Mining malware to detect variants

Ahmad Azab, Robert Layton, Mamoun Alazab, Jonathan Oliver

    Research output: Chapter in Book/Report/Conference proceedingConference Paper published in Proceedingspeer-review


    Cybercrime continues to be a growing challenge and malware is one of the most serious security threats on the Internet today which have been in existence from the very early days. Cyber criminals continue to develop and advance their malicious attacks. Unfortunately, existing techniques for detecting malware and analysing code samples are insufficient and have significant limitations. For example, most of malware detection studies focused only on detection and neglected the variants of the code. Investigating malware variants allows antivirus products and governments to more easily detect these new attacks, attribution, predict such or similar attacks in the future, and further analysis. The focus of this paper is performing similarity measures between different malware binaries for the same variant utilizing data mining concepts in conjunction with hashing algorithms. In this paper, we investigate and evaluate using the Trend Locality Sensitive Hashing (TLSH) algorithm to group binaries that belong to the same variant together, utilizing the k-NN algorithm. Two Zeus variants were tested, TSPY-ZBOT and MAL-ZBOT to address the effectiveness of the proposed approach. We compare TLSH to related hashing methods (SSDEEP, SDHASH and NILSIMSA) that are currently used for this purpose. Experimental evaluation demonstrates that our method can effectively detect variants of malware and resilient to common obfuscations used by cyber criminals. Our results show that TLSH and SDHASH provide the highest accuracy results in scoring an F-measure of 0.989 and 0.999 respectively.

    Original languageEnglish
    Title of host publicationProceedings - 5th Cybercrime and Trustworthy Computing Conference, CTC 2014
    Place of PublicationAukland; New Zealand
    PublisherIEEE, Institute of Electrical and Electronics Engineers
    Number of pages10
    ISBN (Electronic)9781479988259
    Publication statusPublished - 1 Jan 2015
    Event5th Cybercrime and Trustworthy Computing Conference, CTC 2014 - Aukland, New Zealand
    Duration: 24 Nov 201425 Nov 2014


    Conference5th Cybercrime and Trustworthy Computing Conference, CTC 2014
    Country/TerritoryNew Zealand


    Dive into the research topics of 'Mining malware to detect variants'. Together they form a unique fingerprint.

    Cite this