Finding Non-trivial Malware Naming Inconsistencies

Malware analysts, and in particular antivirus vendors, never agreed on a single naming convention for malware specimens. This leads to confusion and difficulty—more for researchers than for practitioners—for example, when comparing coverage of different antivirus engines, when integrating and systematizing known threats, or comparing the classifications given by different detectors. Clearly, solving naming inconsistencies is a very difficult task, as it requires that vendors agree on a unified naming convention. More importantly, solving inconsistencies is impossible without knowing exactly where they are. Therefore, in this paper we take a step back and concentrate on the problem of finding inconsistencies. To this end, we first represent each vendor’s naming convention with a graph-based model. Second, we give a precise definition of inconsistency with respect to these models. Third, we define two quantitative measures to calculate the overall degree of inconsistency between vendors. In addition, we propose a fast algorithm that finds non-trivial (i.e., beyond syntactic differences) inconsistencies. Our experiments on four major antivirus vendors and 98,798 real-world malware samples confirm anecdotal observations that different vendors name viruses differently. More importantly, we were able to find inconsistencies that cannot be inferred at all by looking solely at the syntax.

Authors and Affiliations

1. Dipartimento di Elettronica e Informazione, Politecnico di Milano, Italy

   Federico Maggi, Andrea Bellini, Guido Salvaneschi & Stefano Zanero

Editors and Affiliations

1. Center for Secure Information Systems, George Mason University, 4400 University Drive, 22030-4422, Fairfax, VA, USA

   Sushil Jajodia

2. Center for Distributed Computing, Jadavpur University, 7000032, Kolkata, India

   Chandan Mazumdar

Reprints and permissions

© 2011 Springer-Verlag Berlin Heidelberg

Policies and ethics