[223] Giuseppe Primiero, Frida J. Solheim, and Jonathan M. Spring, « On Malfunction, Mechanisms and Malware Classification », in: *Philosophy & Technology* 32.2 (June 2019), 339–362, ISSN: 2210-5441, DOI: 10.1007/s13347-018-0334-2.

[224] GNU Project, *GNU Debugger (GDB)*, 2022, URL: https://www.gnu.org/software/gdb.

[225] Yara Project, *Yara documentation*, Website, Accessed: 2022-02-03, URL: https://yara.readthedocs.io/.

[226] Xueheng Qiu et al., « Ensemble deep learning for regression and time series forecasting », in: *2014 IEEE symposium on computational intelligence in ensemble learning (CIEL)*, IEEE, 2014, pp. 1–6.

[227] NGUYEN Anh Quynh and DANG Hoang Vu, « Unicorn: Next generation cpu emulator framework », in: *BlackHat USA* 476 (2015).

[228] Team Radare, *Radare2 github repository*, 2020, URL: https://github.com/radareorg/radare2.

[229] T Ramraj and R Prabhakar, « Frequent subgraph mining algorithms–a survey », in: *Procedia Computer Science* 47 (2015), pp. 197–204.

[230] Nidhi Rastogi et al., « Malont: An ontology for malware threat intelligence », in: *International Workshop on Deployable Machine Learning for Security Defense*, Springer, 2020, pp. 28–44.

[231] hex rays, *IDA Free*, 2022, URL: https://hex-rays.com/ida-free/.

[232] Saif Ur Rehman, Asmat Ullah Khan, and Simon Fong, « Graph mining: A survey of graph mining techniques », in: *Seventh International Conference on Digital Information Management (ICDIM 2012)*, IEEE, 2012, pp. 88–92.

[233] Radim Rehurrek, Petr Sojka, et al., « Gensim—statistical semantics in python », in: *Retrieved from genism.org* (2011).

[234] Microsoft Research, Z3, URL: https://www.microsoft.com/en-us/research/project/z3-3/.

[235] Konrad Rieck et al., « Automatic analysis of malware behavior using machine learning », in: *Journal of Computer Security* 19.4 (2011), pp. 639–668.
[236] Konrad Rieck et al., «Learning and Classification of Malware Behavior», in: *Detection of Intrusions and Malware, and Vulnerability Assessment*, ed. by Diego Zamboni, Berlin, Heidelberg: Springer Berlin Heidelberg, 2008, pp. 108–125, ISBN: 978-3-540-70542-0.

[237] Lior Rokach and Oded Maimon, «Clustering Methods», in: Jan. 2005, pp. 321–352, DOI: 10.1007/0-387-25465-X_15.

[238] Xin Rong, «word2vec parameter learning explained», in: *arXiv preprint arXiv:1411.2738* (2014).

[239] Andrew Rosenberg and Julia Hirschberg, «V-measure: A conditional entropy-based external cluster evaluation measure», in: *Proceedings of the 2007 joint conference on empirical methods in natural language processing and computational natural language learning (EMNLP-CoNLL)*, 2007, pp. 410–420.

[240] Florian Roth, *How to Write Simple but Sound Yara Rules*, 2015, URL: https://www.nextron-systems.com/2015/02/16/write-simple-sound-yara-rules/.

[241] Florian Roth, *yarGen*, 2013, URL: https://github.com/Neo23x0/yarGen.

[242] Peter J. Rousseeuw, «Silhouettes: A graphical aid to the interpretation and validation of cluster analysis», in: *Journal of Computational and Applied Mathematics* 20 (1987), pp. 53–65, ISSN: 0377-0427, DOI: https://doi.org/10.1016/0377-0427(87)90125-7, URL: https://www.sciencedirect.com/science/article/pii/0377042787901257.

[243] David E Rumelhart, Geoffrey E Hinton, and Ronald J Williams, «Learning representations by back-propagating errors», in: *nature* 323.6088 (1986), pp. 533–536.

[244] Per Runeson and Martin Höst, «Guidelines for conducting and reporting case study research in software engineering», in: *Empirical software engineering* 14.2 (2009), pp. 131–164.

[245] Mark E Russinovich, David A Solomon, and Alex Ionescu, *Windows internals, part 2*, Pearson Education, 2012.

[246] Barbara G. Ryder, «Constructing the Call Graph of a Program», in: *IEEE Trans. Softw. Eng.* 5.3 (May 1979), 216–226, ISSN: 0098-5589, DOI: 10.1109/TSE.1979.234183, URL: https://doi.org/10.1109/TSE.1979.234183.
[247] Imtithal A Saeed, Ali Selamat, and Ali MA Abuagoub, « A survey on malware and malware detection systems », in: *International Journal of Computer Applications* 67.16 (2013).

[248] Aleieldin Salem, Sebastian Banescu, and Alexander Pretschner, « Maat: Automatically Analyzing VirusTotal for Accurate Labeling and Effective Malware Detection », in: *arXiv preprint arXiv:2007.00510* (2020).

[249] David E. Sanger, « Obama Order Sped Up Wave of Cyberattacks Against Iran », in: *The New York Times* (June 1, 2012), URL: https://www.nytimes.com/2012/06/01/world/middleeast/obama-ordered-wave-of-cyberattacks-against-iran.html (visited on 05/24/2022).

[250] Florent Saudel and Jonathan Salwan, « Triton: A dynamic symbolic execution framework », in: *Symposium sur la sécurité des technologies de l'information et des communications, SSTIC, France, Rennes*, 2015, pp. 31–54.

[251] Prateek Saxena et al., « Loop-extended symbolic execution on binary programs », in: *Proceedings of the eighteenth international symposium on Software testing and analysis*, 2009, pp. 225–236.

[252] Hossein Sayadi et al., « Ensemble learning for effective run-time hardware-based malware detection: A comprehensive analysis and classification », in: *2018 55th ACM/ESDA/IEEE Design Automation Conference (DAC)*, IEEE, 2018, pp. 1–6.

[253] Robert Schaefer, « The Epistemology of Computer Security », in: *SIGSOFT Softw. Eng. Notes* 34.6 (Dec. 2009), 8–10, ISSN: 0163-5948, DOI: 10.1145/1640162.1655274, URL: https://doi.org/10.1145/1640162.1655274.

[254] Jonathan Schaffer, « Is There a Fundamental Level? », in: *Noûs* 37.3 (2003), pp. 498–517, DOI: 10.1111/1468-0068.00448.

[255] MANDIANT: Intelligent Information Security, *OpenIOC*, Accessed: 2021-12-01, URL: http://www.mandiant.com.

[256] A. A. Selçuk, F. Orhan, and B. Batur, « Undecidable problems in malware analysis », in: *2017 12th International Conference for Internet Technology and Secured Transactions (ICITST)*, 2017, pp. 494–497, DOI: 10.23919/ICITST.2017.8356458.
[257] Koushik Sen et al., «MultiSE: Multi-Path Symbolic Execution Using Value Summaries», in: *Proceedings of the 2015 10th Joint Meeting on Foundations of Software Engineering*, ESEC/FSE 2015, Bergamo, Italy: Association for Computing Machinery, 2015, 842–853, ISBN: 9781450336758, DOI: 10.1145/2786805.2786830, URL: https://doi.org/10.1145/2786805.2786830.

[258] Shanhu Shang et al., «Detecting malware variants via function-call graph similarity», in: *Nov. 2010, pp. 113–120*, DOI: 10.1109/MALWARE.2010.5665787.

[259] Geoff Shaw, « Spyware & Adware: the risks facing businesses », in: *Network security* 2003.9 (2003), pp. 12–14.

[260] John F Shoch and Jon A Hupp, « The “worm” programs—early experience with a distributed computation », in: *Communications of the ACM* 25.3 (1982), pp. 172–180.

[261] Yan Shoshitaishvili et al., « Sok:(state of) the art of war: Offensive techniques in binary analysis », in: *2016 IEEE Symposium on Security and Privacy (SP)*, IEEE, 2016, pp. 138–157.

[262] Michael Sikorski and Andrew Honig, *Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software*, 1st, San Francisco, CA, USA: No Starch Press, 2012, ISBN: 1593272901, 9781593272906.

[263] Jagsir Singh and Jaswinder Singh, « A survey on machine learning-based malware detection in executable files », in: *Journal of Systems Architecture* 112 (2021), p. 101861, ISSN: 1383-7621, DOI: https://doi.org/10.1016/j.sysarc.2020.101861, URL: https://www.sciencedirect.com/science/article/pii/S1383762120301442.

[264] Steven Skiena, *Implementing discrete mathematics - combinatorics and graph theory with Mathematica*. Addison-Wesley, 1990, pp. I–VIII, ISBN: 978-0-201-50943-4.

[265] Alex J Smola and Bernhard Schölkopf, « A tutorial on support vector regression », in: *Statistics and computing* 14.3 (2004), pp. 199–222.

[266] Fu Song and Tayssir Touili, « Pushdown model checking for malware detection », in: *International Journal on Software Tools for Technology Transfer* 16.2 (2014), pp. 147–173.

[267] Open Source, *Cuckoo Sandbox*, 2010, URL: https://www.cuckoosandbox.org.

[268] Lars St, Svante Wold, et al., « Analysis of variance (ANOVA) », in: *Chemometrics and intelligent laboratory systems* 6.4 (1989), pp. 259–272.
[269] Richard M Stallman, « GNU compiler collection internals », in: *Free Software Foundation* (2002).

[270] Luke Stark and Jevan Hutson, « Physiognomic artificial intelligence », in: *Available at SSRN* 3927300 (2021).

