METHODS AND APPARATUS FOR DETECTING MALWARE SAMPLES WITH SIMILAR IMAGE SETS

An apparatus can include a processor that can extract, from an input binary file, an image data structure, and can scale the image data structure to a predetermined size, and/or modify the image data structure to represent a grayscale image. The processor can calculate a modified pixel value for each pixel in the image data structure, and can define a binary vector based on the modified pixel value for each pixel in the image data structure. The processor can also identify a set of nearest neighbor binary vectors for the binary vector based on a comparison between the binary vector and a set of reference binary vectors stored in a malware detection database. The processor can then determine a malware status of the input binary file based on the set of nearest neighbor binary vectors satisfying a similarity criterion associated with a known malware image from a known malware file.