# ClarAVy: A Tool for Scalable and Accurate Malware Family Labeling

arXiv: https://arxiv.org/abs/2502.02759 · HTML: https://mlsanity.com/paper/2502.02759/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 4 Feb 2025.

## Built on by (most cited first, 10 of 10)

- [EMBER2024 -- A Benchmark Dataset for Holistic Evaluation of Malware Classifiers](https://mlsanity.com/paper/2506.05074/) (2025)
- [RawMal-TF: Raw Malware Dataset Labeled by Type and Family](https://mlsanity.com/paper/2506.23909/) (2025)
- [Zipf-Gramming: Scaling Byte N-Grams Up to Production Sized Malware Corpora](https://mlsanity.com/paper/2511.13808/) (2025)
- [MASCOT: Analyzing Malware Evolution Through A Well-Curated Source Code Dataset](https://mlsanity.com/paper/2512.00741/) (2025)
- [Cybersecurity is the True Frontier for Generative AI Success or Failure](https://mlsanity.com/paper/2606.28929/) (2026)
- [Automated Malware Family Classification using Weighted Hierarchical Ensembles of Large Language Models](https://mlsanity.com/paper/2604.02490/) (2026)
- [FARM: Few-shot Adaptive Malware Family Classification under Concept Drift](https://mlsanity.com/paper/2601.17907/) (2026)
- [Building an Adversarial Malware Dataset by Family and Type: Generation, Evasion, and Poisoning Evaluation](https://mlsanity.com/paper/2605.25937/) (2026)
- [MalTree: Tracing Malware Evolution from Embeddings at Scale](https://mlsanity.com/paper/2606.06570/) (2026)
- [Hamm-Grams: An Algorithm for Mining Regular Expressions of Bytes](https://mlsanity.com/paper/2607.01445/) (2026)

## Abstract (arXiv)

Determining the family to which a malicious file belongs is an essential component of cyberattack investigation, attribution, and remediation. Performing this task manually is time consuming and requires expert knowledge. Automated tools using that label malware using antivirus detections lack accuracy and/or scalability, making them insufficient for real-world applications. Three pervasive shortcomings in these tools are responsible: (1) incorrect parsing of antivirus detections, (2) errors during family alias resolution, and (3) an inappropriate antivirus aggregation strategy. To address each of these, we created our own malware family labeling tool called ClarAVy. ClarAVy utilizes a Variational Bayesian approach to aggregate detections from a collection of antivirus products into accurate family labels. Our tool scales to enormous malware datasets, and we evaluated it by labeling ≈40 million malicious files. ClarAVy has 8 and 12 percentage points higher accuracy than the prior leading tool in labeling the MOTIF and MalPedia datasets, respectively.