Context based fuzzy clustering of malware

<p>CuckooML will deliver a mechanism to find similarities between malware through analysing reports about them. Additionally, the software will be able to detect new types of malware - reports not similar to anything seen before (anomalies) - hence, it will constitute an invaluable tool for security researchers.</p> <p>Through the project a state of the art data science and machine learning approaches will be developed and integrated into Cuckoo package being accessible through both: command-line toolkit and as a web based interface.<br> First and foremost, a set of <em>features</em> that well represents the diversity of malware reports will be engineered; it is a common knowledge that the classification - clustering in particular - can only be as good as the features that are used.<br> The development will be focused on <strong>fuzzy</strong> (<em>soft</em>) clustering approaches that can be easily <em>calibrated</em> to maximise their performance. Additionally, the <em>probabilities</em> returned by the classifier will be adapted to serve as <strong>novelty detection</strong> mechanism.<br> Finally, developed approach will be <em>versatile</em> in a sense that user will be able to choose a <strong>context</strong> based on which clustering is performed e.g. platforms at risk, type of threat, etc.</p>