Pehash: A novel approach to fast malware clustering

LEET 2009 - 2nd USENIX Workshop on Large-Scale Exploits and Emergent Threats: Botnets, Spyware, Worms, and More

Volumn , Issue , 2009, Pages

  Wicherski, Georg ^a  

^a RWTH AACHEN UNIVERSITY   (Germany)

Author keywords

[No Author keywords available]

Indexed keywords

BOTNET; COMPUTER VIRUSES; HASH FUNCTIONS;

DATA ANALYSIS SYSTEM; DATA COLLECTION; MESSAGE DIGESTS; MULTIPLE INSTANCES; NEW FUNCTIONS; PORTABLE EXECUTABLE; SCALING ANALYSIS; STRUCTURAL INFORMATION;

NETWORK SECURITY;

EID: 85084095857     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (15)

1. Thorsten Holz, Maximillian Dornseif, Felix Freiling, Paul Baecher, Markus Koetter: The Nepenthes Platform, 9th International Symposium on Advances in Intrusion Detection (RAID 2006)
2. Carsten Willems, Thorsten Holz, Felix Freiling: Toward Automated Dynamic Malware Analysis Using CWSandbox, IEEE Security & Privacy, 1540-7993/07
3. F-Secure: Allaple.A, http://www.f-secure.com/v-descs/allaple_a.shtml
4. Vassil Roussev, Golden G. Richard III, Lodovico Marziale: Multi-resolution similarity hashing, Digital Investigation Journal
5. Tony Abou-Assaleh, Nick Cercone, Vlado Keselj, Ray Sweidan: N-gram-based Detection of New Malicious Code, Proceedings of the 28th Annual International Computer Software and Applications Conference
6. Zynamics: VxClass, http://www.zynamics.com/index.php?page=vxclass
7. The mwcollect Alliance, https://alliance.mwcollect.org/
8. PackerStatistics
9. ShadowServer: Packer Statistics, http://www.shadowserver.org/wiki/pmwiki.php?n=Stats.
10. NIST: Kolmogorov Complexity, http://www.nist.gov/dads/HTML/kolmogorov.html
11. whdc/system/platform/firmware/ PECOFF.mspx
12. Microsoft: Portable Executable Format Specification, http://www.microsoft.com/
13. Symantec: W32.Virut.A Technical Details, http://www.symantec.com/security_response/ writeup.jsp?docid= 2006-051402-1930-99&tabid=2
14. Tillmann Werner: Nebula, http://nebula.mwcollect.org/
15. Andrew Walenstein: Exploiting Similarity Between Variants to Defeat Malware, Blackhat DC 2007