Abstract: Embodiments relate to systems and methods for behavior-based automated malware analysis and classification. Aspects relate to platforms and techniques which access a set of samples of malware, and extract or capture a set of low-level behavioral artifacts produced by those samples. The low-level artifacts can be used to organize or identify a set of features, based upon which the sample can be classified and/or clustered into different labels, groups, or categories. The artifacts and/or features can be analyzed by one or more selectable algorithms, whose accuracy, efficiency, and other characteristics can be compared to one another for purposes of performing a classification or clustering task. The algorithm(s) can be selected by a user to achieve desired run times, accuracy levels, and/or other effects.

Abstract: Embodiments relate to systems and methods for behavior-based automated malware analysis and classification. Aspects relate to platforms and techniques which access a set of samples of malware, and extract or capture a set of low-level behavioral artifacts produced by those samples. The low-level artifacts can be used to organize or identify a set of features, based upon which the sample can be classified and/or clustered into different labels, groups, or categories. The artifacts and/or features can be analyzed by one or more selectable algorithms, whose accuracy, efficiency, and other characteristics can be compared to one another for purposes of performing a classification or clustering task. The algorithm(s) can be selected by a user to achieve desired run times, accuracy levels, and/or other effects.