Introduction Malware similarity research often falls into one of these categories: similarity search clustering nearest neighbor multi-class classification Each of these requires feature identification and a similarity metric or distance measure.