A modern binary executable is made up of various networks. This study is an empirical 1
analysis of the networks composing malicious binaries from multiple samples and quantifies their 2
structural composition with network measurements. We demonstrate the presence of Scale-Free 3
properties for data dependency and control flow graphs, and show that data dependency graphs 4
have both Scale-Free and Small-World properties. We show that program data dependency graphs 5
have a degree correlation that is disassortative, and that control flow graphs have a neutral degree 6
assortativity. These network measurements provide a set of features for further classification tasks to 7
identify patterns of malicious programs.
Keywords:
Subject: Computer Science and Mathematics - Computer Science
Copyright: This open access article is published under a Creative Commons CC BY 4.0 license, which permit the free download, distribution, and reuse, provided that the author and preprint are cited in any reuse.
Preprints.org is a free preprint server supported by MDPI in Basel, Switzerland.