# Cluster Analysis of Malware Family Relationships

arXiv: https://arxiv.org/abs/2103.05761 · HTML: https://mlsanity.com/paper/2103.05761/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 1 of its 32 references that are in the map.
- First posted on arXiv 7 Mar 2021.

## Builds on (most cited first, 1 of 1)

- [Adjusting for Chance Clustering Comparison Measures](https://mlsanity.com/paper/1512.01286/) (2015)

## Built on by (most cited first, 2 of 2)

- [Online Clustering of Known and Emerging Malware Families](https://mlsanity.com/paper/2405.03298/) (2024)
- [A Malware Classification Survey on Adversarial Attacks and Defences](https://mlsanity.com/paper/2312.09636/) (2023)

## Abstract (arXiv)

In this paper, we use K-means clustering to analyze various relationships between malware samples. We consider a dataset comprising~20 malware families with~1000 samples per family. These families can be categorized into seven different types of malware. We perform clustering based on pairs of families and use the results to determine relationships between families. We perform a similar cluster analysis based on malware type. Our results indicate that K-means clustering can be a powerful tool for data exploration of malware family relationships.