Visual Analysis of Malware Behavior (Short paper)

Philipp Trinius, Thorsten Holz, Jan Göbel, Felix Freiling

Workshop on Visualization for Cyber Security (VizSec), Atlantic City, NJ, USA, October 2009


We study techniques to visualize the behavior of malicious software (malware). Our aim is to help human analysts to quickly assess and classify the nature of a new malware sample. Our techniques are based on a parametrized abstraction of detailed behavioral reports automatically generated by sandbox environments. We then explore two visualization techniques: treemaps and thread graphs. We argue that both techniques can effectively support a human analyst (a) in detecting maliciousness of software, and (b) in classifying malicious behavior.


tags: Information Visualization, Malware