Detecting malware evolution using support vector machines

Malware families typically evolve over a period of time. Differences between malware samples within a single family can originate from various code modifications designed to evade detection, or changes that are made to alter the functionality of the malware itself. Thus, malware samples from the same family from different time periods can exhibit significantly different behavior. In this research, we apply feature ranking-based on linear support vector machine (SVM) weights-to identify changes within malware families. We analyze numerous malware families over extended periods of time. Our goal is to demonstrate that we can detect evolutionary changes within malware families using an automated and quantifiable machine learning based technique. (C) 2019 Elsevier Ltd. All rights reserved.