[271] Nick Stephens et al., « Driller: Augmenting fuzzing through selective symbolic execution. », in: *NDSS*, vol. 16, 2016, 2016, pp. 1–16.

[272] Matthias Steup and Ram Neta, « Epistemology », in: *The Stanford Encyclopedia of Philosophy*, ed. by Edward N. Zalta, Fall 2020, Metaphysics Research Lab, Stanford University, 2020.

[273] Alexander Strehl and Joydeep Ghosh, « Cluster ensembles - A Knowledge Reuse Framework for Combining Multiple Partitions », in: *Journal of machine learning research* 3.Dec (2002), pp. 583–617.

[274] Peter Suber, « What is software? », in: *The Journal of Speculative Philosophy* (1988), pp. 89–119.

[275] Bowen Sun et al., « Malware family classification method based on static feature extraction », in: *2017 3rd IEEE International Conference on Computer and Communications (ICCC)*, IEEE, 2017, pp. 507–513.

[276] Morton Swimmer, *Towards An Ontology of Malware Classes*, Accessed: 2021-12-01, 2009, URL: http://www.scribd.com/doc/24058261/Towards-an-Ontology-of-Malware-Classes.

[277] Peter Szor, *The Art of Computer Virus Research and Defense*, Addison-Wesley Professional, 2005, ISBN: 0321304543.

[278] Pang-Ning Tan, Michael Steinbach, and Vipin Kumar, *Introduction to data mining*, Pearson Education India, 2016.

[279] Andrew S. Tanenbaum, *Structured computer organization, 5th Edition*, Pearson Education, 2006, ISBN: 978-0-13-148521-1.

[280] AV TEST, *Malware Statistics*, Website, URL: https://www.av-test.org/en/statistics/malware/ (visited on 05/24/2022).

[281] Ken Thompson, « Reflections on Trusting Trust », in: *Commun. ACM* 27.8 (Aug. 1984), 761–763, ISSN: 0001-0782, DOI: 10.1145/358198.358210, URL: https://doi.org/10.1145/358198.358210.
[282] Ronghua Tian et al., «Differentiating malware from cleanware using behavioural analysis », in: *2010 5th international conference on malicious and unwanted software*, Ieee, 2010, pp. 23–30.

[283] Flavio Toffalini et al., « Detection of Masqueraders Based on Graph Partitioning of File System Access Events », in: *2018 IEEE Security and Privacy Workshops (SPW)*, 2018, pp. 217–227, DOI: 10.1109/SPW.2018.00037.

[284] Philipp Trinius et al., « A malware instruction set for behavior-based analysis », in: (2009).

[285] Raymond Turner, « Specification », in: *Minds and Machines* 21.2 (May 2011), 135–152, ISSN: 1572-8641, DOI: 10.1007/s11023-011-9239-x.

[286] Grigorios Tzortzis and Aristidis Likas, « Convex mixture models for multi-view clustering », in: *International Conference on Artificial Neural Networks*, Springer, 2009, pp. 205–214.

[287] Daniele Ucci, Leonardo Aniello, and Roberto Baldoni, « Survey of machine learning techniques for malware analysis », in: *Computers & Security* 81 (2019), pp. 123–147, ISSN: 0167-4048, DOI: https://doi.org/10.1016/j.cose.2018.11.001, URL: https://www.sciencedirect.com/science/article/pii/S0167404818303808.

[288] Jamal Uddin, Rozaida Ghazali, and Mustafa Mat Deris, « Does number of clusters affect the purity and entropy of clustering? », in: *International Conference on Soft Computing and Data Mining*, Springer, 2016, pp. 355–365.

[289] Xabier Ugarte-Pedrero, Mariano Graziano, and Davide Balzarotti, « A close look at a daily dataset of malware samples », in: *ACM Transactions on Privacy and Security (TOPS)* 22.1 (2019), pp. 1–30.

[290] Xabier Ugarte-Pedrero et al., « SoK: Deep packer inspection: A longitudinal study of the complexity of run-time packers », in: *2015 IEEE Symposium on Security and Privacy*, IEEE, 2015, pp. 659–673.

[291] Sandro Vega-Pons and José Ruiz-Shulcloper, « A survey of clustering ensemble algorithms », in: *International Journal of Pattern Recognition and Artificial Intelligence* 25.03 (2011), pp. 337–372.

[292] Swapna Vemparala et al., « Malware detection using dynamic birthmarks », in: *Proceedings of the 2016 ACM on international workshop on security and privacy analytics*, 2016, pp. 41–46.
[293] Nguyen Xuan Vinh, Julien Epps, and James Bailey, « Information theoretic measures for clusterings comparison: Variants, properties, normalization and correction for chance », in: *The Journal of Machine Learning Research* 11 (2010), pp. 2837–2854.

[294] VirusTotal, *Malware Hunting*, Website, Accessed: 2022-02-03, URL: https://www.virustotal.com/#/hunting-overview.

[295] John Von Neumann, « Theory and organization of complicated automata », in: *Burks* (1966) (1949), pp. 29–87.

[296] Roland Vossen, *Win 95 Source code in c!! (Archive)*, URL: https://groups.google.com/g/rec games programmer/c/hqQmsBR0ltg (visited on 05/30/2022).

[297] Jane Wakefield, « Tax software blamed for cyber-attack spread », in: *BBC News* (June 28, 2017), URL: https://www.bbc.com/news/technology-40428967 (visited on 05/24/2022).

[298] Xinran Wang et al., « Behavior Based Software Theft Detection », in: *Proceedings of the 16th ACM Conference on Computer and Communications Security*, CCS '09, Chicago, Illinois, USA: Association for Computing Machinery, 2009, 280–290, ISBN: 9781605588940, DOI: 10.1145/1653662.1653696, URL: https://doi.org/10.1145/1653662.1653696.

[299] World Economic Forum (WEF), *The Global Risks Report 2010*, Accessed: 2022-05-24, 2010, URL: https://www3.weforum.org/docs/WEF الأم Global Risks Report 2010.pdf.

[300] World Economic Forum (WEF), *The Global Risks Report 2010*, Accessed: 2022-05-24, 2017, URL: https://www3.weforum.org/docs/GRR17_Report_web.pdf.

[301] World Economic Forum (WEF), *The Global Risks Report 2012*, Accessed: 2022-05-24, 2012, URL: https://www3.weforum.org/docs/WEF الأم GlobalRisks Report 2012.pdf.

[302] World Economic Forum (WEF), *The Global Risks Report 2014*, Accessed: 2022-05-24, 2014, URL: https://www3.weforum.org/docs/WEF الأم GlobalRisks Report 2014.pdf.

[303] World Economic Forum (WEF), *The Global Risks Report 2018*, Accessed: 2022-05-24, 2018, URL: https://www3.weforum.org/docs/WEF_GRR18_Report.pdf.
[304] World Economic Forum (WEF), *The Global Risks Report 2019*, Accessed: 2022-05-24, 2019, URL: https://www3.weforum.org/docs/WEF_Global_Risks_Report_2019.pdf.

[305] World Economic Forum (WEF), *The Global Risks Report 2020*, Accessed: 2022-05-24, 2020, URL: https://www3.weforum.org/docs/WEF_Global_Risk_Report_2020.pdf.

[306] World Economic Forum (WEF), *The Global Risks Report 2021*, Accessed: 2022-05-24, 2021, URL: https://www3.weforum.org/docs/WEF_The_Global_Risks_Report_2021.pdf.

[307] World Economic Forum (WEF), *The Global Risks Report 2022*, Accessed: 2022-05-24, 2022, URL: https://www3.weforum.org/docs/WEF_The_Global_Risks_Report_2022.pdf.

[308] Kilian Weinberger et al., « Feature hashing for large scale multitask learning », in: *Proceedings of the 26th annual international conference on machine learning*, 2009, pp. 1113–1120.

[309] Carl J. Wenning, « Scientific epistemology: How scientists know what they know », in: *2009*.

[310] Christoph M. Wintersteiger, Youssef Hamadi, and Leonardo de Moura, « Efficiently solving quantified bit-vector formulas », in: *Formal Methods in System Design 42.1* (Feb. 1, 2013), pp. 3–23, DOI: 10.1007/s10703-012-0156-2, URL: https://doi.org/10.1007/s10703-012-0156-2.

[311] WithSecure, *Brain: Searching for the first PC virus in Pakistan*, YouTube, URL: https://www.youtube.com/watch?v=lnedOWfPKTO (visited on 05/30/2022).

[312] Lingfei Wu et al., « A novel malware variants detection method based On function-call graph », in: *Jan. 2013*, pp. 1–5, ISBN: 978-1-4799-1660-3, DOI: 10.1109/ANTHOLOGY.2013.6784887.

[313] Xiao-Ling Xia et al., « Malware detection based on ontology », in: *2017 International Conference on Machine Learning and Cybernetics (ICMLC)*, vol. 1, IEEE, 2017, pp. 21–26.

[314] Dongpeng Xu, Jiang Ming, and Dinghao Wu, « Cryptographic function detection in obfuscated binaries via bit-precise symbolic loop mapping », in: *2017 IEEE Symposium on Security and Privacy (SP)*, IEEE, 2017, pp. 921–937.
[315] Lifan Xu et al., « Dynamic Android Malware Classification Using Graph-Based Representations », in: *2016 IEEE 3rd International Conference on Cyber Security and Cloud Computing (CSCloud)*, 2016, pp. 220–231, DOI: 10.1109/CSCloud.2016.27.

[316] Babak Yadegari and Saumya Debray, « Symbolic execution of obfuscated code », in: *Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security*, ACM, 2015, pp. 732–744.

