Comparative Analysis of Hash-based Malware Clustering via K-Means

• URL: http://arxiv.org/abs/2512.09539v1
• Date: Wed, 10 Dec 2025 11:24:35 GMT
• Title: Comparative Analysis of Hash-based Malware Clustering via K-Means
• Abstract summary: This work focuses on the analysis and evaluation of techniques for clustering malware samples using the K-means algorithm.<n>We experimented with established malware families and traits and found that TLSH and IMPHash produce more distinct, semantically meaningful clusters.<n>The findings of this work can guide the development of more robust threat-detection mechanisms and adaptive security mechanisms.
• Score: 0.9134244356393665
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: With the adoption of multiple digital devices in everyday life, the cyber-attack surface has increased. Adversaries are continuously exploring new avenues to exploit them and deploy malware. On the other hand, detection approaches typically employ hashing-based algorithms such as SSDeep, TLSH, and IMPHash to capture structural and behavioural similarities among binaries. This work focuses on the analysis and evaluation of these techniques for clustering malware samples using the K-means algorithm. More specifically, we experimented with established malware families and traits and found that TLSH and IMPHash produce more distinct, semantically meaningful clusters, whereas SSDeep is more efficient for broader classification tasks. The findings of this work can guide the development of more robust threat-detection mechanisms and adaptive security mechanisms.

Related papers

• Applying Graph Analysis for Unsupervised Fast Malware Fingerprinting [4.558679802785059]
  We propose TrapNet, a novel, scalable, and unsupervised framework for malware fingerprinting and grouping.<n>TrapNet detects packed binaries and unpacks them using known generic packer tools.<n>It generates a digest that captures the underlying semantics.
  arXiv  Detail & Related papers  (2025-10-07T05:02:45Z)
• The importance of the clustering model to detect new types of intrusion in data traffic [0.0]
  The presented work use K-means algorithm, which is a popular clustering technique.<n>Data was gathered utilizing Kali Linux environment, cicflowmeter traffic, and Putty Software tools.<n>The model counted the attacks and assigned numbers to each one of them.
  arXiv  Detail & Related papers  (2024-11-21T19:40:31Z)
• Online Clustering of Known and Emerging Malware Families [1.2289361708127875]
  It is essential to categorize malware samples according to their malicious characteristics. Online clustering algorithms help us to understand malware behavior and produce a quicker response to new threats. This paper introduces a novel machine learning-based model for the online clustering of malicious samples into malware families.
  arXiv  Detail & Related papers  (2024-05-06T09:20:17Z)
• Bit-mask Robust Contrastive Knowledge Distillation for Unsupervised Semantic Hashing [71.47723696190184]
  We propose an innovative Bit-mask Robust Contrastive knowledge Distillation (BRCD) method for semantic hashing. BRCD is specifically devised for the distillation of semantic hashing models.
  arXiv  Detail & Related papers  (2024-03-10T03:33:59Z)
• Reliable Malware Analysis and Detection using Topology Data Analysis [12.031113181911627]
  Malwares are becoming more complex and they are spreading on networks targeting different infrastructures and personal-end devices. To defend against malwares, recent work has proposed different techniques based on signatures and machine learning.
  arXiv  Detail & Related papers  (2022-11-03T00:46:52Z)
• Deep Image: A precious image based deep learning method for online malware detection in IoT Environment [12.558284943901613]
  In this paper, a different view of malware analysis is considered and the risk level of each sample feature is computed. In addition to the usual machine learning criteria namely accuracy and FPR, a proposed criterion based on the risk of samples has also been used for comparison. The results show that the deep learning approach performed better in detecting malware.
  arXiv  Detail & Related papers  (2022-04-04T17:56:55Z)
• Increasing the Confidence of Deep Neural Networks by Coverage Analysis [71.57324258813674]
  This paper presents a lightweight monitoring architecture based on coverage paradigms to enhance the model against different unsafe inputs. Experimental results show that the proposed approach is effective in detecting both powerful adversarial examples and out-of-distribution inputs.
  arXiv  Detail & Related papers  (2021-01-28T16:38:26Z)
• CIMON: Towards High-quality Hash Codes [63.37321228830102]
  We propose a new method named textbfComprehensive stextbfImilarity textbfMining and ctextbfOnsistency leartextbfNing (CIMON) First, we use global refinement and similarity statistical distribution to obtain reliable and smooth guidance. Second, both semantic and contrastive consistency learning are introduced to derive both disturb-invariant and discriminative hash codes.
  arXiv  Detail & Related papers  (2020-10-15T14:47:14Z)
• A black-box adversarial attack for poisoning clustering [78.19784577498031]
  We propose a black-box adversarial attack for crafting adversarial samples to test the robustness of clustering algorithms. We show that our attacks are transferable even against supervised algorithms such as SVMs, random forests, and neural networks.
  arXiv  Detail & Related papers  (2020-09-09T18:19:31Z)
• Bayesian Optimization with Machine Learning Algorithms Towards Anomaly Detection [66.05992706105224]
  In this paper, an effective anomaly detection framework is proposed utilizing Bayesian Optimization technique. The performance of the considered algorithms is evaluated using the ISCX 2012 dataset. Experimental results show the effectiveness of the proposed framework in term of accuracy rate, precision, low-false alarm rate, and recall.
  arXiv  Detail & Related papers  (2020-08-05T19:29:35Z)
• Deep Hashing with Hash-Consistent Large Margin Proxy Embeddings [65.36757931982469]
  Image hash codes are produced by binarizing embeddings of convolutional neural networks (CNN) trained for either classification or retrieval. The use of a fixed set of proxies (weights of the CNN classification layer) is proposed to eliminate this ambiguity. The resulting hash-consistent large margin (HCLM) proxies are shown to encourage saturation of hashing units, thus guaranteeing a small binarization error.
  arXiv  Detail & Related papers  (2020-07-27T23:47:43Z)
• A Survey on Deep Hashing Methods [52.326472103233854]
  Nearest neighbor search aims to obtain the samples in the database with the smallest distances from them to the queries. With the development of deep learning, deep hashing methods show more advantages than traditional methods. Deep supervised hashing is categorized into pairwise methods, ranking-based methods, pointwise methods and quantization. Deep unsupervised hashing is categorized into similarity reconstruction-based methods, pseudo-label-based methods and prediction-free self-supervised learning-based methods.
  arXiv  Detail & Related papers  (2020-03-04T08:25:15Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.