Fuzzy-import hashing: A malware analysis approach

Nitin Kumar Naik, Paul Jenkins, Nick Savage, Longzhi Yang, Tossapon Boongoen, Natthakan Iam-On

Research output: Chapter in Book/Report/Conference proceedingConference Proceeding (Non-Journal item)

11 Citations (SciVal)

Abstract

Malware has remained a consistent threat since its emergence, growing into a plethora of types and in large numbers. In recent years, numerous new malware variants have enabled the identification of new attack surfaces and vectors, and have become a major challenge to security experts, driving the enhancement and development of new malware analysis techniques to contain the contagion. One of the preliminary steps of malware analysis is to remove the abundance of counterfeit malware samples from the large collection of suspicious samples. This process assists in the management of man and machine resources effectively in the analysis of both unknown and likely malware samples. Hashing techniques are one of the fastest and efficient techniques for performing this preliminary analysis such as fuzzy hashing and import hashing. However, both hashing methods have their limitations and they may not be effective on their own, instead the combination of two distinctive methods may assist in improving the detection accuracy and overall performance of the analysis. This paper proposes a Fuzzy-Import hashing technique which is the combination of fuzzy hashing and import hashing to improve the detection accuracy and overall performance of malware analysis. This proposed Fuzzy-Import hashing offers several benefits which are demonstrated through the experimentation performed on the collected malware samples and compared against stand-alone techniques of fuzzy hashing and import hashing.

Original languageEnglish
Title of host publicationInternational Conference on Fuzzy Systems
Subtitle of host publicationFUZZ 2020 - Proceedings
PublisherIEEE Press
Pages1-8
Number of pages8
ISBN (Electronic)9781728169323
DOIs
Publication statusPublished - 19 Jul 2020
Externally publishedYes
Event2020 IEEE International Conference on Fuzzy Systems, FUZZ 2020 - Glasgow, United Kingdom of Great Britain and Northern Ireland
Duration: 19 Jul 202024 Jul 2020

Publication series

NameIEEE International Conference on Fuzzy Systems
Volume2020-July
ISSN (Print)1098-7584

Conference

Conference2020 IEEE International Conference on Fuzzy Systems, FUZZ 2020
Country/TerritoryUnited Kingdom of Great Britain and Northern Ireland
CityGlasgow
Period19 Jul 202024 Jul 2020

Keywords

  • Fuzzy C-Means Clustering
  • Fuzzy Hashing
  • Fuzzy-Import Hashing
  • Import Hashing
  • Malware Analysis
  • Ransomware

Fingerprint

Dive into the research topics of 'Fuzzy-import hashing: A malware analysis approach'. Together they form a unique fingerprint.

Cite this