A PV-DM-based feature fusion method for binary malware clustering

Utilizing NLP methods in malware classification or clustering applications is a hotspot in malware analysis. Binary malware embedding has become an important direction and basis for malware analysis. Existing binary malware vectorizing methods cannot extract semantic and functional information simultaneously, which may affect the performance of family clustering. In this paper, a novel feature fusion representation method is proposed based on PV -DM (Paragraph Vector-Distributed Memory) model, and the K-Means algorithm is adopted for family clustering. The method combines the features of program-level API call sequence and function-level instruction sequences by means of PV -DM. The functional and semantic representation capabilities of binary malwares can be improved. Malware public dataset VXHeavon is taken as the dataset. A series of experiments are conducted, using the existing family labels as the clustering accuracy evaluation standard. The results demonstrate that our feature fusion representation method outperforms the baseline method by 4.96% in terms of accuracy.