The feasibility of using fuzzy hashing for malware detection

与计算机安全的任何其他领域相比，黑客试图开发计算机恶意软件的新变种，而安全专业人员则试图开发和完善识别和隔离这些恶意代码的工具。每当开发出一种新的恶意软件变体时，安全专业人员都会创建一个“签名”，以唯一地识别恶意软件，并将其添加到已知恶意软件的参考数据库中。防病毒软件在尝试检测系统是否受感染或某些数据流量是否包含已知的恶意代码时使用这些数据库。目前，生成病毒签名的最简单方法是基于使用加密散列，例如消息摘要算法5（MD5）或安全散列算法1（SHA-1），其中文件的散列被认为是该文件的签名，因此用于确定它是已知恶意软件还是已知恶意软件的变体。本研究计划的目的是研究使用模糊散列算法来减少病毒检测过程中的假阴性数量并提高其检测速度的可行性。在这个时间点上，这个项目的合作公司，红河解决方案公司。具有恶意软件检测产品，但该产品在通过更传统的手段、签名和签名更新来检测恶意软件变体方面的能力有限。 这项研究的预期成果是提高产品在识别多态病毒攻击目标网络时的能力。 从公司的角度来看，结果将是一个更好的产品，将更适销对路，并提供更多的价值，该公司的客户。 此外，它将通过具有新的和独特的方式来检测恶意软件，为公司在市场上提供竞争优势。 这一功能将是适销对路和一个关键的卖点。

More than any other field in computer security, the race is always dynamic between hackers trying to develop new variants of computer malwares and security professionals trying to develop and perfect tools to identify and isolate these malicious codes. Every time a new variant of a malware is developed, security professionals create a "signature" that uniquely identifies the malware and adds it to the reference database of known malwares. Anti-virus software uses these databases when trying to detect whether a system in infected, or whether certain data traffic contains known strains of these malicious codes. Currently, the simplest methods to generate a signature for a virus are based on using cryptographic hashes such as the Message-Digest algorithm 5 (MD5) or the Secure Hash Algorithm 1 (SHA-1) where the hash of a file is considered as the signature for that file and is therefore used to determine whether it is a known malware or a variant of known malware. The purpose of the research project is to study the feasibility of using fuzzy hashing algorithms to reduce the number of false negatives during virus detection and to improve its detection speed. At this point of time, the collaborating company on this project, Red River Solutions Inc. has a malware detection product, but the product is limited in its capabilities in detecting variants to malware by more traditional means, signatures and updates to signatures. The expected outcome of this research is to advance the product's capabilities in the area of identifying polymorphic viruses as they attack a targeted network. From the company perspective, the outcome will be a better product that will be more marketable and provide more value to the company's clients. Further it will provide a competitive advantage to the company in the market place by having a new and unique manner to detect malware. This feature will be marketable and a key selling point.