The feasibility of using fuzzy hashing for malware detection

点击翻译按钮获取中文摘要

More than any other field in computer security, the race is always dynamic between hackers trying to develop new variants of computer malwares and security professionals trying to develop and perfect tools to identify and isolate these malicious codes. Every time a new variant of a malware is developed, security professionals create a "signature" that uniquely identifies the malware and adds it to the reference database of known malwares. Anti-virus software uses these databases when trying to detect whether a system in infected, or whether certain data traffic contains known strains of these malicious codes. Currently, the simplest methods to generate a signature for a virus are based on using cryptographic hashes such as the Message-Digest algorithm 5 (MD5) or the Secure Hash Algorithm 1 (SHA-1) where the hash of a file is considered as the signature for that file and is therefore used to determine whether it is a known malware or a variant of known malware. The purpose of the research project is to study the feasibility of using fuzzy hashing algorithms to reduce the number of false negatives during virus detection and to improve its detection speed. At this point of time, the collaborating company on this project, Red River Solutions Inc. has a malware detection product, but the product is limited in its capabilities in detecting variants to malware by more traditional means, signatures and updates to signatures. The expected outcome of this research is to advance the product's capabilities in the area of identifying polymorphic viruses as they attack a targeted network. From the company perspective, the outcome will be a better product that will be more marketable and provide more value to the company's clients. Further it will provide a competitive advantage to the company in the market place by having a new and unique manner to detect malware. This feature will be marketable and a key selling point.