NDLI: Malware variant detection using similarity search over content fingerprint

Content Provider	IEEE Xplore Digital Library
Author	Ban Xiaofang Chen Li Hu Weihua Wu Qu
Copyright Year	2014
Description	Author affiliation: China Inf. Technol. Security Evaluation Center, Beijing, China (Ban Xiaofang; Chen Li; Hu Weihua) \|\| Tsinghua Univ., Beijing, China (Wu Qu)
Abstract	Detection of polymorphic malware variants plays an important role to improve information system security. Traditional static/dynamic analysis technologies have shown to be an effective characteristic that represents polymorphic malware instances. While these approaches demonstrate promise, they are themselves subject to a growing array of countermeasures that increase the cost of capturing these malware code features. Further, feature extraction requires a time investment per malware that does not scale well to the daily volume of malwares being reported by those who diligently collect malware. In this paper, we propose a similarity search of malware using novel distance (similarity) metrics of malware content fingerprint based on the locality-sensitive hashing (LSH) schemes. We describe a malware by the binary content of the malware contains; the next step is to compute an feature fingerprint for the malware binary image sample by using the SURF algorithm, and then do fast fingerprint matching with the LSH from malware code corpus to return the top most visually (structurally) similar variants. The LSH algorithm that captures malware similarity is based on image similarity. We implement B2M (Binary mapping to image) algorithm, the SURF algorithm and the LSH algorithm in a complete malware variant detection system. The evaluation shows that our approach is highly effective in terms of response time and malware variant detection.
Starting Page	5334
Ending Page	5339
File Size	5252872
Page Count	6
File Format	PDF
ISBN	9781479937073
e-ISBN	9781479937080
DOI	10.1109/CCDC.2014.6852216
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2014-05-31
Publisher Place	China
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Algorithm design and analysis Force Data visualization Fingerprint recognition Feature extraction Malware Variant Detection Malware Vectors Similarity Search Content Fingerprint Locality-sensitive Hashing
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Similarity search and locality sensitive hashing using ternary content addressable memories

Construct a new fixed-length binary fingerprint representation using Kernelized Locality-Sensitive Hashing

Malware Variant Detection Using Similarity Search over Sets of Control Flow Graphs

Video copy detection based on Speeded Up Robust Features and Locality Sensitive Hashing

Similarity search and locality sensitive hashing using ternary content addressable memories (2010)

Efficient speaker search over large populations using kernelized locality-sensitive hashing

Efficient distributed locality sensitive hashing

Application of Locality Sensitive Hashing to realtime loop closure detection

Video copy detection based on improved affinity propagation

Malware variant detection using similarity search over content fingerprint

Similar Documents

Similarity search and locality sensitive hashing using ternary content addressable memories

Construct a new fixed-length binary fingerprint representation using Kernelized Locality-Sensitive Hashing

Malware Variant Detection Using Similarity Search over Sets of Control Flow Graphs

Video copy detection based on Speeded Up Robust Features and Locality Sensitive Hashing

Similarity search and locality sensitive hashing using ternary content addressable memories (2010)

Efficient speaker search over large populations using kernelized locality-sensitive hashing

Efficient distributed locality sensitive hashing

Application of Locality Sensitive Hashing to realtime loop closure detection

Video copy detection based on improved affinity propagation

Malware variant detection using similarity search over content fingerprint