[317] Jinpei Yan, Yong Qi, and Qifan Rao, « Detecting malware with an ensemble method based on deep neural network », in: *Security and Communication Networks* 2018 (2018).

[318] Xifeng Yan and Jiawei Han, « gSpan: Graph-Based Substructure Pattern Mining. », in: *Proceedings of the 2002 IEEE International Conference on Data Mining (ICDM 2002)*, Maebashi City, Japan: IEEE Computer Society, Dec. 2002, pp. 721–724, ISBN: 0-7695-1754-4, URL: http://dblp.uni-trier.de/db/conf/icdm/icdm2002.html#YanH02.

[319] Yara - VirusTotal, website, URL: https://virustotal.github.io/yara/.

[320] Yanfang Ye et al., « Automatic malware categorization using cluster ensemble », in: *Proceedings of the 16th ACM SIGKDD international conference on Knowledge discovery and data mining*, 2010, pp. 95–104.

[321] Adam Young and Moti Yung, « Cryptovirology: Extortion-based security threats and countermeasures », in: *Proceedings 1996 IEEE Symposium on Security and Privacy*, IEEE, 1996, pp. 129–140.

[322] Mikhail Zaslavskiy, Francis Bach, and Jean-Philippe Vert, « A Path Following Algorithm for the Graph Matching Problem », in: *IEEE Transactions on Pattern Analysis and Machine Intelligence* 31.12 (2009), pp. 2227–2242, DOI: 10.1109/TPAMI.2008.245.

[323] Kim Zetter, « A Mysterious Hacker Group Is On a Supply Chain Hijacking Spree », in: *WIRED* (May 3, 2019), URL: https://www.wired.com/story/barium-supply-chain-hackers/ (visited on 05/30/2022).

[324] Kim Zetter, « That Insane, $81M Bangladesh Bank Heist? Here's What We Know », in: *WIRED* (May 17, 2016), URL: https://www.wired.com/2016/05/insane-81m-bangladesh-bank-heist-heres-know/ (visited on 05/24/2022).
[325] Jie Zhang et al., «Malware Detection using CNN via Word Embedding», in: *2021 8th International Conference on Dependable Systems and Their Applications (DSA)*, IEEE, 2021, pp. 600–607.

[326] Y. Zhang et al., «Based on Multi-features and Clustering Ensemble Method for Automatic Malware Categorization», in: *2017 IEEE Trustcom/BigDataSE/ICESS*, 2017, pp. 73–82, DOI: 10.1109/Trustcom/BigDataSE/ICESS.2017.222.

[327] Ying Zhao and George Karypis, «Criterion functions for document clustering: Experiments and analysis», in: (2001).

[328] Qinghai Zheng et al., «Feature concatenation multi-view subspace clustering», in: *Neurocomputing* 379 (2020), pp. 89–102.

[329] Hao Zhou et al., «Analysis of Android Malware Family Characteristic Based on Isomorphism of Sensitive API Call Graph», in: *2017 IEEE Second International Conference on Data Science in Cyberspace (DSC)*, 2017, pp. 319–327, DOI: 10.1109/DSC.2017.77.

[330] zynamics, *BinDiff*, https://www.zynamics.com/bindiff.html.
<figure><img src="image_113.png" /></figure>
**6.1 Basic Formal Ontology (BFO)**

This section intends to provide a short background on some of the main concepts defined in BFO, depicted in figure 6.1. For greater details on BFO, refer to the official specification and user guide [5].

<figure><img src="image_114.png" /><figcaption>Figure 6.1 – Synoptic outline of BFO hierarchy.</figcaption></figure>

In BFO, *Entity* is the most basic concept representing anything that exists. These entities are divided into *Instances* and *Universals*, where the former refers to a particular case of the latter. Entities are also divided into *Continuant* and *Occurrent*, where the former “exists in full at any time in which it exists at all, persists through time while maintaining its identity and has no temporal parts” (e.g. a thesis) and the latter “has temporal parts and that happens, unfolds or develops through time” (e.g. the process of writing a thesis).

An *Independent Continuant* is “a bearer of *quality* and *realizable entities*, in which other
*entities* inhere and which itself cannot inhere in anything" (e.g. a thesis), whereas a *Dependent Continuant* is "dependent on one or other *independent continuant* bearers or inheres in or is borne by other entities" (e.g. the number of pages of this thesis). In other words, *Dependent Continuants* are *qualities, functions, roles, and dispositions*—generically, *Dependent Continuants* are "attributes" —that can exist only insofar as they are borne or carried by *Independent Continuants*.

A *Generically Dependent Continuant* is “dependent on one or other *independent contin-
uant* bearers” (e.g. the content of this thesis), whereas a *specifically dependent continuant*
“inheres in or is borne by other entities” (e.g. a printed version of this thesis).

BFO defines two types of *specifically dependent continuant: quality* and *realizable. Quality* is a *specifically dependent continuant* that “is exhibited if it inheres in an *entity* or *entities* at all (a categorical property)” (e.g. the number of words in this thesis). In contrast, a *Realizable Entity* is a *specifically dependent continuant* that “inhabits in *continuant entities* and is exhibited in full at every time in which it inheres in an *entity* or group of *entities*. The exhibition or actualization of a *realizable entity* is a particular manifestation, functioning or process that occurs under certain circumstances” (e.g. the use of this thesis as reference by another work).

BFO defines two types of *Realizable Entity: role* and *disposition*. *Role* is a "manifestation of which brings about some result or end that is not essential to a *continuant* in virtue of the kind of thing that it is but that can be served or participated in by that kind of *continuant* in some kinds of natural, social or institutional contexts" (e.g. the use of this thesis as reference by another work). *Disposition* is a "*realizable entity* that essentially causes a specific process or transformation in the *continuant* in which it inheres, under specific circumstances and in conjunction with the laws of nature." (e.g. the number of pages of this thesis, given the font size and policy). Essentially, *role* is an *extrinsic* (or *externally-grounded*) *realizable entity*, whereas *disposition* is an *intrinsic* (or *internally-grounded*) *realizable entity*.

BFO also defines *Function* as a special kind of *realizable entity*, which consists in “the manifestation of which is an **essentially end-directed activity** of a *continuant* entity in virtue of that *continuant* entity being a specific kind of *entity* in the kind or kinds of contexts that it is made for” (e.g. the function of a thesis to present the research about some topic). To further clarify the BFO notion of *function*, we can think about the following example: “the function of a hammer is to drive in nails”; although it is possible to play drums with a hammer, its **essential end-directed activity** is driving nails.
## 6.2 Logistic Equation and the Sigmoid Function

The logistic function was introduced by Pierre François Verhulst as a model of population growth. It is modeled as a first-order non-linear ordinary differential equation, known as the logistic equation:

$$ \frac{d}{dt} f(t) = f(t)(a - bf(t)) \qquad (6.1) $$

The term *a* represents the positive growth rate that takes place when the birth rate is higher than the death rate, whereas the term *b* represents the slow down in the growth rate due to competition which increases as the population grows. Implicitly, both *a* and *b* are assumed to be positive values.

Defining *z(t)* as *z(t) = 1/f(t)*, we have:

$$ \frac{d}{dt} z(t) = -\frac{1}{f(t)^2} \frac{d}{dt} f(t) = -\frac{1}{f(t)^2} f(t)(a - bf(t)) = -az(t) + b \qquad (6.2) $$

The solution to equation 6.2 is $z(t) = \frac{b}{a} + c_0 e^{-at}$, therefore the solution to equation 6.1 is:

$$ f(t) = \frac{a}{c_0 e^{-at} + b} \qquad (6.3) $$

For $c_0 > 0$, $f(t)$ is strictly increasing monotonic because $f'(t) = \frac{a^2 e^{-at}}{c_0 e^{-at} + b} > 0$. We notice that $f(t \to -\infty) = 0$, whereas $f(t \to \infty) = a/b$.

Furthermore, $f'(t) = f(t)(a - bf(t))$ is zero for $f(t) = 0$ or $f(t) = a/b$, which happens for $t \to -\infty$ and $t \to \infty$. Those points where the derivative are zero are the steady states of the logistic equation.

By computing a second derivative of $f(t)$ we obtain:

$$ \begin{aligned} f''(t) &= \frac{d}{dt}(af(t) - bf(t)) = af'(t) - 2bf(t)f'(t) \\ &= f(t)(a - bf(t))(a - 2bf(t)) \end{aligned} $$

The values of *t* for which $f''(t) = 0$ are those for which $f(t) = 0$, $f(t) = a/b$ or $f(t) = a/2b$. As seen before, the first two cases correspond to $t \to -\infty$ and $t \to \infty$. For the third case, we refer to this point as $t = \tau$:
$$ 
\begin{aligned}
f(\tau) &= \frac{a}{2b} \Rightarrow \frac{a}{c_0 e^{-a\tau} + b} = \frac{a}{2b} \\
&\Rightarrow c_0 e^{-a\tau} + b = 2b \\
&\Rightarrow \tau = \frac{\ln(c_0) - \ln(b)}{a}
\end{aligned}
$$

We now show that $f(t)$ is rotationally symmetrical about $(\tau, f(\tau))$, i.e. $f(\tau + \alpha) - f(\tau) = f(\tau) - f(t - \alpha)$.

