Phylogenetic-Inspired Probabilistic Model Abstraction in Detection of Malware Families

Lineage of malware has been studied using phylogenetic based methods. Multiple sequence alignment techniques in biology form the foundations of phylogenetic analysis. The analysis of malware trace data using sequence alignment techniques is a drastic simplification from reality. In this work, we describe a framework that incorporates uncertainty in discovering the relationship between malware traces. The framework leverages on probabilistic measures of similarity between stochastic models to compare two malware families. A proof-of-concept of our formalism is demonstrated with the construction of a network of malware relationships.