Abstract
Cybercrime continues to be a growing challenge and malware is one of the most serious security threats on the Internet today which have been in existence from the very early days. Cyber criminals continue to develop and advance their malicious attacks. Unfortunately, existing techniques for detecting malware and analysing code samples are insufficient and have significant limitations. For example, most of malware detection studies focused only on detection and neglected the variants of the code. Investigating malware variants allows antivirus products and governments to more easily detect these new attacks, attribution, predict such or similar attacks in the future, and further analysis. The focus of this paper is performing similarity measures between different malware binaries for the same variant utilizing data mining concepts in conjunction with hashing algorithms. In this paper, we investigate and evaluate using the Trend Locality Sensitive Hashing (TLSH) algorithm to group binaries that belong to the same variant together, utilizing the k-NN algorithm. Two Zeus variants were tested, TSPY-ZBOT and MAL-ZBOT to address the effectiveness of the proposed approach. We compare TLSH to related hashing methods (SSDEEP, SDHASH and NILSIMSA) that are currently used for this purpose. Experimental evaluation demonstrates that our method can effectively detect variants of malware and resilient to common obfuscations used by cyber criminals. Our results show that TLSH and SDHASH provide the highest accuracy results in scoring an F-measure of 0.989 and 0.999 respectively.
Original language | English |
---|---|
Title of host publication | Proceedings - 5th Cybercrime and Trustworthy Computing Conference, CTC 2014 |
Place of Publication | Aukland; New Zealand |
Publisher | IEEE, Institute of Electrical and Electronics Engineers |
Pages | 44-53 |
Number of pages | 10 |
ISBN (Electronic) | 9781479988259 |
DOIs | |
Publication status | Published - 1 Jan 2015 |
Event | 5th Cybercrime and Trustworthy Computing Conference, CTC 2014 - Aukland, New Zealand Duration: 24 Nov 2014 → 25 Nov 2014 |
Conference
Conference | 5th Cybercrime and Trustworthy Computing Conference, CTC 2014 |
---|---|
Country/Territory | New Zealand |
City | Aukland |
Period | 24/11/14 → 25/11/14 |