Understanding uses and misuses of similarity hashing functions for malware detection and family clustering in actual scenarios

No abstract is available for this paper.

• Publication year

  2021

• Venue

  Digital Investigation. The International Journal of Digital Forensics and Incident Response

• Publication date

  2021-09-01

• Fields of study

  Computer Science

• Identifiers
  DOI 10.1016/J.FSIDI.2021.301220
• External record

  Open on Semantic Scholar

• Source metadata

  Semantic Scholar

• No claims are published for this paper.

• No concepts are published for this paper.

• Designing the Elements of a Fuzzy Hashing Scheme

  2021cited by this paper
• Pre-processing memory dumps to improve similarity score of Windows modules

  2021cited by this paper
• Bringing order to approximate matching: Classification and attacks on similarity digest algorithms

  2021cited by this paper
• TrustAV: Practical and Privacy Preserving Malware Analysis in the Cloud

  2020cited by this paper
• Familial Clustering for Weakly-Labeled Android Malware Using Hybrid Representation Learning

  2020cited by this paper
• Beyond Labeling: Using Clustering to Build Network Behavioral Profiles of Malware Families

  2020cited by this paper
• The impact of excluding common blocks for approximate matching

  2020cited by this paper
• A semantic-based methodology for digital forensics analysis

  2020cited by this paper
• A Study on Approximate Matching for Similarity Search: Techniques, Limitations and Improvements for Digital Forensic Investigations

  2020influential reference
• One Size Does Not Fit All: A Longitudinal Analysis of Brazilian Financial Malware

  2020cited by this paper
• Clustering IoT Malware based on Binary Similarity

  2020cited by this paper
• Similarity Metric Method for Binary Basic Blocks of Cross-Instruction Set Architecture

  2020cited by this paper
• On the Security of Application Installers and Online Software Repositories

  2020cited by this paper
• We need to talk about antiviruses: challenges & pitfalls of AV evaluations

  2020cited by this paper
• RevEngE is a dish served cold: Debug-Oriented Malware Decompilation and Reassembly

  2019cited by this paper
• Understanding the effects of removing common blocks on Approximate Matching scores under different scenarios for digital forensic investigations

  2019cited by this paper
• L(a)ying in (Test)Bed - How Biased Datasets Produce Impractical Results for Actual Malware Families' Classification

  2019cited by this paper
• Malware Variants Identification in Practice

  2019cited by this paper
• Cyberthreat Hunting - Part 1: Triaging Ransomware using Fuzzy Hashing, Import Hashing and YARA Rules

  2019cited by this paper
• Augmented YARA Rules Fused With Fuzzy Hashing in Ransomware Triaging

  2019cited by this paper
• Towards exact and inexact approximate matching of executable binaries

  2019cited by this paper
• Improving file-level fuzzy hashes for malware variant classification

  2019cited by this paper
• Beyond Precision and Recall: Understanding Uses (and Misuses) of Similarity Hashes in Binary Analysis

  2018influential reference
• Aperfeiçoamento da ferramenta sdhash para identificação de artefatos similares em investigações forenses

  2018cited by this paper
• Dynamic signatures: A review of dynamic feature variation and forensic methodology.

  2018cited by this paper
• Malicious Linux Binaries: A Landscape

  2018cited by this paper
• The Need for Speed: An Analysis of Brazilian Malware Classifers

  2018cited by this paper
• Malware Detection and Classification Based on N-Grams Attribute Similarity

  2017cited by this paper
• Similarity Digest Search: A Survey and Comparative Analysis of Strategies to Perform Known File Filtering Using Approximate Matching

  2017cited by this paper
• Lempel-Ziv Jaccard Distance, an Effective Alternative to Ssdeep and Sdhash

  2017cited by this paper
• Dynamic Malware Detection Using API Similarity

  2017cited by this paper
• A Novel DBSCAN Based on Binary Local Sensitive Hashing and Binary-KNN Representation

  2017cited by this paper
• Malware provenance: code reuse detection in malicious software at scale

  2016cited by this paper
• Forensic Malware Analysis: The Value of Fuzzy Hashing Algorithms in Identifying Similarities

  2016cited by this paper
• Bytewise Approximate Matching: The Good, The Bad, and The Unknown

