Fuzzy-import hashing: A malware analysis approach

Nitin Naik, Paul Jenkins, Nick Savage, Longzhi Yang, Tossapon Boongoen, Natthakan Iam-On

Research output: Chapter in Book/Published conference outputConference publication

Abstract

Malware has remained a consistent threat since its emergence, growing into a plethora of types and in large numbers. In recent years, numerous new malware variants have enabled the identification of new attack surfaces and vectors, and have become a major challenge to security experts, driving the enhancement and development of new malware analysis techniques to contain the contagion. One of the preliminary steps of malware analysis is to remove the abundance of counterfeit malware samples from the large collection of suspicious samples. This process assists in the management of man and machine resources effectively in the analysis of both unknown and likely malware samples. Hashing techniques are one of the fastest and efficient techniques for performing this preliminary analysis such as fuzzy hashing and import hashing. However, both hashing methods have their limitations and they may not be effective on their own, instead the combination of two distinctive methods may assist in improving the detection accuracy and overall performance of the analysis. This paper proposes a Fuzzy-Import hashing technique which is the combination of fuzzy hashing and import hashing to improve the detection accuracy and overall performance of malware analysis. This proposed Fuzzy-Import hashing offers several benefits which are demonstrated through the experimentation performed on the collected malware samples and compared against stand-alone techniques of fuzzy hashing and import hashing.

Original languageEnglish
Title of host publication2020 IEEE International Conference on Fuzzy Systems, FUZZ 2020 - Proceedings
PublisherIEEE
ISBN (Electronic)9781728169323
DOIs
Publication statusPublished - 26 Aug 2020
Event2020 IEEE International Conference on Fuzzy Systems, FUZZ 2020 - Glasgow, United Kingdom
Duration: 19 Jul 202024 Jul 2020

Publication series

NameIEEE International Conference on Fuzzy Systems
Volume2020-July
ISSN (Print)1098-7584

Conference

Conference2020 IEEE International Conference on Fuzzy Systems, FUZZ 2020
Country/TerritoryUnited Kingdom
CityGlasgow
Period19/07/2024/07/20

Bibliographical note

© 2020 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.

Keywords

  • Fuzzy C-Means Clustering
  • Fuzzy Hashing
  • Fuzzy-Import Hashing
  • Import Hashing
  • Malware Analysis
  • Ransomware

Fingerprint

Dive into the research topics of 'Fuzzy-import hashing: A malware analysis approach'. Together they form a unique fingerprint.

Cite this