For this we first expand $f(t + \alpha)$:

$$ 
\begin{aligned}
f(\tau + \alpha) &= \frac{a}{c_0 e^{-a(\tau+\alpha)} + b} \\
&= \frac{a}{c_0 e^{-a\tau - a\alpha} + b} \\
&= \frac{a}{c_0 e^{-a\tau} + b} = \frac{ae^{a\alpha}}{c_0 e^{-a\tau} + be^{a\alpha}} \\
&= \frac{ae^{a\alpha}}{c_0 e^{-a\tau} + b} = \frac{ae^{a\alpha}}{c_0 \frac{e^{\ln(b)}}{e^{\ln(c_0)}} + be^{a\alpha}} \\
&= \frac{ae^{a\alpha}}{b + be^{a\alpha}} = \frac{a/b}{1 + e^{-a\alpha}}
\end{aligned}
$$

Now we expand $f(t - \alpha)$:

$$ 
\begin{aligned}
f(\tau - \alpha) &= \frac{a}{c_0 e^{-a(\tau-\alpha)} + b} \\
&= \frac{a}{c_0 e^{-a\tau + a\alpha} + b} \\
&= \frac{a}{e^{a\alpha} c_0 e^{-a\tau} + b} = \frac{ae^{-a\alpha}}{c_0 e^{-a\tau} + be^{-a\alpha}} \\
&= \frac{ae^{-a\alpha}}{c_0 e^{-a\tau} + b} = \frac{ae^{-a\alpha}}{c_0 \frac{e^{\ln(b)}}{e^{\ln(c_0)}} + be^{-a\alpha}} \\
&= \frac{ae^{-a\alpha}}{b + be^{-a\alpha}} = \frac{a/b}{1 + e^{-a\alpha}}
\end{aligned}
$$
And we compute $f(\tau + \alpha) - f(\tau)$ and $f(\tau) - f(t - \alpha)$ as follows:

$$ 
\begin{aligned}
f(\tau + \alpha) - f(\tau) &= \frac{a/b}{1 + e^{-a\alpha}} - \frac{a}{2b} = \frac{a}{b} \left[ \frac{1}{1 + e^{-a\alpha}} - \frac{1}{2} \right] = \frac{a(1 - e^{-a\alpha})}{2b(1 + e^{-a\alpha})} = \frac{a(e^{a\alpha} - 1)}{2b(e^{a\alpha} + 1)} \\
f(\tau) - f(\tau - \alpha) &= \frac{a}{2b} - \frac{a/b}{1 + e^{a\alpha}} = \frac{a}{b} \left[ \frac{1}{2} - \frac{1}{1 + e^{a\alpha}} \right] = \frac{a(e^{a\alpha} - 1)}{2b(e^{a\alpha} + 1)} \\
\Rightarrow f(\tau + \alpha) - f(\tau) &= f(\tau) - f(\tau - \alpha) \quad \square
\end{aligned}
$$

The value of $f'(t) = f(t)(a - b f(t))$ at $\tau$ is $f'(\tau) = (a/2b)(a - b(a/2b)) = a^2/2b$, which is always positive. As $f'(t)$ and $f''(t)$ are two continuous functions, $f''(t) = 0$ for $t \to -\infty$, $t \to \infty$ and $t = \tau$, and $f'(t) = 0$ for $t \to -\infty$, $t \to \infty$, it means that the peak of $f'(t)$ occurs for $t = \tau$.

It means that the logistic function (1) is rotationally symmetrical about $(\tau, f(\tau))$, (2) increases slowly for large absolute values of $t$, (3) increases faster for values $t$ near to $\tau$. All these factors combined give a “S-shape” form to the curve—reason why the logistic curve is also referred as the “S-curve”.

We note that if $c_0 = b$ it implies that $\tau = 0$, which results in:

$$ f(t) = \frac{a}{b(1 + e^{-at})} $$

For $a = b$ we have $f(t) \in [0, 1]$, which can be used to represent a likelihood function. The special case in which $a = b = c_0 = 1$ is known as the sigmoid function ($\sigma(x)$), i.e.:

$$ \sigma(x) = \frac{1}{1 + e^{-x}} $$

The plot of the sigmoid function is displayed below:
sigmoid function

<figure><img src="image_115.png" /></figure>
6.3 Density-Based Clustering Methods

<caption>**Algorithm 1:** Pseudocode of DBSCAN algorithm</caption>

1 **DBSCAN** ({pᵢ}, ε, MinPts);
2   **Input** : {pᵢ}, ε and MinPts
3   **Output**: C
4   C ← {};
5   cnt ← 0;
6   /* Cluster counter */
7   L(pᵢ) ← ∅, ∀{pᵢ};
8   **foreach** p in {pᵢ} **do**
9     if L(p) ≠ ∅ **then** continue;;
10     /* Already visited */
11     N ← FindNeighbors(p, {pᵢ}, ε);
12     **if** |N| < MinPts − 1 **then**
13       L(p) ← η;
14       /* η: noise */
15       continue
16     **end**
17     cnt ← cnt +1;
18     C cnt ← {pᵢ};
19     L(p) ← cnt;
20     /* Cluster label */
21     **foreach** pᵣ in N **do**
22       if L(pᵣ) = η **then** L(pᵣ) ← cnt;
23       if L(pᵣ) ≠ ∅ **then** continue;;
24       /* Already clustered */
25       C cnt ← C cnt ∪ {pᵣ};
26       L(pᵣ) ← cnt;
27       N n ← FindNeighbors(pᵣ, {pᵢ}, ε);
28       **if** |N| ≥ MinPts − 1 **then**
29         N ← N ∪ N n;
30         /* Add reachable points */
31       **end**
32     **end**
33   end
34   end
27 **end**
## 6.4 Mutual Information

Here we demonstrate that the mutual information of two random variables X and Y is indeed:

$$I(X, Y) = \sum_{x \in X, y \in Y} p(x, y) \log_2 \left( \frac{p(x, y)}{p(x)p(y)} \right)$$

Starting from the definition of entropy:

$$H(X) = \sum_{x \in X} p(x) \log_2 \left( \frac{1}{p(x)} \right)$$

Since $\sum_{y \in Y} p(x, y) = p(x)$, we have:

$$H(X) = \sum_{x \in X} \left( \sum_{y \in Y} p(x, y) \right) \log_2 \left( \frac{1}{p(x)} \right) = \sum_{x \in X, y \in Y} p(x, y) \log_2 \left( \frac{1}{p(x)} \right)$$

The same goes for $H(Y)$, i.e.:

$$H(Y) = \sum_{y \in Y} \left( \sum_{x \in X} p(x, y) \right) \log_2 \left( \frac{1}{p(y)} \right) = \sum_{x \in X, y \in Y} p(x, y) \log_2 \left( \frac{1}{p(y)} \right)$$

Since the definition of the mutual information $I(X, Y)$ is:

$$I(X, Y) = H(X) + H(Y) - H(X, Y)$$

we can replace $H(X)$ and $H(Y)$ by the previous equations, i.e.:

$$\begin{align*}
I(X, Y) &= \sum_{x \in X, y \in Y} p(x, y) \log_2 \left( \frac{1}{p(x)} \right) + \sum_{x \in X, y \in Y} p(x, y) \log_2 \left( \frac{1}{p(y)} \right) - \sum_{x \in X, y \in Y} p(x, y) \log_2 \left( \frac{1}{p(x, y)} \right) \\
&= \sum_{x \in X, y \in Y} p(x, y) \left( \log_2 \left( \frac{1}{p(x)} \right) + \log_2 \left( \frac{1}{p(y)} \right) - \log_2 \left( \frac{1}{p(x)p(y)} \right) \right) \\
&= \sum_{x \in X, y \in Y} p(x, y) \log_2 \left( \frac{p(x, y)}{p(x)p(y)} \right) \quad \square
\end{align*}$$
## 6.5 PE Headers

<figure><img src="image_116.png" /><figcaption>Figure 6.2 – Layout of headers in a PE file¹.</figcaption></figure>
## 6.6 Call Tracing with Symbolic Execution

### 6.6.1 Supplementary analysis

#### Main effect of graph and execution heuristics on the F-score

Figure 6.3 shows the impact on the F-score of the seven studied factors (i.e. the graph building and execution heuristics). The plots aim to represent how classifier and the levels to which a given factor are related.

In each plot, points on a column represent the micro average F-score achieved by all the configurations having a specific setting (on the x-axis) for the heuristic reported in the caption. Each plot represents the levels for a given factor on the x-axis. On the y-axis the quality of the classifier, $F_1$-score by family in our case.

#### Interactions between factors

The interactions between each possible combination of factors are represented by means of the Pareto plot in figure 6.4. Basically, such a plot allows to observe factors and interaction effects having the highest impact on the performance (the F-score in our case). The impact, positive or negative (respectively in black and gray in figure 6.4), of each combination of factors on the F-score is on the x-axis.

Interaction plots in figures 6.5, 6.6 and 6.7 provide a more detailed view by showing the relations between each pair of factors (by means of a linear model).

#### Relationship between connected components and F-score

During our analysis we pointed out that the litmus test for the quality of an ECDG-based classifier is the presence and the size of connected components (c.f. section 3.5.3). Here we report, by means of box plots the relationship between the classifier performance (with respect to the binary and multi-class classifiers) and number (c.f. figures 6.8, 6.9, and 6.10) and size (c.f. figures 6.11, 6.12 and 6.13) of the largest connected components in the set of ECDG-based signatures used by the classifier, for all the 128 experimental units analyzed in this work.

