Comparative Analysis of Hash-based Malware Clustering via K-Means

2025-12-10

AI Summary

This study systematically evaluates the effectiveness of three hash-based similarity measures—SSDeep, TLSH, and IMPHash—in K-means clustering for malware family identification. Using real-world malware samples, it quantitatively assesses their capacity to model structural and behavioral semantics. Results reveal that TLSH and IMPHash produce semantically clearer clusters with higher intra-cluster consistency, significantly outperforming SSDeep in fine-grained family discrimination; conversely, SSDeep remains indispensable for large-scale preliminary screening due to its superior computational efficiency. The work rigorously delineates the applicability boundaries and configuration trade-offs among these hash functions—e.g., sensitivity to code obfuscation, robustness to semantic-preserving transformations, and scalability under high-dimensional feature spaces. By providing reproducible empirical benchmarks and actionable guidelines, this research establishes a principled foundation for algorithm selection in semantic-aware malware clustering.

Technology Category

• Machine Learning: Clustering
• Data Mining & Knowledge Management: Semantic Web
• Search and Optimization: Metareasoning and Metaheuristics

Application Category

• Web Mining and Content Analysis: Normalization, clustering, classification, and summarization of Web text
• Security and Privacy: Large-scale security measurements
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Abstract

With the adoption of multiple digital devices in everyday life, the cyber-attack surface has increased. Adversaries are continuously exploring new avenues to exploit them and deploy malware. On the other hand, detection approaches typically employ hashing-based algorithms such as SSDeep, TLSH, and IMPHash to capture structural and behavioural similarities among binaries. This work focuses on the analysis and evaluation of these techniques for clustering malware samples using the K-means algorithm. More specifically, we experimented with established malware families and traits and found that TLSH and IMPHash produce more distinct, semantically meaningful clusters, whereas SSDeep is more efficient for broader classification tasks. The findings of this work can guide the development of more robust threat-detection mechanisms and adaptive security mechanisms.

Problem

• Analyzes hash-based malware clustering using K-means algorithm
• Evaluates SSDeep, TLSH, IMPHash for malware sample grouping
• Identifies effective techniques for robust threat-detection mechanisms

Innovation

• Uses TLSH and IMPHash for distinct malware clustering
• Applies K-means algorithm to hash-based malware analysis
• Compares SSDeep efficiency for broader classification tasks