Malware clustering methods and challenges explained with datasets
Malware Clustering in the Wild: Taxonomy, Challenges, and Evaluation Metrics
Cryptography and SecurityArtificial Intelligence
Summary
Malware, or harmful software, is increasing in number and complexity. This paper reviews many ways researchers group malware samples to find patterns and relationships, which helps understand malware better. The authors organize these methods into seven main types and describe popular malware datasets used for these studies. They also point out challenges and suggest that AI-based methods might improve future analysis of large malware collections.
What this means in practice
- •For cybersecurity analysts: Group new malware samples by similarities to quickly understand threats and track evolving variants using organized clustering methods.
- •For network security teams: Use clustering techniques to identify suspicious network activity patterns associated with malware families for improved threat detection.
A survey. It maps existing work.
Authors
Raguvir S, Bojing Li, Prajna Bhandary, Charles Nicholas
Abstract
As malware continues to grow in volume, diversity, and sophistication, clustering has emerged as a critical technique for analyzing large malware corpora. Clustering enables the discovery of structural relationships, behavioral patterns, and evolutionary trends, and is widely used to group unknown samples, infer malware family boundaries, and identify novel variants. However, existing research remains fragmented, employing a wide range of clustering techniques with no unified perspective that systematically organizes prior work or clearly identifies gaps in the literature. This survey addresses this gap by organizing previous malware clustering research into seven categories: centroid-based, hierarchical-based, density-based, distribution-based, mixed- type, fuzzy, and AI-driven approaches. In addition, this survey summarizes publicly available malware datasets commonly used in clustering research and examines the feature representations derived from these datasets. Our goal is to clarify the current landscape and outline promising avenues for future research on malware clustering, including how AI-driven methods may shape large-scale and reproducible analysis.