关键词: 恶意代码, 可视化, 谱系分析, Jaccard距离, K最邻近节点算法（KNN）

Abstract: Malware programmers often create malware variants with automatic methods, which makes the number of malwares increase exponentially. Automatic methods use similar modules, which provide valuable evidences for malware analysts to recognize and distinguish. This paper proposes a new visualization method for malware pedigree analysis, which converts binary files into double-color-channel bitmaps and normalized pixel images taking advantage of K-Nearest Neighbor algorithm in a visualization mode. The experimental results show that the dimensionality reduction scheme of pixel normalization decreases time overheads of display greatly. And by means of applying Jaccard distance to rapid similarity comparison automatically, the proposed method can classify malware families effectively and improve recognition efficiency.

Key words: malware, visualization, pedigree analysis, Jaccard distance, K-Nearest Neighbor（KNN） algorithm