AVclass2: Massive Malware Tag Extraction from AV Labels
Silvia Sebastián, Juan Caballero
Abstract
Tags can be used by malware repositories and analysis services to enable searches for samples of interest across different dimensions. Automatically extracting tags from AV labels is an efficient approach to categorize and index massive amounts of samples. Recent tools like AVclass and Euphony have demonstrated that, despite their noisy nature, it is possible to extract family names from AV labels. However, beyond the family name, AV labels contain much valuable information such as malware classes, file properties, and behaviors.
Topics & Concepts
MalwareComputer scienceCategorizationInformation retrievalIndex (typography)Artificial intelligenceNatural language processingWorld Wide WebComputer securityAdvanced Malware Detection TechniquesSpam and Phishing DetectionDigital and Cyber Forensics