NLP-Driven Malware Classification: A Jaccard Similarity Approach

Malware classification is a critical task in cybersecurity, essential for identifying and mitigating threats. This paper presents an approach to malware classification using Natural Language Processing (NLP) techniques coupled with Jaccard similarity. We propose utilizing
$n-\mathbf{grams}$
of API call sequences, comprising API names and their arguments, to represent the behavior of malware samples. By computing the Jaccard similarity between these
$n-\mathbf{grams}$
, we can effectively capture the similarities and differences in malware behavior. Our experiments reveal that different
$n-\mathbf{grams}$
exhibit varying classification abilities, with some performing better for specific types of malware. Moreover, we observe that increasing the value of n in
$n-\mathbf{grams}$
leads to improved evaluation metrics, indicating the effectiveness of our approach. Overall, our method offers a promising approach to malware classification, leveraging NLP and Jaccard similarity to enhance accuracy and effectiveness in identifying malware variants.