In the plots, on the secondary y-axis the red stars refer to the F-score of the multi-class classification (malware classifier), whereas the triangles represent the F-score of the binary

<footnote n="1">1. Image published at https://fi.wikipedia.org/wiki/Portable_Executable#/media/Tiedosto:Portable_Executable_32_bit_Structure_in_SVG fixed.svg (accessed October 2022)</footnote>
<figure><img src="image_117.png" /><figcaption>(a) Trace combination</figcaption></figure>

<figure><img src="image_118.png" /><figcaption>(b) Merge calls</figcaption></figure>

<figure><img src="image_119.png" /><figcaption>(c) Min trace size</figcaption></figure>

<figure><img src="image_120.png" /><figcaption>(d) z3 config</figcaption></figure>

<figure><img src="image_121.png" /><figcaption>(e) branching loop threshold</figcaption></figure>

<figure><img src="image_122.png" /><figcaption>(f) step timeout</figcaption></figure>

<figure><img src="image_123.png" /><figcaption>(g) max active path</figcaption></figure>

<caption>Figure 6.3 – Main effect of the factors.</caption>
<figure><img src="image_124.png" /><figcaption>Figure 6.4 – Pareto plot for the factorial experiments. In black positive coefficients, in gray the negative ones.</figcaption></figure>
<figure><img src="image_125.png" /><figcaption>(a) Trace combination and merge calls</figcaption></figure>

<figure><img src="image_126.png" /><figcaption>(b) Trace combination and min-trace-size</figcaption></figure>

<figure><img src="image_127.png" /><figcaption>(c) Trace combination and z3 configuration</figcaption></figure>

<figure><img src="image_128.png" /><figcaption>(d) Trace combination and branching loop</figcaption></figure>

<figure><img src="image_129.png" /><figcaption>(e) Trace combination and step timeout</figcaption></figure>

<figure><img src="image_130.png" /><figcaption>(f) Trace combination and max active paths</figcaption></figure>

<figure><img src="image_131.png" /><figcaption>(g) Branching loop and max active paths</figcaption></figure>

<figure><img src="image_132.png" /><figcaption>(h) Branching loop and step timeout</figcaption></figure>

<figure><img src="image_133.png" /><figcaption>(i) Step timeout and max active path</figcaption></figure>

Figure 6.5 – Interaction plots for the ANOVA analysis (1/3): interaction effects on the mean $F_1$-score by malware family for each possible pair of factors.
<figure><img src="image_134.png" /><figcaption>(a) Merge calls and min trace size</figcaption></figure>

<figure><img src="image_135.png" /><figcaption>(b) Merge calls and z3 configuration</figcaption></figure>

<figure><img src="image_136.png" /><figcaption>(c) Merge calls and branching loop</figcaption></figure>

<figure><img src="image_137.png" /><figcaption>(d) Merge calls and step timeout</figcaption></figure>

<figure><img src="image_138.png" /><figcaption>(e) Merge calls and max active paths</figcaption></figure>

<figure><img src="image_139.png" /><figcaption>(f) Min trace size and z3 configuration</figcaption></figure>

<figure><img src="image_140.png" /><figcaption>(g) Min trace size and branching loop</figcaption></figure>

<figure><img src="image_141.png" /><figcaption>(h) Min trace size and step timeout</figcaption></figure>

<figure><img src="image_142.png" /><figcaption>(i) Min trace size and max active path</figcaption></figure>

Figure 6.6 – Interaction plots for the ANOVA analysis (2/3): interaction effects on the mean $F_1$-score by malware family for each possible pair of factors.
<figure><img src="image_143.png" /><figcaption>(a) z3 configuration and
branching loop</figcaption></figure>

<figure><img src="image_144.png" /><figcaption>(b) z3 configuration and step
timeout</figcaption></figure>

<figure><img src="image_145.png" /><figcaption>(c) z3 configuration and max
active paths</figcaption></figure>

Figure 6.7 – Interaction plots for the ANOVA analysis (3/3): interaction effects on the mean F₁-score by malware family for each possible pair of factors.

classification (malware detection). For the sake of readability, the 128 configurations have
been grouped in sets of 32 for each plot.

Impact of the graph similarity threshold on the F-score

In this work, according to our previous experience and after the preliminary analysis, we
have chosen to set the similarity threshold for the graph matching algorithm gSpan to 0.7.
In the following (c.f. figures 6.14, 6.15, 6.16, 6.17, 6.18, 6.19, 6.20, and 6.21), we report the F-
score for the binary (malware detection) and multi-class (malware classification) classifiers,
for all the 128 studied configurations, by varying the similarity threshold with steps of 0.1 in
the range from 0 to 1. Here the blue circles indicate binary classification, and the red stars
multi-class classification.

Dataset

Due to a NDA (Non-Disclosure Agreement) and security concerns we are not allowed to share our dataset. Notwithstanding, for the sake of reproducibility, we provide below the SHA1 and the corresponding family for each binary analyzed in our work (c.f. tables 6.1, 6.2, 6.3, 6.4 and 6.5). As files are (overwhelmingly likely to be) mapped to a single SHA1 value, interested researchers can lookup for the samples in other available databases (e.g. VirusTotal).
<figure><img src="image_146.png" /><figcaption>Figure 6.8 – Number of connected components for the ECDGs in each configuration and F-scores (triangles represent the binary classifier, stars the multi-class classifier) - (1/3).</figcaption></figure>
<figure><img src="image_147.png" /><figcaption>Figure 6.9 – Number of connected components for the ECDGs in each configuration and F-scores (triangles represent the binary classifier, stars the multi-class classifier) - (2/3).</figcaption></figure>
<figure><img src="image_148.png" /><figcaption>Figure 6.10 – Number of connected components for the ECDGs in each configuration and F-scores (triangles represent the binary classifier, stars the multi-class classifier) - (3/3).</figcaption></figure>
<figure><img src="image_149.png" /><figcaption>Figure 6.11 – Size of the largest connected component for the ECDGs in each configuration and F-scores (triangles represent the binary classifier, stars the multi-class classifier) - (1/3).</figcaption></figure>
<figure><img src="image_150.png" /><figcaption>Figure 6.12 – Size of the largest connected component for the ECDGs in each configuration and F-scores (triangles represent the binary classifier, stars the multi-class classifier) - (2/3).</figcaption></figure>
<figure><img src="image_151.png" /><figcaption>Figure 6.13 – Size of the largest connected component for the ECDGs in each configuration and F-scores (triangles represent the binary classifier, stars the multi-class classifier) - (3/3).</figcaption></figure>
<figure><img src="image_152.png" /><figcaption>Figure 6.14 – Graph similarity vs. F-scores (1/8)</figcaption></figure>
<figure><img src="image_153.png" /><figcaption>Figure 6.15 – Graph similarity vs. F-scores (2/8)</figcaption></figure>
<figure><img src="image_154.png" /><figcaption>Figure 6.16 – Graph similarity vs. F-scores (3/8)</figcaption></figure>
<figure><img src="image_155.png" /><figcaption>Figure 6.17 – Graph similarity vs. F-scores (4/8)</figcaption></figure>
<figure><img src="image_156.png" /><figcaption>Figure 6.18 – Graph similarity vs. F-scores (5/8)</figcaption></figure>
<figure><img src="image_157.png" /><figcaption>Figure 6.19 – Graph similarity vs. F-scores (6/8)</figcaption></figure>
<figure><img src="image_158.png" /><figcaption>Figure 6.20 – Graph similarity vs. F-scores (7/8)</figcaption></figure>
<figure><img src="image_159.png" /><figcaption>Figure 6.21 – Graph similarity vs. F-scores (8/8)</figcaption></figure>
## 6.6.2 Evaluation Dataset

<table><caption>Table 6.1 – Evaluation dataset (1/5)</caption><thead><tr><th>Family</th><th>SHA1</th></tr></thead><tbody><tr><td>jeefo</td><td>f1f06713bfce019a1d33185bf65dbd3ff4854b34<br>12c35183ab2c960234e8b3224feaa8653d14d882e<br>f59b3f97f596daba094e974b90c37fd111add32a<br>7324e63211332c945c0db095317409dba5b8aa89<br>4971eae31449da08f120d6d4cab2ddf57c1a5115<br>8eb11682498a8291aba5c0836c7992a6dcbe54ed<br>667194c6c6f672a0a77d89937073072d3b707862<br>31448f16a4845ebfa4864dabc000b54871e03acf<br>41e97ad145fb417cd9a214b8e169ea1bb43d5850<br>8c5903f36018d0613f70704d0b12adeb9daa4ce2<br>6b998c847c35691fdf71adcfed5cc759ecfd11b<br>02c0362de786d276eb5dd67065ee7f49ad6d4cc<br>f5b4782760fe2c064ca9d97f0f39b7fcb03957a5<br>ae51bc9ed3f9d90ef2bda01fd76d22c97e46cdb6<br>bf2d30db511ee0d469de55386bf6e7849439a45c<br>ef827d0aefff1572e1816c907cea4b4612142375<br>9a04faa46701d9ef53852dd896ec9312b580d9d6<br>dce188f3809291ac046a72bb78265b182b2e7c75<br>fb030359343a43d4d6ff142589dd58b1db9a8fc2<br>1a60a66557f0c4e82629b88ddb18886f6bbeccka<br>150b079cdefa6d664a63fe64107b31af1a258350<br>c1af341a10eac11cafa0c51a3c7165fb6020eacd<br>37f0a68ebfad0a8f590345372c0bc95ec63de5<br>0fb629bdfdcfaa12405e141a418edc2f13c771ac<br>17b547234616c69682cc7c11fa6f8b75626ebdf<br>g Gamemodding</td></tr></tbody></table>

