An AI Approach to Malware Similarity Analysis: Mapping the Malware Genome With a Deep Neural Network
summary
Describes using a variational autoencoder to remap feature vectors so distances reflect true family relationships, trained on 800,000 VirusTotal samples with 1,500 Microsoft family/variant labels and time‑split validation. Encoder outputs feed a 3‑nearest‑neighbor F1 check. Using simple string features lifts F1 from ~65% to ~75%, and with a richer feature set the method reports 98% accuracy, while removing manual tuning and enabling daily retraining as labels arrive.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:10Why AI
- 3:25The Fundamental Task
- 5:40The Problem
- 7:30The Question
- 8:04The Perfect World
- 10:53Why Use Deep Neural Networks
- 12:19Variational AutoEncoder
- 16:59Visualization
- 28:10Conclusion
related talks
40mDemystifying File Similarity for Malware Detection
30mData Driven Security
27mA Machine Learning approach for detecting a Malware
22mA Scalable, Ensemble Approach for Building and Visualizing Deep Code-Sharing Networks
41mHow AI Is Changing the Malware Landscape
44mUnmasking APTs: An Automated Approach for Real-World Threat Attribution
25mEnhancing Malware Code Similarity Detection through Vectorsearch and TLSH
27mTranscend: Detecting Concept Drift in Malware Classification Models