Mal-netminer: Malware classification based on social network analysis of call graph

In this work, we aim to classify malware using automatic classi- fiers by employing graph metrics commonly used in social net- work analysis. First, we make a malicious system call dictionary that consists of system calls found in malware. To analyze the gen- eral structural information of malware and measure the influence of system calls found in malware, we adopt social network analysis. Thus, we use social network metrics such as the degree distribu- Tion, degree centrality, and average distance, which are implicitly equivalent to distinct behavioral characteristics. Our experiments demonstrate that the proposed system performs well in classifying malware families within each malware class with accuracy greater than 98%. As exploiting the social network properties of system calls found in malware, our proposed method can not only classify the malware with fewer features than previous methods adopting graph features but also enables us to build a quick and simple de- Tection system against malware.