<table><caption>Table 6.2 – Evaluation dataset (2/5)</caption><thead><tr><th>Family</th><th>SHA1</th></tr></thead><tbody><tr><td>mira</td><td>09cebe61bd8a85fd1b8e15a87bc528e50e9146d1<br>8b171470662a7f77c711d1f8219f742b67b6636<br>8be30a111087292144c4a105b1e59336c646c7b2<br>9f93c3603f91455ffa10611ed505682ad3750222<br>f2678a18b5760e50e1496cc10793b8dd0d43babb<br>8735fb97613720390ff44ec4088e19a6bf20fc82<br>7301f70dab808be9cb9d61eb829c0ac84e822fed6<br>22531cac47269c6b5424700e11686ba310b474425<br>4c2716baa548f10a97cb581ac3b3ff22970dbad3<br>d1dac653c287606c58c13442a1bc98ff1cab33ae<br>dbb489de8a845ce8cec003f9a73c7b848dc4c0d<br>69dff1bdad1773ec9aa187b33cd0b1c19e8e3cc9<br>cab35a276d1631ef5b62a91c0b1fe51e59dd4e7b<br>b74cf183df124ef29954d855eb0d4493a603<br>8777e4a3528e399e94223c4f8b0e9d0c29fe6c0a<br>ec3fa64c6a0778e610b59c9639abed71e408984c<br>59ac1c3502cce4128fe56e953aa59614275eaf1d<br>03c60cb6df950a8ab8fc79db6a4485304ed4b4<br>f19390b920a515b752f5c5827d7e909e32912caf<br>4c68e704f180f51f60c5864760837802ae42ed4b<br>7fb49935dc90a6ca38f3e287f6862f335df1e ca3<br>a69aa13f110a258e6be1edfa14c9c6453440cd7<br>5e1fd37d3ac6e376719af055956a3f7cc8b961b05<br>b993fca2a7e5475de0503ac6fe53ec502ffdda71<br>042e5606a5469abecff6f63f76933459baa3ccf5<br>42314c2e1ddc0366a7e6227f23e170fd34e517<br>312596700c2326168e08d2c339400e8b740317f1<br>d5e9fc66f70d40bff172470f3e8c76affaeabba8<br>2ae5536f48452423d7f32db71460cabd16107df6<br>a082516a4389503d15f4069922e1b18e2537f750<br>87a116c78c4cca00024cbc672ab3a2bb3dec27c<br>2ce3f5baa7d7f4b2e3a64e8b9e8549c3dcf945a6<br>dfdb89211d2f15e92cab0bf042da063e1d3b840<br>00364b2f2ad09a975efacdd420876d29199a1e388<br>1e2aean7e811fdb550302a0603b0b30fb370f503<br>5f3272cd501f346e6075a58ba94ff977e241b225<br>2839fda2772f066150dca6b7d95efa33e85bfc79<br>667e6f22bf45c38fc33059e9f7399295b2d897f8<br>8d8e373ed0845ed4ed2d983ee2b1c5b00cad9076<br>ead0d438833687ba989318c9e27290da5581191b<br>e7be4cb61f06a72cc1b300508608d6689edd68d2<br>03c437977840383bb01b9581cb3eb343cfa852a4<br>21029fa0e28350101d038ad6d27ca251666d6b2e<br>c443922da881d8ad5fd3e3a0e40ae5ffd4938df6c<br>9cb055b6f6df6e3e42372b2dc60771f33cf80fb4<br>26a55c1e24e34292bae6de47e50d7c46cdc4115ce<br>78339b24d2d0e8801b889aa00b8d9255830772<br>8bf70b22639c9bd822f0778327a521d19e37ca2<br>7ca87cd015492dea5e9ff97d023add97efe277ba<br>fc9d8bd601f53343bf0f5c4116d2f840423ee70</td></tr></tbody></table>
<table><caption>Table 6.3 – Evaluation dataset (3/5)</caption><thead><tr><th>Family</th><th>SHA1</th></tr></thead><tbody><tr><td>addrop</td><td>ed268e89978f59dbd6a34613a251322b1f7e7f70<br>9ee17a6fe4da450ab751712264af58bdfe8cdab8<br>a5216221219a3fa2f0e03f742f62f3c670a68b34<br>f058a34fa7a0ad2dfcaeledcad9b42bae31e15dd<br>13dce4594d01c430e3098d5da26bf7f7ec629ad0c<br>5c632ad6f5029e05becd4b47924a29c2ba6033af<br>2ae7f1ef08b8657de3060068bbdcf375e2f20cd3<br>f8a5215a4bffc2fc90f115e914fb26b5817d50e3<br>adeda6a02c5312bb12fceaf71a055627f50ba180<br>9c240d316d0b8766a5cf6ec07e5aa4fac6c819cc<br>d97825ab75f08a1efbc924e2969487a0a6408e7f<br>65f46c8a82782640e502396a107f4403fbbacc72<br>8fcd4ffcd87c1283a470aeb5184ae5dafa42fd54<br>37c443875ebbf6056ccaf22ed6f184e7f24520336<br>cfb14ce62e981a610f88be8811e1dc343db12b92<br>7188044570e204369e3bab83039ee56753a381cb<br>010b38298a4a4d1e256a27e87cc0d1f34f47b64a<br>14606a9aada603389684160b59794a766efe9f0b<br>181433c9aa6780710b44dd1c48ad8796dca18cb8<br>e0fdd45df81ecde6823a4bf4ffccbc35cabd1cb<br>c8ed6e3a1353616d0232b5ce0ec74dfac61b4b1<br>3e746871396e56491bcd2f4c4d0120e15f98ef37<br>5d62957020594d5e66d55d4d72921154475ff8a9<br>c060d2975a5089b6501bbb8839d856ee5dc931a6<br>e51ecb575bbd772b1e7e7391655e777514d8b8d5<br>9e25305bc47f2046e133b2f09b3b828715da811e<br>07f7ccac20b4f412876e7a992c340a0a65e2f63<br>17bb3448fae7c6b3409feaa6002a82348d193949<br>a5f1500704238efae5084368028111066b89d05d<br>1ecb611f1c29e9776baf619675fbc44403d534a3<br>b3ea56b1995e14544202880c0cb211b197a9e95a<br>96c3b39b61552fbe511ee7ada13a29334b4aa286<br>c5c19840d6887f61e010df92ee95adb3af2ea6d<br>eaa9a1a1383cac81e36189d9324aad0028dc68a1<br>d2d5fe3d8ed8a4f0572c36e99e86226b0d827d24<br>d94f7fecac0c27903ded491b233dfbb2a17e647b<br>6828ec0826075baab6186545748db93677689b41<br>2aee9f7c7984303e3c02a0b70701ed2702dac98c<br>6e04ed657682a9ba46bb8e1c19e26bd750722655<br>aa55f46ed48b9be0989a3cbb58191bbd99533cc2<br>9486e83fd4ca8f75e8c57135fb4e31d4849b65e3<br>467cd38943f87ffabe4a848efa7da3f2c9bf95e8<br>3e99db71a9b35285c920d576c989c184d5387e5b<br>3b08d213f1938280cb49a215875a724eb40a7983<br>6723086317f9721401ee2d874af7d9c32a831364<br>8a95de1e8776d2ae66ab3d2d83148e59d3d27b0c<br>363d98aab25bd882fb7732af3ec21d92cbeb483e<br>afbc4811e111cf1df0d6740aef4f0ce57a0707e3<br>4840f4f717359e13ff5d600021d037b4b85ee5b6<br>5d165d2374bf547f299180ff8abc8e2372b5906</td></tr><tr><td>couponmarvel</td><td></td></tr></tbody></table>

