swMATH ID: 23934
Software Authors: Rafique, M.Z., Caballero, J.
Description: FIRMA: malware clustering and network signature generation with mixed network behaviors. The ever-increasing number of malware families and polymorphic variants creates a pressing need for automatic tools to cluster the collected malware into families and generate behavioral signatures for their detection. Among these, network traffic is a powerful behavioral signature and network signatures are widely used by network administrators. In this paper we present FIRMA, a tool that given a large pool of network traffic obtained by executing unlabeled malware binaries, generates a clustering of the malware binaries into families and a set of network signatures for each family. Compared with prior tools, FIRMA produces network signatures for each of the network behaviors of a family, regardless of the type of traffic the malware uses (e.g., HTTP, IRC, SMTP, TCP, UDP). We have implemented FIRMA and evaluated it on two recent datasets comprising nearly 16,000 unique malware binaries. Our results show that FIRMA’s clustering has very high precision (100
Homepage: https://link.springer.com/chapter/10.1007%2F978-3-642-41284-4_8
Related Software: Panorama; KEA; VAMO; Polygraph; ExecScent; Hamsa; Autograph; BitShred; PhishEye; BotProfiler; BotTokenizer; BotMiner; BotSniffer
Cited in: 1 Document

Standard Articles

1 Publication describing the Software Year
FIRMA: Malware clustering and network signature generation with mixed network behaviors
Rafique, M. Zubair; Caballero, Juan

Cited in 0 Serials

Citations by Year