MarCHGen: A framework for generating a malware concept hierarchy

• Published in: Expert systems Vol. 36; no. 5
• Main Authors: Nguyen, Thien Binh, Tran, Cong Doi, Quan, Thanh Tho, Nguyen, Minh Hai, Le, Tuan Anh
• Format: Journal Article
• Language: English
• Published: Oxford Blackwell Publishing Ltd 01.10.2019
• Subjects: Clustering; computer virus; Computer viruses; concept hierarchy generation; conceptual clustering; Data mining; Datasets; FCA; Feature extraction; malicious software; Malware; malware detection; Temporal logic; V‐LCA
• ISSN: 0266-4720; 1468-0394
• DOI: 10.1111/exsy.12445

Automatic classification of virus instances into a concept hierarchy has been attracting much attention from malware research community. However, it is definitely not a trivial work, because malwares usually come in binary forms whose actions are complicated and obfuscated. Therefore, the typical data mining approaches based on feature extraction are not easily applied. In this paper, we tackle this problem by introducing a framework known as MarCHGen (Malware Concept Hierarchy Generation). In this framework, we first apply virus logical concept analysis, which incorporates formal concept analysis with temporal logic to capture malware behaviours and generalize a virus concept lattice accordingly. Second, we propose an on‐the‐fly conceptual clustering technique to generate a malware concept hierarchy. In the MarCHGen framework, the malware concept hierarchy will be monitored by the prelarge data set management technique to avoid reclustering several times unnecessarily. Our approach has been applied in a real data set of virus, and promising experimental results have been acquired.