15. M1 S (P )
1
M2 S ( P2 )
M 1 ' {ai M 1} {b j } : 1 M1 j M2
M 2 ' {ai M 2 } {b j } : 1 M2 j M1
C : M1' M 2 ' R
a, if a M1, b M 2
C ( a, b) { b , if b M 2 , a M 2
ed (a, b), if a M 1 , b M 2
Find a bijection f:M1’M2’ such that the
distance, d is minimized.
d a M1 '
C (a, f (a))
16. •
•
•
•
d ( p, q )
p: p E, | 1 t , d ( p, q ) q
q
18. Samples Malware
Unknown New
From Signature
Database
Sample
Honeypots
From
Honeypot? New
Dynamic Analysis
No Signature
End of Static
Packed Yes Emulate Yes
Unpacking? Classify
Analysis
No
Non
Malicious
Malicious
The Malwise malware classification system .