  2016cited by this paper
• Fingerprinting Android packaging: Generating DNAs for malware detection

  2016cited by this paper
• AVclass: A Tool for Massive Malware Labeling

  2016cited by this paper
• Cache implementation using collective intelligence on cloud based antivirus architecture

  2016cited by this paper
• Experimental study of fuzzy hashing in malware clustering analysis

  2015cited by this paper
• Needles in a Haystack: Mining Information from Public Dynamic Analysis Sandboxes for Malware Intelligence

  2015cited by this paper
• Mining Malware to Detect Variants

  2014cited by this paper
• Approximate Matching: Definition and Terminology

  2014influential reference
• AMAL: High-fidelity, behavior-based automated malware analysis and classification

  2014cited by this paper
• Automated evaluation of approximate matching algorithms on real data

  2014cited by this paper
• Evaluating detection error trade-offs for bytewise approximate matching algorithms

  2014cited by this paper
• Using String Information for Malware Family Identification

  2014cited by this paper
• Heuristic malware detection via basic block comparison

  2013cited by this paper
• Mobile malware visual analytics and similarities of Attack Toolkits (Malware gene analysis)

  2013cited by this paper
• Malware Similarity Identification Using Call Graph Based System Call Subsequence Features

  2013cited by this paper
• TLSH -- A Locality Sensitive Hash

  2013cited by this paper
• Similarity Preserving Hashing: Eligible Properties and a New Algorithm MRSH-v2

  2012cited by this paper
• ThinAV: truly lightweight mobile cloud-based anti-malware

  2012cited by this paper
• An evaluation of forensic similarity hashes

  2011cited by this paper
• Security Aspects of Piecewise Hashing in Computer Forensics

  2011cited by this paper
• Performance Issues About Context-Triggered Piecewise Hashing

  2011cited by this paper
• On Challenges in Evaluating Malware Clustering

  2010cited by this paper
• Data Fingerprinting with Similarity Digests

  2010cited by this paper
• A Linear DBSCAN Algorithm Based on LSH

  2007cited by this paper
• google,我,萨娜

  2006cited by this paper
• Identifying almost identical files using context triggered piecewise hashing

  2006cited by this paper
• An in-depth look into the win32 portable executable le format

  2002cited by this paper
• Approximate String Matching

  1994cited by this paper
• Space/time trade-offs in hash coding with allowable errors

  1970cited by this paper

• Family Ties: A Close Look at the Influence of Static Features on the Precision of Malware Family Clustering

  2025cites this paper
• Hardening behavioral classifiers against polymorphic malware: An ensemble approach based on minority report

  2025cites this paper
• Using approximate matching and machine learning to uncover malicious activity in logs

  2025cites this paper
• FLSH: A Framework Leveraging Similarity Hashing for Android Malware and Variant Detection

  2025cites this paper
• Bytewise approximate matching: Evaluating common scenarios for executable files

  2025cites this paper
• The Polymorphism Maze: Understanding Diversities and Similarities in Malware Families

  2025cites this paper
• APT-ClaritySet: A Large-Scale, High-Fidelity Labeled Dataset for APT Malware with Alias Normalization and Graph-Based Deduplication

  2025cites this paper
• Методика сбора данных об активности вредоносного программного обеспечения под ОС Windows на базе MITRE ATT&CK

  2024cites this paper
• Holographic Global Convolutional Networks for Long-Range Prediction Tasks in Malware Detection

  2024cites this paper
• The Reversing Machine: Reconstructing Memory Assumptions

  2024cites this paper
• On the Effectiveness of Perturbations in Generating Evasive Malware Variants

  2023cites this paper
• AIHGAT: A novel method of malware detection and homology analysis using assembly instruction heterogeneous graph

  2023cites this paper
• GPThreats-3: Is Automatic Malware Generation a Threat?

  2023influential citation
• On the Malware Detection Problem: Challenges & Novel Approaches

  2022influential citation
• HYBRID ENCODING AND DATA TRANSFORMATION FOR CLOUD DATA SECURITY IN POST-QUANTUM ERA

  year unknowncites this paper
• Hardening behavioral classifiers against polymorphic malware: An ensemble approach based on minority report

  year unknowncites this paper