Mobile malware visual analytics and similarities of Attack Toolkits (Malware gene analysis)

We use Normalized Compression Distance (NCD) (owing to its capabilities to perform similarity measure of unstructured data) to enumerate code similarity between malicious Android apps and visualize their clusters. Our classification methods and visual analytics can help the antivirus community to ensure that a variant of a known malware can still be detected without the need of creating a signature. We also present when a new malware is released, our methods can be used to understand the similarity/behavior with known malware families.