<table><caption>Table 6.4 – Evaluation dataset (4/5)</caption><thead><tr><th>Family</th><th>SHA1</th></tr></thead><tbody><tr><td>multiplug</td><td>2cac3884cca13c4a24caf24235d5f0006913ea26<br>63e138c4b9af4a951c753de8866328eec8cbe3d4<br>a6f9db9d1717013e2dfe8e47e24e25f831ed5278<br>7e91a2248abed93eafebf2b2f05810bb0b32802e<br>d9a8f8e3d97e6d47045c4209371a424bcd977026<br>01531ada6cc172dfa4e86d826222b09090cd956a<br>afb72959f2b0b7d5f131130bc5fe21f9bde9c9ec<br>0479e8499c1a3e94da5231e7aa47eff0d84cc5eb<br>235fca383cb5ab9d892af3608489cd56655ed87<br>50771e305929168d44091e11e7491da35559a9b4<br>be4c1c202a2583d9d49a8e9881f9f57b37ae16b2<br>1e2575e266514625ca7591abd6807877842b91c1<br>1d9d53f16af5ea60fef032102f7f10f0a2f0a098a<br>3534182525c52ccecf2f508d8664dc90899c54c6d<br>3b6805317c906a98d34c3d483e720bccfb138922<br>b47e7221fceee6b995728eec97b093e7a201990c9<br>69a09fbb98d0f8679f0717f3bdbf32ae24bf69cc<br>53304574aa944b6696c44f76f8ce45f75f3cf641<br>a32a0faeeec65891f93157bc368dea54383f6d89<br>381b398188662098c306121a92c7164b753eb1ee<br>7a9f8f0e7a443ac2ed5d7dab4e5f9568a85c7479<br>3c4b3dd2375681a3d59d1ea2af7deb8cdf4c6990<br>e3df83d9b798be3284194bb4390579ac7d196873<br>393580b1980ac00490dc8e14c68091e8ac5694ad<br>afa991896b637884e7d60aaf6024a6457c96c0b0<br>c9d4d366439d144fd9b2c60562cda4c9be0e0b04<br>61e7feb76f046262e7b8ebd08450e50c4c6ff1<br>801c0bd52c63d8aa17491e4e7f017435314ae360<br>62c42f510f93dd0ce86d5666449ac9d733b15e9a<br>576a946cdfa6feadf06142ae06f55b7fed577115<br>09031d53c01585fc2a1ff8358cb0541d2006e799<br>3ab89751d14866299b2cb78eb41f931adc816717<br>1aed3dd03d42b96a376598c7a53b5edab14e69f9<br>e6fb750288954e94917a0f7a2ee7b5b271672885<br>6abb9084345b9e2990e14fe907e6fd213cc47cc4<br>e9abd5e7bf0d77723991df905615d14dd4e31692<br>2cad3027ce9674f00cdfd7487e83956033dee1d8<br>2739c2937b4de40924a0400a2200caa9f271f51d<br>59037dc39c4a18d6b98280a9e598c83a33c3e64b<br>9917463fd83f55c5afe4cd5fa5dec1ef8e2128e2<br>13029bb8fd12b4ec54dc49ea49a90abdc2fc75ee<br>04226396c0de4dce851f7529f88fdb96dd112d57<br>6fc2c149f385fb2c35ade0b0dcea54c7ec4b9422<br>97d69adc224831a186c5036e0985ce991177dae9<br>bf63e4ae6b88b1fa3b7426adaf6e1ecbf6c9af4a<br>7f6c111ac542f49c83a3a90514497f0ede8b7392<br>2834829c99ef5cafcbcdfe0f5c194f3f0c096ad1<br>bd287cfe53be4f13404d9c081db5cc223ab380ad<br>6a63611845806950c9f3f0f9dc8adb660aae4a0<br>144837eb6d598644ae5664eadaa3efe308d4a2cd</td></tr><tr><td>droie</td><td></td></tr></tbody></table>
<table><caption>Table 6.5 – Evaluation dataset (5/5)</caption><thead><tr><td>Family</td><td>SHA1</td></tr></thead><tbody><tr><td>cleanware</td><td>168518b3b4aa0ae5c9ade193177ff1a0125ec665c00a10899c17f66ad4b47d9b2e57a9cef4004b6d934ce1475dcaff413a60d792143a582064a62f5ba1bf405584a3b93912c8ae0fb1aa137b4a1f387c0b1d02a4d87c2780dd3d8958cfe9b9b6757bc71d43b18970cb4571b8b516ec4eab5dcba6517b4dd81ab2d93096bcc18c6956118860c3e9aaa4c2f8cfcdf15ab96e7d9e50bd98d20564b67bfa4113c8fb976d42ff400556a15946c1bad7d687212d0c96b3cfba36ab1f6a8842cfa405e922e6c261ac2b45a260e870128b89da49334f107e289d7a74eef7ccad62ec427462f477ff810198aefd122af73a68c73cb8abcc65de8e8f8edc4b27569b34d10bb8c13e4d ee9847051a898d88060ca52bab0c229851acfbf0eed8781c92830087cc2cc41b507b7b6899ae8f179adf02ba06b5297d95e8288cc50ae44ec9f8c28fa51959cb4e11467f0fbdf490be2078ff5d9d7391b63b81aa89fd8db3d9ff2386cc816d5849d9586939a6e114bc4f4bcaf9c915abc5158c98fa2ab4da1898cd90ad7095121511383170d5b3ee85325448139926599045c7de0b37c0906b51c0322c9ab82af36ce7091903b73a6905460069877ddc209ad2e7e0a85bee630d831e3f1aa99bf87b2d7b379f1b4050260b3c03863a375f226c6e1e124b93c325c12e3b5ce23f1e64cb41f639b68fddc44a51f871f70a</td></tr></tbody></table>
# 6.7 Structural-Based Binary Code Similarity

## 6.7.1 NEF Selection: Detailed Analysis

This section details the analysis conducted to select the *nef* value for the AnR experiment. For this, we computed the evaluation metrics for different *nef* values using four different clustering algorithms (i.e. DBSCAN, HDBSCAN, OPTICS and Agglomerative). Furthermore, as DBSCAN requires the definition of input parameters *ε* and Agglomerative the values for linkage (λ) and distance threshold (τ), they also undergo a parameter exploration to pick the best value according to a given *tuned metric*.

The list of considered metrics is:

- Silhouette score

- (Mean) similarity score

- Similarity score

- Completeness score

- V-measure score

While silhouette score and mean similarity do not depend on any given labeling, the similarity, completeness and v-measure are ground truth-dependent. In the latter case, the labels are taken from the Yara rules defined in experiment of the *accuracy phase* (section 4.5.5, page 177).

We split the analysis into two different categories: tuning and no-tuning clustering algorithms. The former includes algorithms that require the definition of input parameters and therefore undergo a parameter exploration against a given *tuning metric*. The latter includes algorithms that do not require input parameters and therefore respond autonomously as the *nef* value varies.

### No-tuning Clustering Algorithms

This category includes the following clustering algorithms:

- HDBSCAN

- OPTICS

This category is simpler to analyze since it does not involve any underlying parameter tuning.
**HDBSCAN** In figure 6.22 we see the variation of each metric as function of *nef*.

<figure><img src="image_160.png" /><figcaption>Figure 6.22 – Metric values for HBSCAN as function of *nef*</figcaption></figure>

we observe that:

- the scores for completeness, homogeneity and v-score almost do not change;

- for *nef* between 0 and 0.8, there is a somewhat stable regime where the silhouette grows (asymptotically) and the similarity reduces linearly;

- the lines for silhouette and similarity scores cross for *nef* between 0.20 and 0.205 (figure 6.23b);

- the worst value for the similarity score is produced for *nef* equal 0.8 (figure 6.23c);

- the worst value for the silhouette score is produced for *nef* equal 0 (figure 6.23a);

**OPTICS** In figure 6.24 we see the variation of each metric as function of *nef*.

we observe that:
Silhouette score: 0.9719820556559722
Similarity score: 0.9725921215645881
Homogeneity score: 0.9794823818550916
Completeness score: 0.8397775552395289
V-measure score: 0.9042658536724304
HDBSCAN results:
Number of clusters found: 8
Samples in cluster {-1: 3, 0: 132, 1: 6, 2: 150, 3: 127, 4: 150, 5: 10, 6: 22}

<figure><img src="image_161.png" /><figcaption>(a) nef =0.0</figcaption></figure>

Silhouette score: 0.950155856484346
Similarity score: 0.9643975609664658
Homogeneity score: 0.9747010046349425
Completeness score: 0.7928519874005193
V-measure score: 0.8744220197394711
HDBSCAN results:
Number of clusters found: 9
Samples in cluster {-1: 3, 0: 133, 1: 6, 2: 150, 3: 127, 4: 132, 5: 18, 6: 9, 7: 22}

<figure><img src="image_162.png" /><figcaption>(b) nef =0.20</figcaption></figure>

Silhouette score: 0.971157673904803
Similarity score: 0.9236144763290282
Homogeneity score: 0.9794823818550916
Completeness score: 0.7939173304213752
V-measure score: 0.8769912754738678
HDBSCAN results:
Number of clusters found: 9
Samples in cluster {-1: 4, 0: 132, 1: 127, 2: 6, 3: 150, 4: 132, 5: 18, 6: 9, 7: 22}

<figure><img src="image_163.png" /><figcaption>(c) nef =0.80</figcaption></figure>

Silhouette score: 0.96595651469296493
Similarity score: 0.9548148992706974
Homogeneity score: 0.9706539134739909
Completeness score: 0.7954135529262997
V-measure score: 0.8743395058987732
HDBSCAN results:
Number of clusters found: 8
Samples in cluster {-1: 9, 0: 26, 1: 132, 2: 127, 3: 6, 4: 150, 5: 132, 6: 18}

<figure><img src="image_164.png" /><figcaption>(d) nef =1.0</figcaption></figure>

Figure 6.23 – Results for HBSCAN clustering with different *nef* values
<figure><img src="image_165.png" /><figcaption>Figure 6.24 – Metric values for OPTICS as function of *nef*</figcaption></figure>

- the score for completeness almost does not change;

- the score for homogeneity follows a step down pattern for *nef* equal 0.2, which impacts
  the v-measure score;

- the silhouette score follows a somewhat stable asymptotically growth trajectory;

- the similarity score decreases almost linearly for *nef* between 0 and 0.8, with exception of an interval between 0.5 and 0.65, where it grows rapidly. A fast growth is also found for *nef* > 0.9;

- the lines for silhouette and similarity scores cross for *nef* between 0.20 and 0.205, fur-
thermore a step downwards is observed for the homogeneity score at this point (fig-
ure 6.25b);

- the worst value for the similarity score is produced for *nef* equal 0.8 (figure 6.25c);

- the worst value for the silhouette score is produced for *nef* equal 0.05 (figure 6.25a);
Silhouette score: 0.9667859307786498
Similarity score: 0.9369480572954465
Homogeneity score: 0.9827064066314803
Completeness score: 0.7967514654730589
V-measure score: 0.88800127871144259
OPTICS results:
Number of clusters found: 9
Samples in cluster (-1: 3, 0: 127, 1: 132, 2: 18, 3: 11, 4: 21, 5: 132, 6: 6, 7: 150)

<figure><img src="image_166.png" /></figure>

(a) *nef* =0.05

Silhouette score: 0.962473747057972
Similarity score: 0.8921131434159251
Homogeneity score: 0.9645824307639571
Completeness score: 0.794821410736676
V-measure score: 0.8715119863984276
OPTICS results:
Number of clusters found: 8
Samples in cluster (0: 127, 1: 132, 2: 18, 3: 5, 4: 30, 5: 6, 6: 150, 7: 132)

<figure><img src="image_167.png" /></figure>

(c) *nef* =0.90

Silhouette score: 0.954292938394140404
Similarity score: 0.95686696584880397
Homogeneity score: 0.995166580016161
Completeness score: 0.8013865468345768
V-measure score: 0.8878258006010932
OPTICS results:
Number of clusters found: 9
Samples in cluster (-1: 5, 0: 127, 1: 132, 2: 18, 3: 11, 4: 21, 5: 130, 6: 6, 7: 150)

