比较三种哈希算法在恶意软件聚类中的表现，助力安全检测优化。
Comparative Analysis of Hash-based Malware Clustering via K-Means
- 用K-means算法对比SSDeep、TLSH和IMPHash的聚类效果。
- TLSH和IMPHash生成更清晰、语义明确的恶意软件簇。
- SSDeep更适合宽泛分类，效率更高，适合快速筛查。
随着日常生活中数字设备的普及，网络攻击面持续扩大。攻击者不断寻找新途径利用这些设备并部署恶意软件。为应对这一挑战，现有检测方法通常采用基于哈希的算法（如SSdeep、TLSH和IMPHash）来捕捉二进制文件间的结构与行为相似性。本文聚焦于使用K-means算法对这些技术在恶意软件聚类中的表现进行分析与评估。通过实验验证已知恶意软件家族及特征，结果表明：TLSH与IMPHash能生成更清晰、更具语义意义的聚类结果；而SSdeep在更广泛的分类任务中表现出更高的效率。研究结论可为构建更稳健的威胁检测与自适应安全机制提供指导。
原文摘要 · Abstract (English)
With the adoption of multiple digital devices in everyday life, the cyber-attack surface has increased. Adversaries are continuously exploring new avenues to exploit them and deploy malware. On the other hand, detection approaches typically employ hashing-based algorithms such as SSDeep, TLSH, and IMPHash to capture structural and behavioural similarities among binaries. This work focuses on the analysis and evaluation of these techniques for clustering malware samples using the K-means algorithm. More specifically, we experimented with established malware families and traits and found that TLSH and IMPHash produce more distinct, semantically meaningful clusters, whereas SSDeep is more efficient for broader classification tasks. The findings of this work can guide the development of more robust threat-detection mechanisms and adaptive security mechanisms.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。