Malwares are the key means leveraged by threat actors in the cyber space for their attacks. There is a large array of commercial solutions in the market and significant scientific research to tackle the challenge of the detection and defense against malwares. At the same time, attackers also advance their capabilities in creating polymorphic and metamorphic malwares to make it increasingly challenging for existing solutions. To tackle this issue, we propose a methodology to perform malware detection and family attribution. The proposed methodology first performs the extraction of opcodes from malwares in each family and constructs their respective opcode graphs. We explore the use of clustering algorithms on the opcode graphs to detect clusters of malwares within the same malware family. Such clusters can be seen as belonging to different sub-family groups. Opcode graph signatures are built from each detected cluster. Hence, for each malware family, a group of signatures is generated to represent the family. These signatures are used to classify an unknown sample as benign or belonging to one the malware families. We evaluate our methodology by performing experiments on a dataset consisting of both benign files and malware samples belonging to a number of different malware families and comparing the results to existing approach.

翻译：恶意软件是威胁行为体在网络空间攻击他们的关键手段。市场上有大量商业解决方案和大量科学研究,以应对发现和防范恶意软件的挑战。同时,攻击者还提高自己创建多形态和变形恶意软件的能力,使其对现有解决方案产生越来越大的挑战。为解决这一问题,我们提议了一个方法来进行恶意软件检测和家庭归属。拟议方法首先从每个家庭中的恶意软件中提取代码,并构建其各自的代码图。我们探索如何在代码图中使用组合算法,以检测同一恶意软件家庭内部的恶意软件群。这些组合可以被视为属于不同的子家庭群。从每个检测到的组合中建立Opco图形签名。因此,对于每个恶意软件家庭,都会生成一组签名来代表家庭。这些签名用来将未知的样本归类为友好或属于一个恶意家庭。我们通过对由属于不同恶意软件家庭的主文档和恶意软件样本组成的数据集进行实验来评估我们的方法。