<figure><img src="image_168.png" /></figure>

(b) *nef* =0.20

Silhouette score: 0.9726572674682413
Similarity score: 0.9974750733718336
Homogeneity score: 0.9827064066314802
Completeness score: 0.8024411197576434
V-measure score: 0.8834721138430831
OPTICS results:
Number of clusters found: 8
Samples in cluster (-1: 14, 0: 127, 1: 132, 2: 18, 3: 6, 4: 150, 5: 132, 6: 21)

<figure><img src="image_169.png" /></figure>

(d) *nef* =1.0

<caption>Figure 6.25 – Results for OPTICS clustering with different *nef* values</caption>
# Tuning Clustering Algorithms

This category includes the following clustering algorithms:

- DBSCAN

- Agglomerative

**DBSCAN** In the figures 6.26a,6.26b, 6.26c, 6.26d, 6.26e we see the variation of each metric as function of *nef* by tuning DBSCAN by silhouette, similarity, homogeneity, completeness and v-measure respectively.

we observe that:

- tuning by *completeness* gives by far the worst average results for all metrics;

- tuning by *v-measure* or *silhouette* results in the best average scores;

- when tuned by *silhouette*, the *similarity* grows steps upwards for *nef* equal 0.5, whereas the *completeness* steps downwards. It suggests that more clusters are found.

- when tuned by *silhouette*, the best value for *nef* < 0.5 is 0.25 (c.f. figure 6.27)

**Agglomerative** In the figures 6.28a,6.28b, 6.28c, 6.28d, 6.28e we see the variation of each metric as function of *nef* by tuning the Agglomerative clustering by silhouette, similarity, homogeneity, completeness and v-measure respectively.

We observe that:

- tuning by *completeness* gives by far the worst average results for all metrics;

- tuning by *v-measure* or *silhouette* results in the best average scores;

- when tuned by *silhouette*, the best result is obtained for *nef* equal 0.45 (c.f. figure 6.29)
<figure><img src="image_170.png" /><figcaption>Figure 6.26 – Results for DBSCAN as function of different tuning metrics</figcaption></figure>
Silhouette score: 0.970149077531073
Similarity score: 0.9601410699196623
Homogenity score: 0.9951665800161608
Completeness score: 0.8459319591320458
V-measure score: 0.9145009860094633
DBSCAN results:
Number of clusters found: 8
Samples in cluster {-1: 6, 0: 127, 1: 150, 2: 10, 3: 21, 4: 6, 5: 150, 6: 130}

<figure><img src="image_171.png" /><figcaption>Figure 6.27 – DBSCAN clustering (nef =0.25, tuned by silhouette)</figcaption></figure>
<figure><img src="image_172.png" /><figcaption>Figure 6.28 – Results for Agglomerative as function of different tuning metrics</figcaption></figure>
Silhouette score: 0.9794611960329693
Similarity score: 0.9921724503557144
Homogeneity score: 0.995166580016161
Completeness score: 0.8287779314607285
V-measure score: 0.9043828849560831
Agglomerative results:
Number of clusters found: 15
Samples in cluster {-1: 3, 0: 2, 1: 150, 2: 127, 3: 150, 4: 130, 5: 3, 6: 2, 8: 2, 9: 6, 11: 21, 12: 2, 14: 2}

<figure><img src="image_173.png" /><figcaption>Figure 6.29 – Agglomerative clustering (nef =0.45, tuned by silhouette)</figcaption></figure>
# 6.8 EMB-DUET: Multi-Feature Clustering Based on Numerical Embedding

## 6.8.1 SVM

### Distance Between Hyperplanes

Here we show that the distance between the margins in SVM is equal to $2/||w||$. For this, let $x_0$ be a point in the hyperplane $\langle w, x \rangle + b = -1$ (i.e. class -1) and $d$ denote the perpendicular distance from $x_0$ to the hyperplane $\langle w, x \rangle + b = 1$ (i.e. class 1) —the distance that we want to find is precisely $d$.

The point on the hyperplane of class 1 corresponds to:

$$ \langle w, x_0 + d \frac{w}{||w||} \rangle + b = 1 $$

because $w/||w||$ is a unit normal vector to the hyperplanes.

Expanding this equation, we have:

$$ \langle w, x_0 \rangle + \langle w, d \frac{w}{||w||} \rangle + b = 1 $$

$$ \langle w, x_0 \rangle + d \frac{||w||^2}{||w||} + b = 1 $$

$$ \langle w, x_0 \rangle + b = 1 - d||w|| $$

$$ -1 = 1 - d||w|| $$

$$ d = \frac{2}{||w||} $$

□
### 6.8.2 EMB-DUET

Scatter plot having the data points of the different OPTICS clusterings with respect to their AMI and homogeneity score:

<figure><img src="image_174.png" /><figcaption>Figure 6.30 – Correlation plot (AMI x Homogeneity score)</figcaption></figure>
<figure><img src="image_175.png" /></figure>
<figure><img src="image_176.png" /></figure>
<figure><img src="image_177.png" /></figure>

**Titre** : Classification de Logiciels Malveillants Dirigée par les Données et Assistée par des Méthodes d'Apprentissage Automatique

**Mot clés** : classification des logiciels malveillants, analyse des logiciels malveillants, exécution symbolique, partitionnement de données

**Résumé** : Historiquement, l'analyse des logiciels malveillants (ou malware, MW) a formement fait appel au savoir-faire humain pour la création manuelle de signatures permettant de détecter et de classer les MW. Cette procédure est très coûteuse et prend beaucoup de temps, ce qui ne permet pas de faire face aux scénario modernes de cybermenaces. La solution consiste à automatiser largement l'analyse des MW.

Dans ce but, la classification des MW permet d'optimiser le traitement de grands corpus de MW en identifiant les ressemblances entre des instances similaires. La classification des MW est donc une activité clé liée à l'analyse des MW.

Cette thèse aborde le problème de la classification des MW en adoptant une approche pour laquelle l'intervention humaine est évitée autant que possible. De plus, nous contournons la subjectivité inhérente à l'analyse humaine en concevant la classification unique-ment à partir de données directement issues de l'analyse des MW, adoptant ainsi une approche dirigée par les données. Notre objectif est d'améliorer l'automatisation de l'analyse des MW et de la combiner avec des méthodes d'apprentissage automatique capables de repérer et de révéler de manière autonome des points communs imprévisibles au sein des données.

Nous avons échelonné notre travail en trois étapes. Dans un premier temps, nous

nous sommes concentrés sur l'amélioration de l'analyse des MW et sur son automatisation, étudiant de nouvelles façons d'exploiter l'exécution symbolique dans l'analyse des MW et développant un cadre d'exécution distribué pour augmenter notre puissance de calcul. Nous nous sommes ensuite concentrés sur la représentation du comportement des MW, en accordant une attention particulière à sa précision et à sa robustesse. Enfin, nous nous sommes focalisés sur le partitionnement des MW, en concevant une méthodologie qui qui ne restreint pas la combinaison des caractéristiques syntaxiques et comportementales, et qui monte bien en charge en pratique.

Quant à nos principales contributions, nous revisitions l'usage de l'exécution symbolique pour l'analyse des MW en accordant une attention particulière à l'utilisation optimale des tactiques des solveurs SMT et aux réglages des hyperparamètres; nous concevons un nouveau paradigme d'évaluation pour les systèmes d'analyse des MW; nous formulons une représentation compacte du comportement sous la forme de graphe, ainsi qu'une fonction associée pour le calcul de la similarité par paire, qui est précise et robuste; et nous élaborons une nouvelle stratégie de partitionnement des MW basée sur un partitionnement d'ensemble flexible en ce qui concerne la combinaison des caractéristiques syntaxiques et comportementales.
**Title:** Data-Driven Malware Classification Assisted by Machine Learning Methods

**Keywords:** malware classification, malware analysis, symbolic execution, clustering

**Abstract:**

Historically, malware (MW) analysis has heavily resorted to human savvy for manual signature creation to detect and classify MW. This procedure is very costly and time consuming, thus unable to cope with modern cyber threat scenario. The solution is to widely automate MW analysis.

Toward this goal, MW classification allows optimizing the handling of large MW corpora by identifying resemblances across similar instances. Consequently, MW classification figures as a key activity related to MW analysis, which is paramount in the operation of computer security as a whole.

This thesis addresses the problem of MW classification taking an approach in which human intervention is spared as much as possible. Furthermore, we steer clear of subjectivity inherent to human analysis by designing MW classification solely on data directly extracted from MW analysis, thus taking a data-driven approach. Our objective is to improve the automation of malware analysis and to combine it with machine learning methods that are able to autonomously spot and reveal unwitting commonalities within data.

We phased our work in three stages. Initially we focused on improving MW analysis and its automation, studying new ways of leveraging symbolic execution in MW analysis and developing a distributed framework to scale up our computational power. Then we concentrated on the representation of MW behavior, with painstaking attention to its accuracy and robustness. Finally, we fixed attention on MW clustering, devising a methodology that has no restriction in the combination of syntactical and behavioral features and remains scalable in practice.

As for our main contributions, we revamp the use of symbolic execution for MW analysis with special attention to the optimal use of SMT solver tactics and hyperparameter settings; we conceive a new evaluation paradigm for MW analysis systems; we formulate a compact graph representation of behavior, along with a corresponding function for pairwise similarity computation, which is accurate and robust; and we elaborate a new MW clustering strategy based on ensemble clustering that is flexible with respect to the combination of syntactical and behavioral features.