Fuzzy-import hashing: A malware analysis approach

Nitin Naik, Paul Jenkins, Nick Savage, Longzhi Yang, Tossapon Boongoen, Natthakan Iam-On

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

3 Citations (Scopus)
114 Downloads (Pure)

Abstract

Malware has remained a consistent threat since its emergence, growing into a plethora of types and in large numbers. In recent years, numerous new malware variants have enabled the identification of new attack surfaces and vectors, and have become a major challenge to security experts, driving the enhancement and development of new malware analysis techniques to contain the contagion. One of the preliminary steps of malware analysis is to remove the abundance of counterfeit malware samples from the large collection of suspicious samples. This process assists in the management of man and machine resources effectively in the analysis of both unknown and likely malware samples. Hashing techniques are one of the fastest and efficient techniques for performing this preliminary analysis such as fuzzy hashing and import hashing. However, both hashing methods have their limitations and they may not be effective on their own, instead the combination of two distinctive methods may assist in improving the detection accuracy and overall performance of the analysis. This paper proposes a Fuzzy-Import hashing technique which is the combination of fuzzy hashing and import hashing to improve the detection accuracy and overall performance of malware analysis. This proposed Fuzzy-Import hashing offers several benefits which are demonstrated through the experimentation performed on the collected malware samples and compared against stand-alone techniques of fuzzy hashing and import hashing.

Original languageEnglish
Title of host publication2020 IEEE International Conference on Fuzzy Systems (FUZZ-IEEE)
Place of PublicationPiscataway
PublisherInstitute of Electrical and Electronics Engineers Inc.
Number of pages8
ISBN (Electronic)9781728169323
ISBN (Print)9781728169330
DOIs
Publication statusPublished - Jul 2020
EventIEEE WCCI 2020: FUZZ-IEEE 2020 - Glasgow, United Kingdom
Duration: 19 Jul 202024 Jul 2020
https://wcci2020.org/

Publication series

NameIEEE International Conference on Fuzzy Systems
Volume2020-July
ISSN (Print)1098-7584

Conference

ConferenceIEEE WCCI 2020
CountryUnited Kingdom
CityGlasgow
Period19/07/2024/07/20
Internet address

Fingerprint

Dive into the research topics of 'Fuzzy-import hashing: A malware analysis approach'. Together they form a unique fingerprint.

Cite this