Similarity search and malware prioritization

1. A computer-implemented method for processing a malware sample executed by one or more computer processors, the method comprising:

receiving two or more malware samples;

analyzing, by the one or more computer processors, the two or more malware samples to extract information from the two or more malware samples;

generating, by the one or more computer processors, at least one set of strings for each of the two or more malware samples using the extracted information, wherein the at least one set of strings includes a first set of strings generated from extracted information corresponding to a first malware sample and a second set of strings generated from extracted information corresponding to a second malware sample;

determining, by the one or more computer processors, a similarity between the two or more malware samples based on the at least one set of strings for each of the two or more malware samples, determining the similarity comprising:

determining a similarity index associated with the first set of strings and the second set of strings by:

determining a union of a first data set associated with the first set of strings and a second data set associated with the second set of strings,

determining an intersection of the first data set and the second data set, and

dividing the intersection by the union,

determining a distance based on the similarity index by subtracting a result of the dividing from one, and

determining the similarity based on the distance; and

providing, for display to a user, an output indicating the similarity between the two or more malware samples.

2. The computer-implemented method of claim 1 , wherein generating the at least one set of strings for each of the two or more malware samples comprises:

generating two or more respective JSONs for the two or more malware samples using the extracted information; and

generating at least one set of strings, respectively, from each of the JSONs.

3. The computer-implemented method of claim 1 , further comprising:

obtaining a hashed set of strings from the at least one set of strings for each of the two or more malware samples, the hashed set of strings having a data size less than respective ones of the at least one set of strings for each of the two or more malware samples.

4. The computer-implemented method of claim 1 , further comprising:

determining a priority order for the two or more malware samples based, at least in part, on the similarity between the two or more malware samples.

5. The method of claim 1 , wherein generating at least one set of strings for each of the two or more malware samples using the extracted information comprises generating at least one set of strings for each of the two or more malware samples by flattening the extracted information, wherein the at least one set of strings includes a first set of strings generated by flattening extracted information corresponding to a first malware sample and a second set of strings generated by flattening extracted information corresponding to a second malware sample.

6. The method of claim 5 , wherein at least some of the extracted information is represented in a multi-level format, and

wherein generating at least one set of strings for each of the two or more malware samples by flattening the extracted information comprises generating at least one set of strings for each of the two or more malware samples by expanding the multi-level formatted information into a string format.

7. A non-transitory computer-readable storage medium encoded with a computer program, the program comprising instructions that upon execution by a computer cause the computer to perform operations comprising:

receiving two or more malware samples;

analyzing the two or more malware samples to extract information from the two or more malware samples;

generating at least one set of strings for each of the two or more malware samples using the extracted information, wherein the at least one set of strings includes a first set of strings generated from extracted information corresponding to a first malware sample and a second set of strings generated from extracted information corresponding to a second malware sample;

determining a similarity between the two or more malware samples based on the at least one set of strings for each of the two or more malware samples, determining the similarity comprising:

determining a similarity index associated with the first set of strings and the second set of strings by:

determining a union of a first data set associated with the first set of strings and a second data set associated with the second set of strings,

determining an intersection of the first data set and the second data set, and

dividing the intersection by the union,

determining a distance based on the similarity index by subtracting a result of the dividing from one, and

determining the similarity based on the distance; and

providing, for display to a user, an output indicating the similarity between the two or more malware samples.

8. The medium of claim 7 , wherein generating the at least one set of strings for each of the two or more malware samples comprises:

generating two or more respective JSONs for the two or more malware samples using the extracted information; and

generating at least one set of strings, respectively, from each of the JSONs.

9. The medium of claim 7 , wherein the operations further comprise:

obtaining a hashed set of strings from the at least one set of strings for each of the two or more malware samples, the hashed set of strings having a data size less than respective ones of the at least one set of strings for each of the two or more malware samples.

10. The medium of claim 7 , wherein the operations further comprise:

determining a priority order for the two or more malware samples based, at least in part, on the similarity between the two or more malware samples.

11. The medium of claim 7 , wherein generating at least one set of strings for each of the two or more malware samples using the extracted information comprises generating at least one set of strings for each of the two or more malware samples by flattening the extracted information, wherein the at least one set of strings includes a first set of strings generated by flattening extracted information corresponding to a first malware sample and a second set of strings generated by flattening extracted information corresponding to a second malware sample.

12. The medium of claim 11 , wherein at least some of the extracted information is represented in a multi-level format, and

wherein generating at least one set of strings for each of the two or more malware samples by flattening the extracted information comprises generating at least one set of strings for each of the two or more malware samples by expanding the multi-level formatted information into a string format.

13. A system comprising:

one or more processors and one or more computer storage media storing instructions that are operable, when executed by the one or more processors, to cause the one or more processors to perform operations comprising:

receiving two or more malware samples;

analyzing the two or more malware samples to extract information from the two or more malware samples;

generating at least one set of strings for each of the two or more malware samples using the extracted information, wherein the at least one set of strings includes a first set of strings generated from extracted information corresponding to a first malware sample and a second set of strings generated from extracted information corresponding to a second malware sample;

determining a similarity between the two or more malware samples based on the at least one set of strings for each of the two or more malware samples, determining the similarity comprising:

determining a similarity index associated with the first set of strings and the second set of strings by:

determining a union of a first data set associated with the first set of strings and a second data set associated with the second set of strings,

determining an intersection of the first data set and the second data set, and

dividing the intersection by the union,

determining a distance based on the similarity index by subtracting a result of the dividing from one, and

determining the similarity based on the distance; and

providing, for display to a user, an output indicating the similarity between the two or more malware samples.

14. The system of claim 13 , wherein generating the at least one set of strings for each of the two or more malware samples comprises:

generating two or more respective JSONs for the two or more malware samples using the extracted information; and

generating at least one set of strings, respectively, from each of the JSONs.

15. The system of claim 13 , wherein the operations further comprise:

obtaining a hashed set of strings from the at least one set of strings for each of the two or more malware samples, the hashed set of strings having a data size less than respective ones of the at least one set of strings for each of the two or more malware samples.

16. The system of claim 13 , wherein the operations further comprise:

determining a priority order for the two or more malware samples based, at least in part, on the similarity between the two or more malware samples.

17. The system of claim 13 , wherein generating at least one set of strings for each of the two or more malware samples using the extracted information comprises generating at least one set of strings for each of the two or more malware samples by flattening the extracted information, wherein the at least one set of strings includes a first set of strings generated by flattening extracted information corresponding to a first malware sample and a second set of strings generated by flattening extracted information corresponding to a second malware sample.

18. The system of claim 17 , wherein at least some of the extracted information is represented in a multi-level format, and

wherein generating at least one set of strings for each of the two or more malware samples by flattening the extracted information comprises generating at least one set of strings for each of the two or more malware samples by expanding the multi-level formatted information into a string format.