Mal-Netminer: Malware Classification Approach Based on Social Network Analysis of System Call Graph

Table 3

The result of additional SNA measure explorations.

Category	Measure of SNA	Result of exploration
Centrality	Avg. normalized betweenness centrality	Can classify only worm
	Avg. normalized weighted in-degree centrality
	Avg. normalized weighted out-degree centrality
Cohesion	Network diameter, -index	Cannot classify all classes
	Number of strong connected components	Cannot classify Trojan

normalized: normalized betweenness/in-degree/out-degree centrality is the betweenness/in-degree/out-degree centrality divided by the maximum betweenness/in-degree/out-degree centrality.
weighted: weighted degree centrality is the number of weighted links that a node has with other nodes in the network. The weighted links represent the amount of duplicated links between two nodes in the network.