Welcome to the SRI Malware Cluster Laboratory:

The SRI Malware Clustering Lab is exploring the use of behavioral attribute clustering as a method to automatically categorize common malware patterns under one forensic model description, and to help us rapidly identify new malware behavioral patterns. We explore malware clustering based on a multi-perspective collection of infection attributes (network communications, sensor alarms, binary attributes, host forensic changes) captured from our live Internet honeynet.   
_____________________________________________________________________________

6941 Malware Infections Analyzed
32 Behavioral Profiles

 [VIEW FULL SET]

Behavioral Clustering
Similarity Matrix

The two figures plot the pair-wise similarity between the synopsis. You may view the image as a matrix. Pixel (i, j) represents the similarity measure between the i-th and the j-th synopsis. A red pixel means the similarity is close to 1. (i.e. the synopsis are close to identical.)  A blue pixel means small similarity.

___________________________________________________________________________________________________
Development Team:  Arvind Naryanan (UTexas Austin), Phillip Porras (SRI),  Vinod Yegneswaran (SRI),   Jian Zhang (SRI)