Mining malware to detect variants

Ahmad Azab, Robert Layton, Mamoun Alazab, Jonathan Oliver

Research output: Chapter in Book/Report/Conference proceedingConference proceeding contributionpeer-review

50 Citations (Scopus)


Cybercrime continues to be a growing challenge and malware is one of the most serious security threats on the Internet today which have been in existence from the very early days. Cyber criminals continue to develop and advance their malicious attacks. Unfortunately, existing techniques for detecting malware and analysing code samples are insufficient and have significant limitations. For example, most of malware detection studies focused only on detection and neglected the variants of the code. Investigating malware variants allows antivirus products and governments to more easily detect these new attacks, attribution, predict such or similar attacks in the future, and further analysis. The focus of this paper is performing similarity measures between different malware binaries for the same variant utilizing data mining concepts in conjunction with hashing algorithms. In this paper, we investigate and evaluate using the Trend Locality Sensitive Hashing (TLSH) algorithm to group binaries that belong to the same variant together, utilizing the k-NN algorithm. Two Zeus variants were tested, TSPY-ZBOT and MAL-ZBOT to address the effectiveness of the proposed approach. We compare TLSH to related hashing methods (SSDEEP, SDHASH and NILSIMSA) that are currently used for this purpose. Experimental evaluation demonstrates that our method can effectively detect variants of malware and resilient to common obfuscations used by cyber criminals. Our results show that TLSH and SDHASH provide the highest accuracy results in scoring an F-measure of 0.989 and 0.999 respectively.

Original languageEnglish
Title of host publicationProceedings - 5th Cybercrime and Trustworthy Computing Conference, CTC 2014
Place of PublicationPiscataway, NJ
PublisherInstitute of Electrical and Electronics Engineers (IEEE)
Number of pages10
ISBN (Electronic)9781479988259, 9781479988242
ISBN (Print)9781479988266
Publication statusPublished - 15 Apr 2015
Externally publishedYes
Event5th Cybercrime and Trustworthy Computing Conference, CTC 2014 - Aukland, New Zealand
Duration: 24 Nov 201425 Nov 2014


Other5th Cybercrime and Trustworthy Computing Conference, CTC 2014
Country/TerritoryNew Zealand


  • Cyber Security
  • Cybercrime
  • Hacking
  • Malware
  • Profiling
  • similarity


Dive into the research topics of 'Mining malware to detect variants'. Together they form a unique fingerprint.

Cite this