We have seen the advantages and limitations associated with traditional malware analysis methodologies, and we have understood why—in light of the high prevalence of malware threats—it is necessary to introduce algorithmic automation methods for malware detection.
In particular, it is increasingly important that the similarities in malware behavior are correctly identified, which means that malware samples must be associated to classes or families of the same type, even if the individual malware signatures are not comparable to each other, due to, for example, the presence of polymorphic codes that alter the hash checksums accordingly.
The analysis of similarities can be carried out in an automated form, by using clustering algorithms.
