Malware similarity and a new fuzzy hash: Compound Code Block Hash (CCBHash)

In the last few years, malware analysis has become increasingly important due to the rise of sophisticated cyberattacks. One of the objectives of this cybersecurity branch is to find similarities between different files or functions used by malware programmers, thus allowing malware detection, class...

Full description

Saved in:
Bibliographic Details
Published in:Computers & security 2024-07, Vol.142, p.103856, Article 103856
Main Authors: Onieva, Jose A., Pérez Jiménez, Pablo, López, Javier
Format: Article
Language:English
Subjects:
Code similarity
Fuzzy hashes
Hashes
Malware
Citations: Items that this one cites
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:In the last few years, malware analysis has become increasingly important due to the rise of sophisticated cyberattacks. One of the objectives of this cybersecurity branch is to find similarities between different files or functions used by malware programmers, thus allowing malware detection, classification and even attribution in a timely manner. In this article we survey the state of the art in this area, reviewing the different techniques that can be applied to the field, with the objective of studying similarity, and therefore detecting, classifying and attributing malware samples. We have developed a fuzzy hash capable of characterizing malware by generating an easily comparable and storable signature of its functions. Since our goal is to detect these similarities in huge amounts of data within a reasonable time-frame, the size of the hash must be limited while retaining as much information as possible.
ISSN:0167-4048
1872-6208
DOI:10.1016/j.cose.2024.103856