TagClass: A Tool for Extracting Class-Determined Tags from Massive Malware Labels via Incremental Parsing

VirusTotal is widely used for malware annotation by providing malware labels from a large set of anti-malware engines. A long-standing challenge in using these inconsistent labels is extracting class-determined tags. In this paper, we present Tagclass,a tool based on incremental parsing to associate tags with their corresponding family, behavior, and platform classes. Tagclasstreats behavior and platform tags as locators and achieves incremental parsing by introducing and iterating the following two algorithms: 1) location first search, which hits family tags using locators, and 2) co-occurrence first search, which finds new locators by family tags. Experiments across two benchmark datasets indicate Tagclassoutperforms existing methods, improving the parsing accuracy by 21% and 28%, respectively. To the best of our knowledge, Tagclassis the first tag class-determined malware label parsing tool, which would pave the way for research on crowdsourcing malware annotation. Tagclasshas been released to the community 11https://github.com/crowdma/tagclass.