • Computer science,
  • hidden markov,
  • malware,
  • software,
  • telecommunications
Disciplines
Publication Date
2014
DOI
10.1007/s11416-014-0215-x
Publisher Statement
SJSU users: use the following link to login and access the article via SJSU databases
Citation Information
Chinmayee Annachhatre, Thomas H. Austin and Mark Stamp. "Hidden Markov models for malware classification" Journal of Computer Virology and Hacking Techniques Vol. 11 Iss. 2 (2014) p. 59 - 73 ISSN: 2274-2042
Available at: http://works.bepress.com/thomas_austin/2/