Detection of Malicious Portable Executables using Evidence Combinational Theory with Fuzzy Hashing

Simple item page
dc.contributor.authorNamanya, Anitta Patience
dc.contributor.authorKhan Ali Mirza, Qublai
dc.contributor.authorAl-Mohannadi, Hamad
dc.contributor.authorAwan, Irfan U.
dc.contributor.authorFerdinand Pagna Disso, Jules
dc.date.accessioned2023-05-05T17:08:24Z
dc.date.available2023-05-05T17:08:24Z
dc.date.issued2016
dc.description.abstractFuzzy hashing is a known technique that has been adopted to speed up malware analysis processes. However, Hashing has not been fully implemented for malware detection because it can easily be evaded by applying a simple obfuscation technique such as packing. This challenge has limited the usage of hashing to triaging of the samples based on the percentage of similarity between the known and unknown. In this paper, we explore the different ways fuzzy hashing can be used to detect similarities in a file by investigating particular hashes of interest. Each hashing method produces independent but related interesting results which are presented herein. We further investigate combination techniques that can be used to improve the detection rates in hashing methods. Two such evidence combination theory based methods are applied in this work in order propose a novel way of combining the results achieved from different hashing algorithms. This study focuses on file and section Ssdeep hashing, PeHash and Imphash techniques to calculate the similarity of the Portable Executable files. Our results show that the detection rates are improved when evidence combination techniques are used.en_US
dc.identifier.citationNamanya, A. P., Mirza, Q. K. A., Al-Mohannadi, H., Awan, I. U., & Disso, J. F. P. (2016, August). Detection of malicious portable executables using evidence combinational theory with fuzzy hashing. In 2016 IEEE 4th International Conference on Future Internet of Things and Cloud (FiCloud) (pp. 91-98). IEEE. DOI 10.1109/FiCloud.2016.21en_US
dc.identifier.other10.1109/FiCloud.2016.21
dc.identifier.urihttps://nru.uncst.go.ug/handle/123456789/8635
dc.language.isoenen_US
dc.publisherIEEEen_US
dc.subjectMalware detectionen_US
dc.subjectFuzzy hashen_US
dc.subjectEvidence combinational theoryen_US
dc.subjectCommon Factor Modelen_US
dc.subjectFuzzy Logicen_US
dc.subjectPortable executableen_US
dc.titleDetection of Malicious Portable Executables using Evidence Combinational Theory with Fuzzy Hashingen_US
dc.typeOtheren_US
Files
Original bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
Detection of Malicious Portable Executables using.pdf
Size:
442.95 KB
Format:
Adobe Portable Document Format
Description:
Proceedings
Download
License bundle
Now showing 1 - 1 of 1
No Thumbnail Available
Name:
license.txt
Size:
1.71 KB
Format:
Item-specific license agreed upon to submission
Description:
Download
Collections
Engineering and Technology