Loading...
Similarity hash based scoring of portable executable files for efficient malware detection in IoT
Namanya, Anitta P. Awan, Irfan U. Disso, J.P. Younas, M.
Namanya, Anitta P.
Awan, Irfan U.
Disso, J.P.
Younas, M.
Publication Date
2020-09
End of Embargo
Supervisor
Rights
© 2019 Elsevier B.V. All rights reserved. Reproduced in accordance with the publisher's self-archiving policy. This manuscript version is made available under the CC-BY-NC-ND 4.0 license.
Peer-Reviewed
Yes
Open Access status
openAccess
Accepted for publication
2019-04-19
Institution
Department
Awarded
Embargo end date
Abstract
The current rise in malicious attacks shows that existing security systems are bypassed by malicious files. Similarity hashing has been adopted for sample triaging in malware analysis and detection. File similarity is used to cluster malware into families such that their common signature can be designed. This paper explores four hash types currently used in malware analysis for portable executable (PE) files. Although each hashing technique produces interesting results, when applied independently, they have high false detection rates. This paper investigates into a central issue of how different hashing techniques can be combined to provide a quantitative malware score and to achieve better detection rates. We design and develop a novel approach for malware scoring based on the hashes results. The proposed approach is evaluated through a number of experiments. Evaluation clearly demonstrates a significant improvement (> 90%) in true detection rates of malware.
Version
Accepted manuscript
Citation
Namanya AP, Awan IU, Disso JP et al (2020) Similarity hash based scoring of portable executable files for efficient malware detection in IoT. Future Generation Computer Systems. 110: 824-832.
Link to publisher’s version
Link to published version
Link to Version of Record
Type
Article