Year: 2025
Type: article
Abstract: Identifying and categorizing malware variants efficiently is a critical capability for modern cybersecurity systems tasked with defending against rapidly evolving threats. Traditional similarity search techniques often rely on syntactic or signature-based comparisons, which are insufficient for capturing deeper semantic relationships among malware samples, especially in the presence of obfuscation and polymorphism. This research introduces a semantic metric learning approach for enhanced malware similarity search that leverages deep neural embeddings trained to capture high-level behavioral and structural characteristics of malicious code. By employing a supervised metric learning framework with contrastive and triplet loss functions, the model learns a discriminative embedding space in which semantically similar malware instances are mapped closer together while dissimilar samples are pushed farther apart. Experimental evaluations on benchmark malware datasets demonstrate that the proposed method significantly outperforms traditional hashing and signature-based approaches in retrieval precision, recall, and mean average precision. The results underscore the potential of semantic metric learning to advance malware analysis, facilitate threat hunting, and improve incident response workflows by enabling more accurate and scalable similarity-based retrieval.
Authors: Yuki Nakamura, Hiroshi Tanaka
Institutions: The University of Tokyo, Kyoto University
Language: English
Subfield: Signal Processing
Field: Computer Science
Domain: Physical Sciences
Open Access status: bronze
OpenAlex ID: W4411918148