Lion Cipher Lab
Turn messy antivirus labels into a malware family name (the AVClass method)
- Threat Intel Analyst
- Intermediate
- ~70 min
- Free · no account required
Why it matters
Ask twelve antivirus engines what a malicious file is and you get twelve answers: one says Trojan.Win32 plus a family name, one says a generic heuristic, one says only 'Malicious', and two quietly repeat a third engine's label word for word. Yet threat-intel work runs on family names: you count how many samples of a family hit your organisation, you cluster a malware feed, you build a labeled dataset to train or test a classifier, you decide whether today's sample is the ransomware from last month's advisory. Researchers at the IMDEA Software Institute showed that taking the full label…
What you'll learn
- Explaining why the same sample gets a different name from every antivirus engine, and which part of a label is the family
- Normalizing AV labels into tokens: lowercase, strip trailing digits, drop short and generic tokens, replace aliases
- Choosing a family by plurality vote over tokens with a minimum-engines threshold, and reporting SINGLETON when no family survives
- Collapsing identical labels so engines that copy each other get one vote, not three
- Grading a labeling method against ground truth by correct, wrong and unlabeled counts, and reading the threshold trade-off
- Learning a generic-token list from labeled data, and recognizing when the seed set is too narrow to learn it
Steps in this lab
- Why one file gets twelve different names
- The AVClass recipe, in five moves
- Build the fixture: 40 samples, 12 invented engines, a hidden answer key
- Label it three ways and grade each against the answer key
- Why identical labels mean copying (and why that matters more than it looks)
- Sweep the threshold: more agreement, fewer labels
- Learn the generic list instead of typing it -- and watch it fail on a narrow seed
- Where the method stops: new families, label drift, and what a family name is not
- Do it for real, and how a pro uses the output