AVclass: A Tool for Massive Malware Labeling
AVclass: A Tool for Massive Malware Labeling
M. Sebastián,Richard Rivera,Platon Kotzias,Juan Caballero
2016 · DOI: 10.1007/978-3-319-45719-2_11
International Symposium on Recent Advances in Intrusion Detection · 433 Citations
TLDR
AVclass is described, an automatic labeling tool that given the AV labels for a, potentially massive, number of samples outputs the most likely family names for each sample, and implements novel automatic techniques to address 3 key challenges: normalization, removal of generic tokens, and alias detection.