Journal article

Malware classification based on call graph clustering

Kinable J, Kostakis O ...see all

Journal in Computer Virology, vol. 7, issue 4 (2011) pp. 233-245

  • 4


    Mendeley users who have this article in their library.
  • N/A


    Citations of this article.
Sign in to save reference


Each day, anti-virus companies receive tens of thousands samples of potentially harmful executables. Many of the malicious samples are variations of previously encountered malware, created by their authors to evade pattern-based detection. Dealing with these large amounts of data requires robust, automatic detection approaches. This paper studies malware classification based on call graph clustering. By representing malware samples as call graphs, it is possible to abstract certain variations away, enabling the detection of structural similarities between samples. The ability to cluster similar samples together will make more generic detection techniques possible, thereby targeting the commonalities of the samples within a cluster. To compare call graphs mutually, we compute pairwise graph similarity scores via graph matchings which approximately minimize the graph edit distance. Next, to facilitate the discovery of similar malware samples, we employ several clustering algorithms, including k-medoids and Density-Based Spatial Clustering of Applications with Noise (DBSCAN). Clustering experiments are conducted on a collection of real malware samples, and the results are evaluated against manual classifications provided by human malware analysts. Experiments show that it is indeed possible to accurately detect malware families via call graph clustering. We anticipate that in the future, call graphs can be used to analyse the emergence of new malware families, and ultimately to automate implementation of generic detection schemes. © 2011 Springer-Verlag France.

Author-supplied keywords

  • Anti virus
  • Automatic Detection
  • Call graphs
  • Cluster analysis
  • Clustering algorithms
  • Computer crime
  • Density-based spatial clustering of applications w
  • Detection scheme
  • Detection technique
  • Executables
  • Experiments
  • Graph edit distance
  • Graph matchings
  • Graph similarity
  • K-medoids
  • Large amounts of data
  • Malwares
  • Manual classification
  • Structural similarity
  • Viruses
  • XML

Get free article suggestions today

Mendeley saves you time finding and organizing research

Sign up here
Already have an account ?Sign in


  • J Kinable

  • O Kostakis

Cite this document

Choose a citation style from the tabs below

Save time finding and organizing research with Mendeley

Sign up for free