Similarity hash based scoring of portable executable files for efficient malware detection in IoT
Loading...
Date
2020
Journal Title
Journal ISSN
Volume Title
Publisher
Future Generation Computer Systems
Abstract
The current rise in malicious attacks shows that existing security systems are bypassed by malicious
files. Similarity hashing has been adopted for sample triaging in malware analysis and detection. File
similarity is used to cluster malware into families such that their common signature can be designed.
This paper explores four hash types currently used in malware analysis for portable executable (PE)
files. Although each hashing technique produces interesting results, when applied independently, they
have high false detection rates. This paper investigates into a central issue of how different hashing
techniques can be combined to provide a quantitative malware score and to achieve better detection
rates. We design and develop a novel approach for malware scoring based on the hashes results. The
proposed approach is evaluated through a number of experiments. Evaluation clearly demonstrates a
significant improvement (> 90%) in true detection rates of malware.
Description
Keywords
Malware, Static analysis, Detection, Hashes, Internet of things
Citation
Namanya, A. P., Awan, I. U., Disso, J. P., & Younas, M. (2020). Similarity hash based scoring of portable executable files for efficient malware detection in IoT. Future Generation Computer Systems, 110, 824-832. https://doi.org/10.1016/j.future.2019.04.044