Fuzzy-Import Hashing: A Malware Analysis Approach

Naik, Nitin, Jenkins, Paul, Savage, Nick, Yang, Longzhi, Boongoen, Tossapon and Iam-On, Natthakan (2020) Fuzzy-Import Hashing: A Malware Analysis Approach. In: 2020 IEEE International Conference on Fuzzy Systems (FUZZ-IEEE). IEEE International Conference on Fuzzy Systems . IEEE, Pistcataway, pp. 1-8. ISBN 9781728169330, 9781728169323 (In Press)

[img]
Preview
Text
FUZZ-IEEE-20-Fuzzy-Import-Hashing-DrNaik.pdf - Accepted Version

Download (395kB) | Preview
Official URL: https://doi.org/10.1109/FUZZ48607.2020.9177636

Abstract

Malware has remained a consistent threat since its emergence, growing into a plethora of types and in large numbers. In recent years, numerous new malware variants have enabled the identification of new attack surfaces and vectors, and have become a major challenge to security experts, driving the enhancement and development of new malware analysis techniques to contain the contagion. One of the preliminary steps of malware analysis is to remove the abundance of counterfeit malware samples from the large collection of suspicious samples. This process assists in the management of man and machine resources effectively in the analysis of both unknown and likely malware samples. Hashing techniques are one of the fastest and efficient techniques for performing this preliminary analysis such as fuzzy hashing and import hashing. However, both hashing methods have their limitations and they may not be effective on their own, instead the combination of two distinctive methods may assist in improving the detection accuracy and overall performance of the analysis. This paper proposes a Fuzzy-Import hashing technique which is the combination of fuzzy hashing and import hashing to improve the detection accuracy and overall performance of malware analysis. This proposed Fuzzy-Import hashing offers several benefits which are demonstrated through the experimentation performed on the collected malware samples and compared against stand-alone techniques of fuzzy hashing and import hashing.

Item Type: Book Section
Uncontrolled Keywords: Malware Analysis, Fuzzy-Import Hashing, Fuzzy Hashing, Import Hashing, Fuzzy C-Means Clustering, Ransomware
Subjects: G400 Computer Science
Department: Faculties > Engineering and Environment > Computer and Information Sciences
Depositing User: John Coen
Date Deposited: 05 Nov 2020 14:10
Last Modified: 10 Nov 2020 09:45
URI: http://nrl.northumbria.ac.uk/id/eprint/44692

Actions (login required)

View Item View Item

Downloads

Downloads per month over past year

View more statistics