Mal-Netminer: Malware Classification Approach Based on Social Network Analysis of System Call Graph

Figure 13

An evaluation of the network-level metrics on both Trojan and worm classes using the clustering coefficient, average distance, average density, and component ratio.

(a) Overall clustering coefficient (Trojan)

(b) Overall clustering coefficient (worm)

(c) Average distance (Trojan)

(d) Average distance (worm)

(e) Network density (Trojan)

(f) Network density (worm)

(g) Component ratio (Trojan)

(h) Component ratio (worm)